{ "analysis_details": { "creation_time": "2017-08-17 15:53 (UTC+2)", "execution_successful": true, "number_of_processes": 7, "termination_reason": "timeout", "type": "analysis_details", "version": 1, "vm_analysis_duration_time": "00:02:27" }, "artifacts": { "files": [ { "filename": "C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\agraba8.exe", "hashes": [ { "md5_hash": "91a61e3be9cc7251972f6ee8d4836cb4", "sha1_hash": "f78c091a623c605e74511dd80d1a48376c2c4145", "sha256_hash": "3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\098073.doc", "hashes": [ { "md5_hash": "e458cf8ec7484ba8e24650b197d3e234", "sha1_hash": "4bd7a1b511c1f33f635ce05045ad66c4cb3840a5", "sha256_hash": "58d2c72e0806714172ed49659b1c967a78de387e5b330850968fb4e823474794", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\098073.doc", "operations": [ "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", "hashes": [], "norm_filename": "c:\\programdata\\sun\\java\\java update\\jaureglist.xml", "operations": [ "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log", "hashes": [], "norm_filename": "c:\\programdata\\mozilla\\logs\\maintenanceservice-install.log", "operations": [ "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", "hashes": [ { "md5_hash": "80039ca09841855c3ee8ec73cd941036", "sha1_hash": "4480cc705cd39cf26adc2f7cd58561cd92e691fd", "sha256_hash": "1515834129378b5fd8759b35c1561ae7413b34d6879c5ad6f10cb9828de77201", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\1C8jivFwqY_v.xls", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\1c8jivfwqy_v.xls", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\ZgsodtON.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\zgsodton.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\uv7fKGVoQ2Jb7.xls", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\uv7fkgvoq2jb7.xls", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\_BYbdV.ods", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\_bybdv.ods", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\~$098073.doc", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\~$098073.doc", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\0xY2zyvX Zz5I6TOq4m.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\0xy2zyvx zz5i6toq4m.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\0YmBkUpDTKvL.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\0ymbkupdtkvl.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\_n9i7UNGQlTHEkQ9n65.ots", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\_n9i7ungqlthekq9n65.ots", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\6 EzXVOVC4Mq.ods", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\6 ezxvovc4mq.ods", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\86HHW2XyBUJyZf.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\86hhw2xybujyzf.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\0CA4J37R3gLfIG x-yY.odt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\0ca4j37r3glfig x-yy.odt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\0Q64daekSd8g.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\0q64daeksd8g.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\GQc8.ots", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\gqc8.ots", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\A4tJ-zen y.odp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\a4tj-zen y.odp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\gxamJ-HMXiK0nNB-ChDC.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\gxamj-hmxik0nnb-chdc.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\AofloKRSx6EqvwHf tV.ots", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\aoflokrsx6eqvwhf tv.ots", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\D8nCf-5QuttckP.odt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\d8ncf-5quttckp.odt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\H 34byGorwd3.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\h 34bygorwd3.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\izRfTW.odt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\izrftw.odt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\bwXEB4I4JkSNwm.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\bwxeb4i4jksnwm.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\C5Ehab.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\c5ehab.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\fsb9bUgRCgwl4dnWSx.odt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fsb9bugrcgwl4dnwsx.odt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\MDETt7XI.ppt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\mdett7xi.ppt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\MB-yqTrORXhMOe.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\mb-yqtrorxhmoe.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\nNYiB9XHa kx1Nj0TSz.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\nnyib9xha kx1nj0tsz.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\numLCBTSa6GhcpDwzxf.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\numlcbtsa6ghcpdwzxf.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\-v4o9DqP.odp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\-v4o9dqp.odp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\2T-3O.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\2t-3o.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\outlook files\\sdjwh@dive.djh.pst", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\e3jdD AhhDmJ.ppt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\e3jdd ahhdmj.ppt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\pHA-WtfIuB3x.ppt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\pha-wtfiub3x.ppt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\VevSo7gmHU.ots", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\vevso7gmhu.ots", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\RaGQtsBU4.odt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\ragqtsbu4.odt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\Ys7hE_EPaSvOAKC.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\ys7he_epasvoakc.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\RCuamB3hI8kb2INA.ods", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\rcuamb3hi8kb2ina.ods", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\rXZZKm4g6OK9.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\rxzzkm4g6ok9.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Te2yCCyBh24.odp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\te2yccybh24.odp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\aLldt37So 5xCJ\\mUJ7Tow.xls", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\alldt37so 5xcj\\muj7tow.xls", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\iGbKMT66Nt d OO.xls", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\igbkmt66nt d oo.xls", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\OwJVc55xap.xls", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\owjvc55xap.xls", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\g3uu.odt", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\g3uu.odt", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\ShV11k3.ots", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\shv11k3.ots", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\td5UFDZoyduoRv-UX.xls", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\td5ufdzoyduorv-ux.xls", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\w138BdKfP5oikOfg f.pptx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\w138bdkfp5oikofg f.pptx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\Tl3GVm4MVU0MvXfGYuVU.odp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\tl3gvm4mvu0mvxfgyuvu.odp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\WhVF-K7m2h 9Ki2J.xlsx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\whvf-k7m2h 9ki2j.xlsx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\p3i2AVU6sbThPuu.rtf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\p3i2avu6sbthpuu.rtf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\_wLCg2yNbmoGGi.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\_wlcg2ynbmoggi.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\Um6ac xaRWrq3ZwHex.pps", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\um6ac xarwrq3zwhex.pps", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\ehbu75um3wvro9aSR.pps", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\ehbu75um3wvro9asr.pps", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\fc7shkFFqXcMBE_pu.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fc7shkffqxcmbe_pu.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\k5jcwCH7962.rtf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\k5jcwch7962.rtf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Clg5pDW.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\clg5pdw.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\cqM03WsMqvf.rtf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\cqm03wsmqvf.rtf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\jrZUr62deGwb.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\jrzur62degwb.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\m5XXH25oGduC2.rtf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\m5xxh25ogduc2.rtf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\1G6BTt0rvWc.rtf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\1g6btt0rvwc.rtf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\CCwA9ID7MwdTmr.rtf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\ccwa9id7mwdtmr.rtf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\r1_647.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\r1_647.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\TrbkUrGWd.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\trbkurgwd.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\XMZB_eGDIWAF.pps", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\xmzb_egdiwaf.pps", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\VygBeG2O_CoUDZ0ri-y.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\vygbeg2o_coudz0ri-y.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\f2t Xh6k.pps", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f2t xh6k.pps", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\czmBJ.docx", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\czmbj.docx", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\2hVBnJTXBLe0.csv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\2hvbnjtxble0.csv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\8KgurcPGpDs5t.csv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\8kgurcpgpds5t.csv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\Af6epVD_ptV-.csv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\af6epvd_ptv-.csv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\uzQVRf8Ab6Zlxci59iY5.csv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\uzqvrf8ab6zlxci59iy5.csv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\qFSpDSqJ5ckg.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\qfspdsqj5ckg.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\desert.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\bJIMR_DP-n.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\bjimr_dp-n.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\koala.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\9A8DdJheRUIQ_Ny.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\9a8ddjheruiq_ny.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\NHG0O.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\nhg0o.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\AT4EGhpKo4u.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\at4eghpko4u.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\i2NYxg2uc_Xdiq4.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\i2nyxg2uc_xdiq4.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\st1os2.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\st1os2.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\6fTf.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\6ftf.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\L5Wat-o9ZxSO52M2hy_.jpg", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\l5wat-o9zxso52m2hy_.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", "hashes": [], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\OZhWRjVb5.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\ozhwrjvb5.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\mk3Q8l7gVRDjyXXB.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\mk3q8l7gvrdjyxxb.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\fgtu.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\fgtu.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\aci3.png", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\aci3.png", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\COLwLh6JcRBU0.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\colwlh6jcrbu0.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\lvLOYOhTcvvr3 yEH.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\lvloyohtcvvr3 yeh.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\gXdxZsT0C5_j5.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\gxdxzst0c5_j5.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\HmCN--W\\f3vo8D7NyvoaKcAkRsY.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f3vo8d7nyvoakcakrsy.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\6SCeJgmwXwG2GjK0Jp.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\6scejgmwxwg2gjk0jp.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\uoE18q.png", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\uoe18q.png", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\tClzdjxzFnQ5k.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\tclzdjxzfnq5k.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\6UEh0WGr8W.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\6ueh0wgr8w.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\8umgBK9 _uxC-P0clK.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\8umgbk9 _uxc-p0clk.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\kMVEz0TO.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\kmvez0to.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\CS rWU_9qBGaWWl2CS.png", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\cs rwu_9qbgawwl2cs.png", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\Ou8E5Tf1Sws.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\ou8e5tf1sws.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\Mx7rpkHkHEU4LD.png", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\mx7rpkhkheu4ld.png", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\LSk3e_y_Z.png", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\lsk3e_y_z.png", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\7EK45zr96-R7KlQSQB5.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\7ek45zr96-r7klqsqb5.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\ogZmmq5hx8.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\ogzmmq5hx8.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\QsiOxSCE.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\qsioxsce.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\Y_FO-Az1Ng2.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\y_fo-az1ng2.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\AHEE1OIJ1w.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\ahee1oij1w.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\0_64JkgHfEkBiBb6l.gif", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\0_64jkghfekbibb6l.gif", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\WB2Drlh.bmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\pictures\\wb2drlh.bmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\C-DDFnNneMnC3LawF.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\c-ddfnnnemnc3lawf.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\dOHwDq.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\dohwdq.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F8hMF6kNB.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\f8hmf6knb.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\FrPnIN5nkI.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\frpnin5nki.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\IUVwA7Tr1T_-Isj.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\iuvwa7tr1t_-isj.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\j-scGKW u_.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\j-scgkw u_.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\LAk9JPgeyPGa1dIfJP.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\lak9jpgeypga1difjp.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\LisXqkX_EZX.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\lisxqkx_ezx.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\nk-ypDwqGFeK9N.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\nk-ypdwqgfek9n.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\NzdrgktZ.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\nzdrgktz.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\NzYBBJl9pba5h.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\nzybbjl9pba5h.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\28a7m.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\28a7m.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\5a CD.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\5a cd.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\68_-mk gLP.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\68_-mk glp.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\7w7S_UlISa3.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\7w7s_ulisa3.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\BpH_tgEJy5Xpr.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\bph_tgejy5xpr.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\CcdGKWAWrhI8xFJ.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\ccdgkwawrhi8xfj.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\dsXG2.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\dsxg2.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\e0ajYWavTiTc8vxhoYhm.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\e0ajywavtitc8vxhoyhm.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\epFY_vnRuzs.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\epfy_vnruzs.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F4ENR-Pu8LXCQZh7xOQc.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f4enr-pu8lxcqzh7xoqc.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\JinnQGZRvm31pijVuxNA.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\jinnqgzrvm31pijvuxna.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\jYupwHhYlEf.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\jyupwhhylef.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\k9Ct.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\k9ct.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\PgYW nGFmTuPUNXUwq.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\pgyw ngfmtupunxuwq.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\qKMaBu0E4qs17fQHw.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\qkmabu0e4qs17fqhw.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\rhjg7pMy.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\rhjg7pmy.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\RpIimbK2wdoSlqmx.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\rpiimbk2wdoslqmx.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\SSm4dCFGv.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\ssm4dcfgv.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\ttLID7ogL6LUJu1L5.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\ttlid7ogl6luju1l5.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\v6Xlq.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\v6xlq.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\VDux-7HT2lWMCS_sfY1E.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\vdux-7ht2lwmcs_sfy1e.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\wiwYP97gesozht.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\wiwyp97gesozht.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\xdiH1Dx3ohQnc.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\xdih1dx3ohqnc.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\YDlFcD1yCL2Rp7.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\ydlfcd1ycl2rp7.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\uG775ameeOobeX0HE.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\ug775ameeoobex0he.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\upnIa15Gc.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\upnia15gc.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\1E2KN90cFWYD.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\1e2kn90cfwyd.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\aMCimEHovpv.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\amcimehovpv.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\DeN-pBWXL-QGo4Re.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\den-pbwxl-qgo4re.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\i97TREDet3.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\i97tredet3.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\IIJa.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\iija.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\l-Vn7zJZk5KM rTdu.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\l-vn7zjzk5km rtdu.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\N0q0_jKdd.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\n0q0_jkdd.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\PQ4Ji1zlt7H.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\pq4ji1zlt7h.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\PxMz-DaEz.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\pxmz-daez.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\q3jafQj919wjB.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\q3jafqj919wjb.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\tdJtW4XGAbfx.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\tdjtw4xgabfx.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\TQO7VlrhrN2iROvxW.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\tqo7vlrhrn2irovxw.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\ulQERW_UXqYGHPV_.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\ulqerw_uxqyghpv_.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\W-MpCtMmi.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\w-mpctmmi.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\yv8TpvMdu0.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\yv8tpvmdu0.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\4csml7.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\4csml7.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\aLldt37So 5xCJ\\Da3Cs8ioIcfSOE.swf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\alldt37so 5xcj\\da3cs8ioicfsoe.swf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\59JR3lNu.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\59jr3lnu.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\WjX4e.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\wjx4e.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\2O2msMjE8 v3PZje-.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\2o2msmje8 v3pzje-.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\25w3DegZoT.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\25w3degzot.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\7nbksoZkyYF4fahzyE.swf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\7nbksozkyyf4fahzye.swf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\h wpWI.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\h wpwi.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\I_LPQZX1r2pOZ.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\i_lpqzx1r2poz.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\mdlkCE 7Mu-OGE29yaZ.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\mdlkce 7mu-oge29yaz.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\UETE8.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\uete8.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\UoYsAzDu.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\uoysazdu.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\W6ZB3DB7-xAUK1zZacTk.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\w6zb3db7-xauk1zzactk.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\z AIP.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\z aip.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\6PLcPv.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\6plcpv.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\7 hNkoOuqhuUPb4WBN\\ryXtE3BJzHtC.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\ryxte3bjzhtc.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\7 hNkoOuqhuUPb4WBN\\ueTgIfGdCBC8HX.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\uetgifgdcbc8hx.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\7 hNkoOuqhuUPb4WBN\\_DXKgbJSQ.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\_dxkgbjsq.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\bRUXQf.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\bruxqf.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\gq2odSlVTX32RO7-UPJ\\-SEWASLi_AhMGq.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\-sewasli_ahmgq.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\gq2odSlVTX32RO7-UPJ\\Herk5RK.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\herk5rk.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\gq2odSlVTX32RO7-UPJ\\WTGYwX_xAAyiysOv.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\wtgywx_xaayiysov.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\9ELHlX71.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\9elhlx71.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\hU-6eYaCn.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\hu-6eyacn.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\jHPdC0WPi4JYh1.flv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\jhpdc0wpi4jyh1.flv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\wKIU.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\wkiu.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\BmSmMoZk2gCziPMvpsZ.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\bmsmmozk2gczipmvpsz.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\eSi7n7P2AfSI0U.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\esi7n7p2afsi0u.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\G36Xd28j-O.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\g36xd28j-o.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\ROpsn4ybvdCclm8gHa1.avi", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\ropsn4ybvdcclm8gha1.avi", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\Z VwmDF.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\z vwmdf.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\HktBrKL.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\hktbrkl.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\rnbs_ lcM4.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\rnbs_ lcm4.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\YDhL-_Oa9J5GrHs.swf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\videos\\ydhl-_oa9j5grhs.swf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\zmW_Fl42FVSkYv_yq.mp4", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\zmw_fl42fvskyv_yq.mp4", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\Eq2x ys5Wy ICJP.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\eq2x ys5wy icjp.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\fSOLDrtbCkwq.mkv", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\fsoldrtbckwq.mkv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\HmCN--W\\2ZAx.swf", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\2zax.swf", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\HmCN--W\\X1J-XzbtNP4bcL.mp3", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\x1j-xzbtnp4bcl.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\0j6ddd daqyN2jsKY.wav", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\0j6ddd daqyn2jsky.wav", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\AETaDb8fj.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\aetadb8fj.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\agMKSA0gka9nzokIE.m4a", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\music\\agmksa0gka9nzokie.m4a", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", "hashes": [], "norm_filename": "c:\\users\\public\\music\\sample music\\kalimba.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", "hashes": [], "norm_filename": "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", "hashes": [], "norm_filename": "c:\\users\\public\\music\\sample music\\sleep away.mp3", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", "hashes": [], "norm_filename": "c:\\users\\public\\videos\\sample videos\\wildlife.wmv", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\Aclviho ASldjfl.contact", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\contacts\\aclviho asldjfl.contact", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Database1.accdb", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\documents\\database1.accdb", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdobeARM.bin", "hashes": [ { "md5_hash": "8ded640a6e355cadf1df2b462bda48e1", "sha1_hash": "f0dbde76b2c3ca0e60ff37ae5eab2204978f420c", "sha256_hash": "dc155298478f78533c31b2d2093dfb992ed2b2ee957d753a032ef053bcce110d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adobearm.bin", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\sikvnb huvuib.contact", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\contacts\\sikvnb huvuib.contact", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\lulcit amkdfe.contact", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\contacts\\lulcit amkdfe.contact", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\chucu jadnvk.contact", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\contacts\\chucu jadnvk.contact", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\asdlfk poopvy.contact", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\contacts\\asdlfk poopvy.contact", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\Administrator.contact", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\contacts\\administrator.contact", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-B1DC6762-4F6CBAB10E0B.lukitus", "hashes": [ { "md5_hash": "6abad91ef2ea344540ffc34da13283b6", "sha1_hash": "444af778f297eccb339123c5959f07a8f89b4224", "sha256_hash": "0f1be91f6d873b31a92eb731c8724746101f75f78a758afcd1516957ec5dc43f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-b1dc6762-4f6cbab10e0b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-1FC77E46-75D0D332D675.lukitus", "hashes": [ { "md5_hash": "776ba4d91050761e680a84012e71145b", "sha1_hash": "f57630ed5b959114fe4d1c15fb41fdbeea492764", "sha256_hash": "17ee0c6ce1f0f32f4661c5aea15558cf056a6bdb20241a2094dc5f3b28d1a6e0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1fc77e46-75d0d332d675.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-F71E2D7C-1A58C58CDE47.lukitus", "hashes": [ { "md5_hash": "a50862100d2462158111dcc9938ff0af", "sha1_hash": "d7f39e3759e9360dd5629aa202acd3699409aa0a", "sha256_hash": "674cd1b6db3d4f950ab79a328944aeaffc2811020ef10bc0ff55fcc037aeabe7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-f71e2d7c-1a58c58cde47.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-68C82DF1-14B4D804BD61.lukitus", "hashes": [ { "md5_hash": "772a87a10bc58301219c75e82450f9d5", "sha1_hash": "a40f092d065c3a19b9529198fe98d5eb4f170601", "sha256_hash": "ffda15c8587df4ba7a0529d32594b6f46f9b99e8d1e6c16f5f9e18614bcd493c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-68c82df1-14b4d804bd61.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-49CF61EE-57465675BB4A.lukitus", "hashes": [ { "md5_hash": "9e0b618eea6c393041ab77e094c91cdf", "sha1_hash": "45837778384830ce66481c4b3605f60ff55c3bf3", "sha256_hash": "c0a44b8e12f625b0c73a5bcdf7cc38b0bc3152c16828ceb3c4232fc2d3eea4aa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-49cf61ee-57465675bb4a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-1E43A153-B4FA5BD13C64.lukitus", "hashes": [ { "md5_hash": "dca25bc771722b0031cd105fe3afb3de", "sha1_hash": "40c83aacedbac1f5dabb83f01b4108745a619455", "sha256_hash": "9afc3f3637a2782cd25e488df9584bec16c21e41c0d12c8bae65588976fccabb", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1e43a153-b4fa5bd13c64.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-746C6C5A-DDDAFA9FE1BD.lukitus", "hashes": [ { "md5_hash": "1265daa90eedb3c9b3ec895a7e2cc859", "sha1_hash": "f756f23b8f219dd1a177efd5067d33895df91eba", "sha256_hash": "44c237217af69cc53029b4335a8bf8f7c920494a683a857122b432d698fcf40b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-746c6c5a-dddafa9fe1bd.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-D050F35D-DF08FE665915.lukitus", "hashes": [ { "md5_hash": "b9d9f966203227eda7672af260d586b5", "sha1_hash": "445fbf1d9de7746bd9f3abc64a580b6ac2806b6d", "sha256_hash": "144ba74c09c895dce58edace591b7e263326b38368c030a86de17061e82a1d8b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-d050f35d-df08fe665915.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-6562EF8E-9356A0B9D778.lukitus", "hashes": [ { "md5_hash": "bf911c31fe23672abda64b65389368f0", "sha1_hash": "0519b3dc9527c0ffc2f0cd9e84ebc8bac072e291", "sha256_hash": "7b44f04bfd993affe249736dbbe704776ca010f61babf56c93c730094b282a74", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-6562ef8e-9356a0b9d778.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-02DDBB2E-DDA7EEF606E5.lukitus", "hashes": [ { "md5_hash": "4fc9141920f3a9a5d2267c61332fc10e", "sha1_hash": "83958705c423b40e7cde22ba24fc4efb881695d1", "sha256_hash": "4f574655f1fcc3084f0008008ab6c986fcd988602591aa6b9aa0af4ae8cc49bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-02ddbb2e-dda7eef606e5.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\0619171273D7A52EB51EE135D94A8C63.tmp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop\\0619171273d7a52eb51ee135d94a8c63.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-DD1F464E-1D4279836981.lukitus", "hashes": [ { "md5_hash": "7e7be556fe089933e12989e93bee08fd", "sha1_hash": "3a776d1c6650c69a2c7bd1b944b45b038df9b0b3", "sha256_hash": "07860428399bba38220f9ba9513d34b4dca67da2927fcdb7382f9129000b824c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-dd1f464e-1d4279836981.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-7CCB072C-C1747AEA88B6.lukitus", "hashes": [ { "md5_hash": "fb5d26ae8d42dca9f83189a46d7aafe6", "sha1_hash": "4244ea22d4acbf5bb1ad36ecdb2b764166f1e92e", "sha256_hash": "d71b7fb4437a0406ad8f9874529946f5856714b53e38e831a8f4eeebcea3872a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-7ccb072c-c1747aea88b6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-6F1F87E1-0611DE322330.lukitus", "hashes": [ { "md5_hash": "6a52bfb9267d0f422a0184a0fe14d6f5", "sha1_hash": "b4133b1d05faa54df705f30a46c433a43014da51", "sha256_hash": "e2015345d5922a8fe3676a1c7e8c940d64d169b1b8b7f5630052b49234f3c552", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-6f1f87e1-0611de322330.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\F56924BE-9663-41BB-93122862-1B3365D6FC4A.lukitus", "hashes": [ { "md5_hash": "885fda6005971a82db16ad2bd29041a4", "sha1_hash": "1c406fd6df0744789ec498a1abf925ad8ec60a3a", "sha256_hash": "a5f248aec0548330dbb26391181cff2f72849242524d84870c8e30d7423c5b5e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\onenote notebooks\\my notebook\\f56924be-9663-41bb-93122862-1b3365d6fc4a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-7F7DF4F3-FEE5A0F835D8.lukitus", "hashes": [ { "md5_hash": "c54fc8af819d898b850ac5fdd43254ed", "sha1_hash": "7bcc4fae19b21c006c7425add419be78de3f1a68", "sha256_hash": "72a36bd4de31602c8dd2e6eb16786c95f11cb307d0dd5ef5ff78bfe3edf0274d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7f7df4f3-fee5a0f835d8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-42DA6451-74994B3B23EB.lukitus", "hashes": [ { "md5_hash": "c65660792799d623f815201d4ed54c7d", "sha1_hash": "264c33cb60857a0dfd1b4d9d8f766188f8886e8c", "sha256_hash": "99c93e6b9ab37b41c663069c5355756c3a7d05fd75552452c2421dc877f743e3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-42da6451-74994b3b23eb.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-E0725B46-87EAD7FBFED8.lukitus", "hashes": [ { "md5_hash": "194a630851f7e2e2f5e013b0ab70e94e", "sha1_hash": "12f1365c7d8b0b5006eb5f7e660f34e6a2be5ffa", "sha256_hash": "58d6317026fb76718b3b13e75763750a069dd1d491d260be1dd09ac2b4d618f9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-e0725b46-87ead7fbfed8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-527C0C14-E324030A4A6E.lukitus", "hashes": [ { "md5_hash": "b2e545b0b9f937ee1514f461838326c3", "sha1_hash": "83fd7b53bef8f92179b46bb43bd887eff6c0e4dc", "sha256_hash": "29bc3313cf80fec7b70b8b0acf41d194d24abfb8d0edd3bdb9f0c75d2d813651", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-527c0c14-e324030a4a6e.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-526E1A2B-128166908518.lukitus", "hashes": [ { "md5_hash": "31475f1b4f38f56ea9f3fb892a129ca1", "sha1_hash": "35e503bddb6773d2ec4fa56fc0342551370bef18", "sha256_hash": "bd739976c57e1d7275a52304b7d7b0bdeba5516e08ae3024680f8fbdc41aa071", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-526e1a2b-128166908518.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-15FBD8AA-4D0A91F58ED4.lukitus", "hashes": [ { "md5_hash": "f0a3789f2aaa76213cb01112e22b0a9b", "sha1_hash": "cd3895ed6ec7e35bc79691d6818a9cce1d3e75d6", "sha256_hash": "96c26e9da10586ee9dceed556236713e4798193d86c19e2a49f314385890e401", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-15fbd8aa-4d0a91f58ed4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-F1FCDEAA-FF7F06504774.lukitus", "hashes": [ { "md5_hash": "676f2fcb58be85dca079aed3c0307b14", "sha1_hash": "312cfed40b006bd070a17d3598638c8a43cf9268", "sha256_hash": "39f27549d5c9a2dcf360ea7730117d5db1057faf98f7505a6313319a837f64d7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-f1fcdeaa-ff7f06504774.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-1D9844F4-6DCE132FA911.lukitus", "hashes": [ { "md5_hash": "6d5e20a0682136d3786edaadd4386eca", "sha1_hash": "b89a45a4d8203f18eae7505c41537ab488891a05", "sha256_hash": "50c7a84443a0102ed402d843e3066c78b171839a130533cbc4e4bb841710aab6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1d9844f4-6dce132fa911.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-988E0A99-75C5268FA982.lukitus", "hashes": [ { "md5_hash": "01f852000bbcb39ac92aa22b36104f32", "sha1_hash": "d73eb40b00de0979342b96cc29879cca7f62d509", "sha256_hash": "1bd6dfb3d97d3e31b19c4efc27c3676237153b34fea49aed5d7aea5bf1cbbfae", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-988e0a99-75c5268fa982.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-14D6A72B-E51A5D5DC391.lukitus", "hashes": [ { "md5_hash": "d1ccedf54e7d148c94dd92abd10e0ebf", "sha1_hash": "be302c7a6536983bc29e6874b4eca6457a25c98d", "sha256_hash": "50534e5328d077935daf7c0fe860c489005810bab3d36edf768a5295e7405a6f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-14d6a72b-e51a5d5dc391.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-65272A78-F5925D3FA2A8.lukitus", "hashes": [ { "md5_hash": "e15288fe1acec5be28093a52d52bf408", "sha1_hash": "bbf0386872ddc6fc426beca0eaf5c1d76d4135bc", "sha256_hash": "f6871b99f685682d86176db35b1ca8b302607accc6ae0c8141ddfb4bd3d24708", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-65272a78-f5925d3fa2a8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-CE32CC3F-EBE8612BBB20.lukitus", "hashes": [ { "md5_hash": "7e1d44b9e9949f1dcc44df1cb77b4ce3", "sha1_hash": "a74b0c652eba8eaa1c10151253cf92475ffd9c8b", "sha256_hash": "1e1a422b1424e7f9340050fb708843f8c2d75a719d37512cbbb7cff41da80bde", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-ce32cc3f-ebe8612bbb20.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-CDA913E8-271056AB5827.lukitus", "hashes": [ { "md5_hash": "27db40185ac2b07a15df545ef2678a80", "sha1_hash": "dcd3ea567c7229127c1d74ebd2ad1cb5d081bad4", "sha256_hash": "d1225f27f37022bbd8bb885e22488197dd3374ad12bc452f1d40509a890c9484", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-cda913e8-271056ab5827.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-BA7682C3-CEEF9FBF020C.lukitus", "hashes": [ { "md5_hash": "4c6380666702b4a9498f07e2116bb164", "sha1_hash": "c7776d7c7d25d7877ec146943b7958f47dbb29c8", "sha256_hash": "9c4266a994efdcd75b39a7f6fb17e4ee1106f9eb4643bf2fdb971e5735da886d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-ba7682c3-ceef9fbf020c.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-FDD27FFA-D0B0AF905888.lukitus", "hashes": [ { "md5_hash": "bfde86a708ed6f8850ba5b5ed119840c", "sha1_hash": "7cc914837ecff162b4c0fb7def66d3e3440bbe60", "sha256_hash": "50b497246a384d66af186e1d98d2a475d97539a02729f805f8cb84b9e6e19782", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-fdd27ffa-d0b0af905888.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Outlook Files\\F56924BE-9663-41BB-612962EE-CDA06FAA83D1.lukitus", "hashes": [ { "md5_hash": "99dc604e6316b4a06151d52b041246b5", "sha1_hash": "eb7f0255ad4028acd7bff986993f5a494f73e5d3", "sha256_hash": "c3324f5e81082ff027fc770e463281b5876976b139f88cc24824e692ba27db81", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\outlook files\\f56924be-9663-41bb-612962ee-cda06faa83d1.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-8C112ABD-8E26AA86B08A.lukitus", "hashes": [ { "md5_hash": "e082a12ca21ea266ab9b9b161f174415", "sha1_hash": "9b2b62d9a09d455bd5885cd1893316122781e7b4", "sha256_hash": "8b2e8cfe601fe954d4975dbc64d3b60ee4549ad080414aa799a9f849ecf02b09", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-8c112abd-8e26aa86b08a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-02ED3F77-9C606D75C05C.lukitus", "hashes": [ { "md5_hash": "0c4780c26232d65f38c435568a283c80", "sha1_hash": "2f4b40dd9a6f30a49f9b5235e9dd9a08fbf7efa5", "sha256_hash": "bd13f30a9947916e13dddd18dc3aeced0fa40a9c1142b7248cf0d339a0016974", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-02ed3f77-9c606d75c05c.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-781DE6A6-E5A7705BB692.lukitus", "hashes": [ { "md5_hash": "ef37e81fbcd78a587fe70e70bddcb967", "sha1_hash": "e685217ccfb73b9a6922d56404be0fdb6ecb7087", "sha256_hash": "43a0d03bf7797de26a60ecdea7139450823eccd41c68cca78580d5f86e0a0809", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-781de6a6-e5a7705bb692.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-7B55CF77-61F436AD3E42.lukitus", "hashes": [ { "md5_hash": "9d9a97256dae66413e871a5f5d43a517", "sha1_hash": "d7ddfa8b1202e255e5dba150958e6d1d85b420d4", "sha256_hash": "29d9dceec2db1c66b2cd8064c1767557086c8b9157891564a6d5720f513b3e4c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7b55cf77-61f436ad3e42.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-A771A452-48DD4BA9679E.lukitus", "hashes": [ { "md5_hash": "3ee359090152ec94da64d6dbe5bbc799", "sha1_hash": "8edcc53621f8ac41d272577daf0e159755638f93", "sha256_hash": "5b8829637915f6af31bee9eba73a6f521217b94926fb3667631300397d41d5f7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-a771a452-48dd4ba9679e.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-B282F5D6-2A6D69715153.lukitus", "hashes": [ { "md5_hash": "ab965e83e2eb2f180dc264c431a95365", "sha1_hash": "a42f75fb6ccd7b090f873bb74bebd5dbabe36587", "sha256_hash": "551327f7b8862e2682f26ff105ee328c7a99860c9b3b510501e483c92b093c18", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-b282f5d6-2a6d69715153.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-3A6DB1CA-755757C28FE3.lukitus", "hashes": [ { "md5_hash": "7f6c8851cc5ea831b374025e26aeee8d", "sha1_hash": "c3954c511bc2521138ecc2e1d88bfbe26fe48e40", "sha256_hash": "21136f752aa9e46b591aa4b52dac4282a7a0789acfcdb71d47d5ce95079a7085", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-3a6db1ca-755757c28fe3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-A9142EC9-2EFEBC30ADE8.lukitus", "hashes": [ { "md5_hash": "641e0e999b0fb9f59ee67e99926ba912", "sha1_hash": "d4b94289b0631439864046a593714b6e0e033c4d", "sha256_hash": "d12ac6afc663ddc778f3ecc28e5fc90729b65a5072ca33c192bb9422ce62e29f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-a9142ec9-2efebc30ade8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\aLldt37So 5xCJ\\F56924BE-9663-41BB-D65A438B-83DFABBB8CED.lukitus", "hashes": [ { "md5_hash": "6e9af0cc8bcf2fa16f861f5e58ec2628", "sha1_hash": "a63de682a5feb2c95af786dd6df44823531810f6", "sha256_hash": "f35bd6b431d60d92171acb7e00fc7a8d9f542910d99619a390797bec49c929ba", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\alldt37so 5xcj\\f56924be-9663-41bb-d65a438b-83dfabbb8ced.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-BB96571E-96BBD2C0A8B9.lukitus", "hashes": [ { "md5_hash": "bbe54ff129630a5dfd8678ddd9aa3c59", "sha1_hash": "dc3ef9c5cdb18b8094c6cb5a99da648b0abfb202", "sha256_hash": "660f420ce546f6714efa7a0a4cc6964fd2be7b29c46b2e15382753969a1ef9d0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-bb96571e-96bbd2c0a8b9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-41FC6DD4-65A22D7F605C.lukitus", "hashes": [ { "md5_hash": "62b011e83e86e7077823d885d1bd2f6a", "sha1_hash": "489c8f2431864bcbc1ea9803767f97782311f299", "sha256_hash": "94e6b2608712fbb162be540f2a78632ed74cac57b3db7de1fc6f62898911d919", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-41fc6dd4-65a22d7f605c.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\F56924BE-9663-41BB-6C56A97B-E7E6A4AA125B.lukitus", "hashes": [ { "md5_hash": "ea428f35f421f3a4b0d2a4a46bdc4051", "sha1_hash": "114fca0136be8b192de0de76fe3203203382ec62", "sha256_hash": "d4e401cef6051ff974180b327f9c4234a67dfa07e56b9313dba5735ec0404ec5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-6c56a97b-e7e6a4aa125b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-A60CE289-E55A447535D2.lukitus", "hashes": [ { "md5_hash": "e15198354fa0c3c3e4dc76f9a8208910", "sha1_hash": "71a89ea03798dafd9228861e65f3570ce74b9164", "sha256_hash": "49caef250b7bc24751001002b12d043b17620e7aa8004696e19967bb8b2a790c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-a60ce289-e55a447535d2.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-21F0CA53-F69E38A75CC4.lukitus", "hashes": [ { "md5_hash": "8970e86ba4de3c42745f25fdd54ae197", "sha1_hash": "6eb90349f272dbea69efe746cbc394059f845dd8", "sha256_hash": "8fedbbb46e330730684e9a9d812a59fc57adb6c18d04ceacc35754277bd253d4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-21f0ca53-f69e38a75cc4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-4B69E5A7-F60E62FE4654.lukitus", "hashes": [ { "md5_hash": "4583cd56d09e37fc0ff4dfdf04479540", "sha1_hash": "49106e215048c20ce86bcfe9f908899a9399bcb0", "sha256_hash": "fbea91064706acd43c1fc6facec79a8c82cf6a6b6fb2cf0783a7f44d6dc9cb3c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-4b69e5a7-f60e62fe4654.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-541108F9-2DA524F314C7.lukitus", "hashes": [ { "md5_hash": "5816b177c84d1e4b863230be0d9b9155", "sha1_hash": "02f22b739ca7aa67f2c516ab3ea123f792331e61", "sha256_hash": "1a8848a90f9aee5f5bdeed6888f423920691f2c5f39be46ed56a4c729404ad15", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-541108f9-2da524f314c7.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-43743AB0-5B4F9943C7B9.lukitus", "hashes": [ { "md5_hash": "30795453a10b70ca931d8fe543dfc0f8", "sha1_hash": "4348bad3bba73608970b5a077b1c55fd0d427ffa", "sha256_hash": "6a1a9268cbfd7e9c5f8ec150ac2551c2ff78a7a79ce2b0af9ebd049abc7a9398", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-43743ab0-5b4f9943c7b9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-3F7EEA71-EEAB13681EBA.lukitus", "hashes": [ { "md5_hash": "f18da71f888de931c6d290190ee237a4", "sha1_hash": "fc1e5754c9fc56908667ecf8bdf6d267e951e90e", "sha256_hash": "4e5f5f0e1e2724b82bfff92ab479d236385d5240fb370047bee42d15017ee289", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-3f7eea71-eeab13681eba.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-44E29957-51107F7F4923.lukitus", "hashes": [ { "md5_hash": "f1e6b4a6cc6867fc03350e84c3c35441", "sha1_hash": "001b04bdf199936d2718ef025a2c138fec1e9b8b", "sha256_hash": "6016bd71e598ce5808efa9e10aa4ee25706b088817596649177a0db54b984650", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-44e29957-51107f7f4923.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-B70504B4-E9A7156822C1.lukitus", "hashes": [ { "md5_hash": "3aa6f3df2b8863ba677b0fce9d227f3b", "sha1_hash": "654428393afb60031d4d6dff4ae21170e19d1402", "sha256_hash": "d045abcd1d24931a3a988e8ab2f3ba2ee52178eb22ed4260d78392d133fc38d0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-b70504b4-e9a7156822c1.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-3C30F310-5C6049E3F1C5.lukitus", "hashes": [ { "md5_hash": "0f1e68e87c1e3926b00f03e9fd4314c6", "sha1_hash": "69d4fbff5e0b93c276b12cd5df74f59cd7c68bd8", "sha256_hash": "ec6da516a2e8ab7edc761e8dbf63ad5a39f144a559a54e3e9006d9d568d8708e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-3c30f310-5c6049e3f1c5.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-88736A33-A73FD1B5DB9A.lukitus", "hashes": [ { "md5_hash": "10bdd7483abd5c15780cd187eec6d3e9", "sha1_hash": "7c99aef210b09b55359f0b186e7ed6bba95ddc1a", "sha256_hash": "6cc4988052fc5268208c1aa802278a723729c40c317822f58603d3da4755a35b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-88736a33-a73fd1b5db9a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-49600478-A7543DF24F7D.lukitus", "hashes": [ { "md5_hash": "ecde9114fa71134e4ecd50f6769477eb", "sha1_hash": "49684d357f3b02e62331a8799d388af9b3947fa5", "sha256_hash": "aa71a2986de776387f5ed629e5a672b004f7afa098b9d2d571ee8f4777454768", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-49600478-a7543df24f7d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-7B6AFC43-B245CC6E1DD0.lukitus", "hashes": [ { "md5_hash": "2c5ba72782c99ecea584b9c58bcfd905", "sha1_hash": "7b2faa090039ac242ec7963df62d2dfc747112d6", "sha256_hash": "afabc17789bc548a251043b4ee9b9d48237914694991bd44d596077a65729a9d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7b6afc43-b245cc6e1dd0.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-026B0F52-B0EE23B731C2.lukitus", "hashes": [ { "md5_hash": "0b48798fab9d59f4cdc78ca9a7df98d7", "sha1_hash": "6ee7d9e79c939d896d8dfc59e93bfe1629f048ec", "sha256_hash": "888e468487916657638ce4d470e13a0ad0bfda2a5d5176974ac9c5429dc81cfe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-026b0f52-b0ee23b731c2.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-71AD6E57-D734BC0DC073.lukitus", "hashes": [ { "md5_hash": "4dece80ced1f7c0b40c0e71b9253ae6c", "sha1_hash": "c4cdfb836256228e788c938afa5480544a43421f", "sha256_hash": "d57dd4c701f4d7ace0f4eb88b08855349155bbac8be1e050342a97259182f2e8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-71ad6e57-d734bc0dc073.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-7B4E72C9-EC40CC1387F6.lukitus", "hashes": [ { "md5_hash": "6c589300bccff80e34e7ee89347ab822", "sha1_hash": "e47f983b65ea4bf4e521001b7332d875578f7457", "sha256_hash": "970f3cf452bd4aa7938e2ed7ab8a4332e1b60156b1fb95b9cd01c6559f5ee597", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7b4e72c9-ec40cc1387f6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-B233076A-F3F69BE0DE98.lukitus", "hashes": [ { "md5_hash": "674111b049564a315cb77810334b6812", "sha1_hash": "c380c52ebfdb46add2fd95277002555716fbf9df", "sha256_hash": "ecebe3573c7b92387ae8a27aa2d8f20f07c9b0ec02a574f2135601e7112883a6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-b233076a-f3f69be0de98.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-B0D08948-4AFDF1D5A73F.lukitus", "hashes": [ { "md5_hash": "58629c03a02f8949cedeb4264ae04000", "sha1_hash": "5354fad509be0ae80298573ac94b0fb1e3ab3553", "sha256_hash": "fd3874cafd3e153d71614dc0040cc91995be12f1960887f6e02d82be1c480be7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-b0d08948-4afdf1d5a73f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-E6373D05-052CD23B85B0.lukitus", "hashes": [ { "md5_hash": "c5bba3c53d13a5b64cc017e0a01699c3", "sha1_hash": "f61aa973b6b13874aaec4e5552460ae34ab7b467", "sha256_hash": "89d4c40bd26112498cc38a463859197e73e7d268fa423dadf30c74a942680ce9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-e6373d05-052cd23b85b0.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-0B1192D3-83011F532CB4.lukitus", "hashes": [ { "md5_hash": "fa8eeeb7176b52428f50c47cffda51a0", "sha1_hash": "0305bcf827446971e40619ce39195e5d50e26299", "sha256_hash": "acd89d750354acd177632d4f35b73cbb978c73410194e533d561ff26371eb022", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-0b1192d3-83011f532cb4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-0BD9344F-59E2FD1B8612.lukitus", "hashes": [ { "md5_hash": "390c978963fa6fcff45f6ff8fb706571", "sha1_hash": "fc13679abcbae212bd248c04369ee984829d5c21", "sha256_hash": "83978e3835fd145da977a36ff5594a90c8017549ab5978b7ec95d0034a3124cf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-0bd9344f-59e2fd1b8612.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-16AC9B2B-CF64176B99FB.lukitus", "hashes": [ { "md5_hash": "fe9bfe26bfca15c48c16c7e07c895ddb", "sha1_hash": "0830a240a25dd5b312f47e724372a29bc2814e60", "sha256_hash": "872bdcfed75cf02be4290f4bec9a88b4a331d0bf181b6e69855b43c7dfa83fde", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-16ac9b2b-cf64176b99fb.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\F56924BE-9663-41BB-6533C1E4-C0738507F428.lukitus", "hashes": [ { "md5_hash": "e5518c14c1615ce72e9fe3f20ed115f6", "sha1_hash": "ac707c1fc026c0f9976e22bb661a0bad2d4c0293", "sha256_hash": "4321f2bb650270e29efa859d59fdd1f367843abdaa1163231d36a0626ab23fd5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-6533c1e4-c0738507f428.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-D49BF973-E058168B454F.lukitus", "hashes": [ { "md5_hash": "3c622893d523c4b4cb2aa0f86108bd61", "sha1_hash": "d5e6fe17cb9eb5de11f650c91e679aeaa52ee463", "sha256_hash": "f39349480a4152ea8aa13c8eda001d9324c0c665b8f7a171baa3ce008cd59b70", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-d49bf973-e058168b454f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Sun\\Java\\Java Update\\72B0CBD499699DC37CF7F45B885A2C21.tmp", "hashes": [], "norm_filename": "c:\\programdata\\sun\\java\\java update\\72b0cbd499699dc37cf7f45b885a2c21.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-13F942E8-48EB76E84F48.lukitus", "hashes": [ { "md5_hash": "f6d233d0e54794f515e43c3957b4bd36", "sha1_hash": "c6e88abe0d62ed019a4a315ca93148e32d249887", "sha256_hash": "0fd7093c5030e4b23a5cf48c98cd315c8caafca22a9ee2baf5797a3e1f79cb73", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-13f942e8-48eb76e84f48.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-29A7DC8C-DFC0E8056306.lukitus", "hashes": [ { "md5_hash": "38312e874cc6187dd6df21fa661996e5", "sha1_hash": "75cb4df8e34e98118504825f6980de6615dc6f9e", "sha256_hash": "aebeffb8b208901908b42efbbd6ada7818009df9cc6dbdd16d2d87003a8c0a6d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-29a7dc8c-dfc0e8056306.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\F56924BE-9663-41BB-44CE3CD7-AFD504F36697.lukitus", "hashes": [ { "md5_hash": "015ae1bde6e5fec87cf588c3e391a541", "sha1_hash": "840c8e1cf059750555b3c523d8f373879428ab8b", "sha256_hash": "1522fed94f047caddf8819cb859caa543cf4dac5ddec13a0fc349bef54c148e0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-44ce3cd7-afd504f36697.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-1BCB39FD-C93E3B4C590B.lukitus", "hashes": [ { "md5_hash": "f437376e25b9953e5f49c245fb862780", "sha1_hash": "dccdceb4b973ae7415d377d29115ce5afa3c0c35", "sha256_hash": "c81e0492c58eb3f5ccaa7d8567f4a827a8ea6f71a46f229354f0fd6d9ffddb3e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1bcb39fd-c93e3b4c590b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-8EC36E5C-CA39E2CA23E1.lukitus", "hashes": [ { "md5_hash": "3b91a491b3fa287c78a534a50d2cf296", "sha1_hash": "b15340ac53f9bb3ac3e42bb05be0b1f83cd966eb", "sha256_hash": "6a8232b65ca125b44bb33194492922fc42bb9250de0905e377de8a73314bb54b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-8ec36e5c-ca39e2ca23e1.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-DB3A9C6C-B4A2996D18E4.lukitus", "hashes": [ { "md5_hash": "c7a0cc1ec3308de7726404756f4224eb", "sha1_hash": "1e6b31dadbe5ab38a5d91c548c66099f1841d165", "sha256_hash": "95d11560d5a43ec88a6abf98bf90599db244c3332565c0afb9b4cdc99e80f2f8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-db3a9c6c-b4a2996d18e4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-63F06B4D-40748180C2C9.lukitus", "hashes": [ { "md5_hash": "eb2b55105302183288147363c55327b2", "sha1_hash": "f45c343692c552032c1becc8c04dcf524f980b9b", "sha256_hash": "d49aecda2c122fc9c5b0bfcf377297600ddf2a77d9d9a456f995682250a20890", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-63f06b4d-40748180c2c9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-2128228C-3EF411E166F1.lukitus", "hashes": [ { "md5_hash": "c992e8f974b5f9f9cde843e199bbe780", "sha1_hash": "30e07368b76be57ad85cbc1ddc0f0ec6546b891e", "sha256_hash": "93f55ef6b0be02288a81713828056490fa63b92618a0e94a767f4c1ca9ba77fe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-2128228c-3ef411e166f1.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-7D28049F-CA2DC98D9072.lukitus", "hashes": [ { "md5_hash": "609dd4e8666f15060b352c277496b383", "sha1_hash": "3d5c85361e5d94a474785e5226a0d904814c89f2", "sha256_hash": "027d71512c9a53eeb25f3a1a1f151cd86dc44de15e6c205bf121e658ed28fa09", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-7d28049f-ca2dc98d9072.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-D0039C86-9E680BA77E12.lukitus", "hashes": [ { "md5_hash": "0cae6416a51b268c9180d03f59d92dc5", "sha1_hash": "8deb398747c130d5b16251a6bcf6832f71931bde", "sha256_hash": "7480b58b1ab6137d68cc828284920c935c30038e6f196380c3cc0818667a6191", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-d0039c86-9e680ba77e12.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-16DB964B-DDB43481F1DB.lukitus", "hashes": [ { "md5_hash": "69cd8258f01125b41414f4441106351e", "sha1_hash": "b12037b8e0b3ca3118e5af1c01800ca5b3616b1c", "sha256_hash": "d31ab02d80c5e8b60eeab53a17c4ad59e35596ccd71ffbbee9f7e7fb1ee30506", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-16db964b-ddb43481f1db.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-8EA4D603-5A2874FAE3FC.lukitus", "hashes": [ { "md5_hash": "ff5c86ab51b783858399547f89eecd26", "sha1_hash": "bca7b2364baf01c154f886b21b8d20cbfa0ada6d", "sha256_hash": "78c50b44e3fc2ce3ec7fc8869c4119d1f1b34bd5f9196f82fce154c846827fe7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-8ea4d603-5a2874fae3fc.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-BEA9B2D7-58D4FA770E74.lukitus", "hashes": [ { "md5_hash": "4e52eca69058b5b90c3cde991c6fd074", "sha1_hash": "f59c4f09d5aafd93b52f7db3ec872fab6abe73f7", "sha256_hash": "3fbc6b06e92ec7067183adefbc0b01b2d8eb5d74cd05a24f67cb83f0af1a63a3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-bea9b2d7-58d4fa770e74.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\F56924BE-9663-41BB-34C63D6D-4A50106C55BE.lukitus", "hashes": [ { "md5_hash": "ad9fc03fdd67cd9298591ea0d12f9347", "sha1_hash": "d08c6626fc2d953917239146aa9dd157967f9c8c", "sha256_hash": "efa59c6e1aceb673a673a44fa7259970adced9049ad1ba518793a34a9bcc31b3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-34c63d6d-4a50106c55be.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-6AE0090E-6CDCB46C0311.lukitus", "hashes": [ { "md5_hash": "5ac26135af6fc8fe57d50c009b23a973", "sha1_hash": "826b2d4b79875fb6b9ed0b54c41c8b47c6b80e34", "sha256_hash": "86be99489223371ded8182569b025831e04cd54239c4d688aa021ae5f5b1fc07", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-6ae0090e-6cdcb46c0311.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-3B2B7F6F-812656DF84C6.lukitus", "hashes": [ { "md5_hash": "cc16e88d461b2a64a0a07952011b6c78", "sha1_hash": "af3fa4ea7f69bc944db7bc8a8c7604524aab4960", "sha256_hash": "af85ec3bf7280380e72c235d78709e7503ae93b9202d26e23ddd92882c7371b5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-3b2b7f6f-812656df84c6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\F56924BE-9663-41BB-FA0D154B-245888D727E3.lukitus", "hashes": [ { "md5_hash": "ca8ce82168e9cf9cf3e17e811d8012ae", "sha1_hash": "4d088416707db0ee6142c662e65102f48d5fb884", "sha256_hash": "a7f002038faba925f927b8f413df6a76340dc71e88918357bc7562ccda14c087", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-fa0d154b-245888d727e3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-85AB3CAB-1A0670314428.lukitus", "hashes": [ { "md5_hash": "186014ca84f18a2a0a4cf027197c3659", "sha1_hash": "5e9a50e85d5b48227b523c373a7b9440f2efa9db", "sha256_hash": "be55916dfabe1669c8523e6e0a87df65e73faa665875aa26e99e8f0369499714", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-85ab3cab-1a0670314428.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\F56924BE-9663-41BB-1753EF9E-5A7F628573FD.lukitus", "hashes": [ { "md5_hash": "125ed2e35e1356ec3ce7af04d089cf6b", "sha1_hash": "17987b1957027fa4bcea9f3296c4f4b2a696256f", "sha256_hash": "5ae802bc9c55e110e649bc8f375bb060218f0138e31d071f76f82363c00c87f0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-1753ef9e-5a7f628573fd.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\F56924BE-9663-41BB-6EDC54F4-2A6316BC2A6D.lukitus", "hashes": [ { "md5_hash": "8d9d2ea39d85168297b0c8463aa91048", "sha1_hash": "354e90bd9f3f0b30ca32b69be03bd8fb4f638125", "sha256_hash": "7561bca5b6c8df3f4f7f7e36f03bb0bc3edea4025ad99b1b03630f355a63678a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-6edc54f4-2a6316bc2a6d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Pictures\\Sample Pictures\\F56924BE-9663-41BB-AD1CA3C0-3165AB58AF89.lukitus", "hashes": [ { "md5_hash": "4ce15772a2aac9a6add35ad06980e018", "sha1_hash": "f0bf0b4046527293854810e644625d675019bdc2", "sha256_hash": "9df69ae1c809db7fb5cbe188b0f9d88e86dec488d44d5ac8f33fe284e3615294", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-ad1ca3c0-3165ab58af89.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-5D8CB0E5-0F44328ECAF2.lukitus", "hashes": [ { "md5_hash": "263038a221405a16c3acb6db5ebe9c65", "sha1_hash": "70cc3921b3c6718efc69b559c044e47aaab3b4dd", "sha256_hash": "fa6a71c1b63fd9d33b7d252b8f53d7db96645299269b92028ba8d5ca5b34f023", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-5d8cb0e5-0f44328ecaf2.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-0725FD16-48003B943989.lukitus", "hashes": [ { "md5_hash": "7db96eedf7fbf29176b3f971cc7850fc", "sha1_hash": "97e28ab0727fed8be616863e4994fc8e01ff028b", "sha256_hash": "5ed5325f19dccd610d97e211a461e9e7c7bd3b2a76337074a57690d218aad144", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-0725fd16-48003b943989.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-21EA5F2C-8701A72F2220.lukitus", "hashes": [ { "md5_hash": "6c5f6d6c1f9cb1698087815dae3ae6ad", "sha1_hash": "88fc8e84ec4a5a1df24c99ea8d9325b3150e1d07", "sha256_hash": "6d78af00ca0852baa7fcb08b8a5cecb51fc1ed2451c1af3fc9832e35a8b24a5b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-21ea5f2c-8701a72f2220.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-5EEEF7E5-307233FEB153.lukitus", "hashes": [ { "md5_hash": "875bd5e3e0eff4b0d987ae366d7e6041", "sha1_hash": "c40e0cf6dcefcc47bcb333be2ba4b36346a74fb1", "sha256_hash": "6026dcd8bdb731eeebd07c9111a9eb27dadd78366758b155ff87d6b2d0ff5160", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-5eeef7e5-307233feb153.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-105FD1E1-6C6BE53496EA.lukitus", "hashes": [ { "md5_hash": "d17b3d430fde8beeed17cc0efb664ab1", "sha1_hash": "6d76f7c3d691e026700c5cdbe6158bd42b21972b", "sha256_hash": "aeae24d279b192567f7a90b71371ada1d8a8f75855884e6ea1a734a5f454df7b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-105fd1e1-6c6be53496ea.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-0DCFA9E5-FAF41D841F89.lukitus", "hashes": [ { "md5_hash": "da6e9f7e90d23867edd35d848ddc5aaf", "sha1_hash": "fc8889186c0193b52b3d54a4cbe509be027f330b", "sha256_hash": "ff27ae1c3d97c77c38bc0dbbd43af610807a60b4110faa713837181384cfb326", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-0dcfa9e5-faf41d841f89.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-4FE46AF0-E6208DFC4337.lukitus", "hashes": [ { "md5_hash": "5e564cee97c6dfe94cf72453127fd8f5", "sha1_hash": "6dc03568c39255efa7e4ea35913b0066d7a26a3f", "sha256_hash": "d05b35f4f554bd90937a62728f4ddedb55ea1a932e794798c175ac0dd73ccbe9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-4fe46af0-e6208dfc4337.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\HmCN--W\\F56924BE-9663-41BB-8EBDCA29-FD38B8601764.lukitus", "hashes": [ { "md5_hash": "9dfa0bee9df987f02306da67434a65a7", "sha1_hash": "9b7c61c830e942ea271ffa047d6eda694058abf6", "sha256_hash": "6566cb2b42873520944bbfeb9578d12caad563f5e945bade9314d867a9821ec7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f56924be-9663-41bb-8ebdca29-fd38b8601764.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\F56924BE-9663-41BB-BFE5064B-970C8F5A0518.lukitus", "hashes": [ { "md5_hash": "3f844b86b9c824437f480abad28c6c99", "sha1_hash": "c1ea0086f2d686ce51e87a19cf37b41e6fa90d14", "sha256_hash": "3a8f1508d6a20477182d64710204aa832adcc0699dff1e67da0b198a864dd5a6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-bfe5064b-970c8f5a0518.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-85A5B08A-605B60B6EBD6.lukitus", "hashes": [ { "md5_hash": "4df6e6740c263aa385de7ab8d612c2f0", "sha1_hash": "5b8561902d5b06e84d2dca6e20495664de89175e", "sha256_hash": "b33ac7b2c77c3f2feb83405ac5eaeb3fa4d60b20b2c05a8c06443a314a104a81", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-85a5b08a-605b60b6ebd6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\8lYa8AgxgSi0\\F56924BE-9663-41BB-88881914-B3AE12B46247.lukitus", "hashes": [ { "md5_hash": "c7fc4e55b879a5c4bb78bf9364d2b18b", "sha1_hash": "53b90e5c4e2ad6c5b99484bc893a213e581b2b07", "sha256_hash": "b771cd820eed03b368ea27b206dea765c6c48ba4ed97cd48b3d2d320312ff033", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-88881914-b3ae12b46247.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-786F2966-85DD58079D16.lukitus", "hashes": [ { "md5_hash": "af7714a87bb259577f9cd70ba3b4a43f", "sha1_hash": "8d5d1151035a895ad1c59328d8bfbb2873edf376", "sha256_hash": "b6f4a6687bd21aed052c4ec0847537fce383cb022701e275145efc4844451766", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-786f2966-85dd58079d16.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\F56924BE-9663-41BB-160875AB-8C16168EF4DD.lukitus", "hashes": [ { "md5_hash": "d6ffc919dd46ef2225ad09abb6b03cb3", "sha1_hash": "3d38abbb116daa61173c8a05eb20eb14997fa28c", "sha256_hash": "4bdbe60d8db008ce218a5c184c91b41176025d6a18e09edefc28581ad4d86413", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-160875ab-8c16168ef4dd.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\F56924BE-9663-41BB-169E6313-C430F979B7E3.lukitus", "hashes": [ { "md5_hash": "0eb5d0a5a5a1c44e54259d4385118891", "sha1_hash": "e2b9f0fe121aefc6def63636ca6f75dd12400811", "sha256_hash": "82596611766de45740b6b6a930b97aff8f8053925a3173424bdf9b7f73fa2858", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-169e6313-c430f979b7e3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\F56924BE-9663-41BB-ED8E90B1-C99EEB3CD344.lukitus", "hashes": [ { "md5_hash": "1336a8270def600025b9e56b32364fd2", "sha1_hash": "f0b7a35386e13258f201612900d830b72907839b", "sha256_hash": "b482c547d6c27c38404265e23e89eee5b08a2a9cda977c6777a586f9407f43d1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-ed8e90b1-c99eeb3cd344.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\_2aELz\\F56924BE-9663-41BB-D8D6A0BE-1EEB096F86F6.lukitus", "hashes": [ { "md5_hash": "54691b48c2c6a9cac8fc27e298e243c6", "sha1_hash": "5819a5f2c9476cb1695b7be464e667c83cc4df23", "sha256_hash": "c8a694b9b45d39f0e8cf97fa56356fe2e624aae6ab1b4d41326f3509d5696ffe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-d8d6a0be-1eeb096f86f6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-C18F2589-5C71BF4F3255.lukitus", "hashes": [ { "md5_hash": "b8e392254147a37a185517b4f6b3042b", "sha1_hash": "b630e4ae8ef2ffc2de66e87aac945a40a9287693", "sha256_hash": "5f578fde878f6aad06bc4d9e6595544840e9dd9a9380907ba4adedf8a3c4104b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-c18f2589-5c71bf4f3255.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\F56924BE-9663-41BB-A5D5084D-DECB3B0C7615.lukitus", "hashes": [ { "md5_hash": "6d481224bac4a1e375b34aaab96f3125", "sha1_hash": "928b5cfed88226f6f8e55f44dab1511f603dfb39", "sha256_hash": "98da131ca6f3fc566c73ced50216f3a3be3056925bcf15f2ac5f10827abae3e0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-a5d5084d-decb3b0c7615.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-A080FC17-79D47057B610.lukitus", "hashes": [ { "md5_hash": "042b78909f13410e288ac87979e83d61", "sha1_hash": "8518bd401583d47d3665e6e3a15e0351e4510f8e", "sha256_hash": "4943e008dee7cfaa9017bc5762d32aaab9612f3c4a32ce504de784774c63ed44", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-a080fc17-79d47057b610.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\F56924BE-9663-41BB-1D9631E8-90BF411C2FEE.lukitus", "hashes": [ { "md5_hash": "006811bc5dafe18a5b3cbb8a6e05131d", "sha1_hash": "d355b436a6ceda728b93467c1c9dd5ace99e2c2d", "sha256_hash": "63cb3577f7b000f7b1525c50de49248fd795cfe7596afe1b4b16fa9fce8146e8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-1d9631e8-90bf411c2fee.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\F56924BE-9663-41BB-8B683683-04F707D56484.lukitus", "hashes": [ { "md5_hash": "2bca9c801bae8b187e614854dcfe45d7", "sha1_hash": "89f8ac79a5abbfc6bcb18871f76291b4bcfe1d98", "sha256_hash": "ff741da1614409e35ab97081ccbbd0acdc727eab1faea2464556dfa6f382325a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-8b683683-04f707d56484.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\97sFY1rz\\F56924BE-9663-41BB-ECB96FE5-208908824DC6.lukitus", "hashes": [ { "md5_hash": "133e56f297202ce2b8d6e56a58e51483", "sha1_hash": "79f080fa37c9b8e4b7d8589ac7872a51a853f19f", "sha256_hash": "4d0b86aae98709ac16bfd3c7c70d361fad7f8862ab72fff806a89a2af71a96dd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-ecb96fe5-208908824dc6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-61116ECA-F6682086BE7A.lukitus", "hashes": [ { "md5_hash": "d139fc83092b0854111e706415920b0e", "sha1_hash": "acc2618bc1f8047a7db70c0de263f554261b82eb", "sha256_hash": "31b652297f9c7406cf1a8ba5821f9e5bef71bc5ecd9c7f5994d0312497f61b3c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-61116eca-f6682086be7a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-0A72E3E6-09C6BD33AE22.lukitus", "hashes": [ { "md5_hash": "29b4e594c48dabb7444129b2a768267d", "sha1_hash": "940d4cedf379e2194cc1cd1d716e6b97ffa35264", "sha256_hash": "0cb11a43748c609b624ba2f700c2ec2ca89295212fd8bafe18ea9470adbe366c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-0a72e3e6-09c6bd33ae22.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Pictures\\F56924BE-9663-41BB-0F2DB1B7-ADEA5382834B.lukitus", "hashes": [ { "md5_hash": "131f61fb3e4a2e22a28b28f76cf85ea5", "sha1_hash": "e0063d8ef02c58e1473c851668fc47340a1cfa99", "sha256_hash": "3d36441a4038a8c4feb102ba50c6df7784b4dd07692988aa762a6d5931d948d1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-0f2db1b7-adea5382834b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-97BFBCF8-B516116E07DA.lukitus", "hashes": [ { "md5_hash": "60b29baa2723f1c9fc8ce005d4114859", "sha1_hash": "7ced67dbf0f687ad3bf18c945555278d26d2b688", "sha256_hash": "ec2dfc3efb3c6b0dadb82899beedfc99c3603cb75ae30378ce14b59c80615058", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-97bfbcf8-b516116e07da.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-9D05EF54-2DBBB8A0A892.lukitus", "hashes": [ { "md5_hash": "a36d01388c5b36b44cfb81b19d7748ec", "sha1_hash": "42b2837c3f3d166b08ace6d91c45a3c3f42e4a9a", "sha256_hash": "181df77c09a33d85e521fcda50da59471a616369e4465ab197782ee127af0c13", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-9d05ef54-2dbbb8a0a892.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-9260E0D0-755888374530.lukitus", "hashes": [ { "md5_hash": "01511775c3f72b14aa155c2192ba8ab4", "sha1_hash": "aa2fe6c8cd7b75981e0cc635814bb16547d10504", "sha256_hash": "df34c8df3cde7aab5b6a9cab0b987e65cdb9c2a4614729a1304264f7e79ecb43", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-9260e0d0-755888374530.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-753475AC-25E968E13AF6.lukitus", "hashes": [ { "md5_hash": "56a3ddd0fa9090b7b512025e5a401e20", "sha1_hash": "5d9198f39a76648b546fafd1f7dc9bc94e089f56", "sha256_hash": "d0ac77f4c7c1c4a64007f1c59cf668897b490308b8ba956701e127409fed7ad4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-753475ac-25e968e13af6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-3BB4B2F2-CD9A31BA95F9.lukitus", "hashes": [ { "md5_hash": "57e9752de10254dc8fb5ef62a1f56410", "sha1_hash": "42c91cf8722c0480ecfb35f1265a2791911bbe14", "sha256_hash": "fb58a6bbd7d1c99b7e253a680143a35ec66bd94b3f15dc1b0756904e57f134a2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-3bb4b2f2-cd9a31ba95f9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-67A2C15B-ACE8513D7DCF.lukitus", "hashes": [ { "md5_hash": "ee6948d23282c4d051ad0d84752b0b56", "sha1_hash": "7b5abaed205e052c48fce640dc3dcb1d10a5fca4", "sha256_hash": "0d64cc3faa9d4c777a382028cf622a067b843d0d8dab9a17780b72071292716a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-67a2c15b-ace8513d7dcf.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-1D8398A0-B0F041BD0889.lukitus", "hashes": [ { "md5_hash": "a3aa6f24770c48403987ef6d3f661a52", "sha1_hash": "f561518fee9ccba23ef7a8e607433fb91c522b09", "sha256_hash": "d7cae341a5b6bb064dcdcee0df2499049f58daf46bf77a68016ba9559a2b2212", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-1d8398a0-b0f041bd0889.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-26890357-3E98A81805A4.lukitus", "hashes": [ { "md5_hash": "e7f11bfabe783d3b2bd6a97bed38a1e9", "sha1_hash": "0fa8e4ddac14120abf524660207c23f96f96c1c9", "sha256_hash": "fb8939676fabc1d3c0bfc48cfaadf45264d2674271df638ff6d9c36ea5e65c51", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-26890357-3e98a81805a4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-920974EC-CC3AB8381775.lukitus", "hashes": [ { "md5_hash": "84844a574b55c3fd72c43876e6f7a6ce", "sha1_hash": "5fef2beafd23a7727ff7d302fe549303dc9d8375", "sha256_hash": "6597ae1e1846f265808e0a582ff3c728a875265a56d4573175c698fc6849420a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-920974ec-cc3ab8381775.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-2DAADF60-E156096DA44F.lukitus", "hashes": [ { "md5_hash": "af7bc76a7aeaad2b5e06fb6c590e62df", "sha1_hash": "2cc8ab65b2660e4a04eed3b43414a1d4cda9c447", "sha256_hash": "e62fc3fe20b9eb1f99e723bc1d4be399b86685f22981769c5a17c9412252c397", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-2daadf60-e156096da44f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-F0395898-EB4252148408.lukitus", "hashes": [ { "md5_hash": "f971962a5c41b255ea328959a1ea7f39", "sha1_hash": "b3ac71960dc96959e40b9cc11da8f90c5f9e9f35", "sha256_hash": "4aa6348f1b51026680973444c6a9babd4e52aacd166577443929910cd2467093", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-f0395898-eb4252148408.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-7C24AE20-0A25AA91C989.lukitus", "hashes": [ { "md5_hash": "165538794fdfd0e2328251c7c781a2ab", "sha1_hash": "ba5fb810268b57d4732ef05396b8b633dda1c839", "sha256_hash": "2a760cfbb662cd8bd56d1d0f19f1fa92693ce12ec2d954de48009ca3fe8eb05f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-7c24ae20-0a25aa91c989.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-FA254207-48D9BC68F536.lukitus", "hashes": [ { "md5_hash": "4c31fe3f0361af9550ae36539b089839", "sha1_hash": "26ad476bdcde39d53378e9088319ca10783edd3e", "sha256_hash": "90514fd2e74bd19016b4ad07e76f02c78879706943d54ab1d70fb5a9630b62f3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-fa254207-48d9bc68f536.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-3FFD1798-470C2125EAB8.lukitus", "hashes": [ { "md5_hash": "140820055bf5e7d1660cd5bb1aade4e1", "sha1_hash": "7bd54c718a37a7d4f9ae03d117c82ebc41c4cc89", "sha256_hash": "084866ed274468828acc947e3fbfa62af63ce5d84d9dfd8982e6f24e970ec2ac", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-3ffd1798-470c2125eab8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-7FC86D39-EF25D3B23399.lukitus", "hashes": [ { "md5_hash": "50dd1e09cfcc59186ea70aab583a9014", "sha1_hash": "ac284339d35535076b2620db326c64c73fc65d40", "sha256_hash": "bfb50446c27128c45569228fbe8ee381704ef171af508391dd8d095bc013f464", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-7fc86d39-ef25d3b23399.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-8E846290-5233B81C7D00.lukitus", "hashes": [ { "md5_hash": "5476591c0489ee38585f8992ca677a86", "sha1_hash": "1c3f5d0b9bbae08814391da2f7880db56aafff34", "sha256_hash": "847bc50b4aa2ab63fd4a335b7e84d5c406cd8a52fed00056797f45a859219f5b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-8e846290-5233b81c7d00.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-F4705DFD-535CF3EF79B9.lukitus", "hashes": [ { "md5_hash": "1173aaa14bf0f412fcd92b9265e318ca", "sha1_hash": "dc69d137034ba334da2e48950931ceee9f7bc66b", "sha256_hash": "3b14415e4304ecf7e1ac5f8004fa2a8b4ac5ced6423621044551142d0c710a7e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-f4705dfd-535cf3ef79b9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-E9F295FD-1189F8AFFE87.lukitus", "hashes": [ { "md5_hash": "d3f520654b53ca913a53cd3a859c1d82", "sha1_hash": "805699c2d6570747117cc26e80f73ef464592e7a", "sha256_hash": "5d94a353504c88bf20f4f5e87e613f4886ddceca86d6a45e778b0e8d5ea01c21", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-e9f295fd-1189f8affe87.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-BCF63BC1-5BBE68E793E7.lukitus", "hashes": [ { "md5_hash": "7c9c466123107a3796f043f83db191b4", "sha1_hash": "565bab6130419a45e1c17abddf1653012684762c", "sha256_hash": "54e7710271568c6e28b7f195071871debaa1586ec807077ea8d1282eda42b6aa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-bcf63bc1-5bbe68e793e7.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-6A36D603-50F4DEB3E87F.lukitus", "hashes": [ { "md5_hash": "44071515d6a0fc0c5cd8707c40ee2483", "sha1_hash": "3e0eb2903d9c2be66ac43753987ded0ebdeff7d2", "sha256_hash": "a79d934f2434fe5f5c6340a63ac71012f4116a0d3f6ab24612d7643a5de4ceb8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-6a36d603-50f4deb3e87f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-952D529B-BD0BE8B63751.lukitus", "hashes": [ { "md5_hash": "eaf9f4bca0dd2a177d12c2124c140ed5", "sha1_hash": "76157a8daff8551deb964be3c4f30592930af1c9", "sha256_hash": "26ac8ac44fa8cf45758f3e251ba3b05a221e9c1695d6ba5891949af72b28e654", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-952d529b-bd0be8b63751.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-B0BB4DF0-6CF812A4840D.lukitus", "hashes": [ { "md5_hash": "081e4d7f2b3b835e92872d746282d832", "sha1_hash": "ca08c720a5a78050824ac3941315a2fb2ff7c042", "sha256_hash": "8800474b7b18b9a417a6602e0d2b8cbf9b65b36194622bc019bacf7e5c8f30d2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-b0bb4df0-6cf812a4840d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-9BD64C04-AD5D37A21037.lukitus", "hashes": [ { "md5_hash": "41b1031a19e81a8b286987b988a52a18", "sha1_hash": "c2dd09e8573a0c2eb968e03ca3964b047c5fbae9", "sha256_hash": "0f4ee31358899953e6f01fd4401e129c08629cc51ad387f5468ce62dc4d4f42e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-9bd64c04-ad5d37a21037.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-873FF873-535F0466EFF8.lukitus", "hashes": [ { "md5_hash": "5b2280a98e3651768d842cc12b4f21aa", "sha1_hash": "8ac4cc828f3c8d362b6d24b4d2b8ddc6b7afbea9", "sha256_hash": "6285d80b671ce5a93871da7629e3304cf72026c1f241dcced7dcd57d1748a7ce", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-873ff873-535f0466eff8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-5239650A-9EFDEF59C32F.lukitus", "hashes": [ { "md5_hash": "7c7a7952a000f04ce424b1c50f2f5b8b", "sha1_hash": "d2700f1c08658d04b42cd4f06936bca69c219d92", "sha256_hash": "608e52f6978d52406745c1258d6185eb114452c84510fded24ab15804dd400d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-5239650a-9efdef59c32f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-6362E4F3-EAA74F3658B8.lukitus", "hashes": [ { "md5_hash": "645ecf9fa7463055bc11fde9b517cef6", "sha1_hash": "9682971234bf21b61d9a2b1fd397fc6e48af213b", "sha256_hash": "118bcd0d7817703514e9db00f8e3e4f4ae71c160b3110395abe6b321046f4c1d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-6362e4f3-eaa74f3658b8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-661EE13B-FDFC54F63D1B.lukitus", "hashes": [ { "md5_hash": "ec4f2070501910b59af19537f5be8323", "sha1_hash": "7d63abe1ca6d4cfad0e8c588ebdf8dae91f1b368", "sha256_hash": "1cd36d416e41761b8859721de85ee4a52a098379ba15fe13524d6c466184b91d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-661ee13b-fdfc54f63d1b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-BF55D3D8-FD0B023DC035.lukitus", "hashes": [ { "md5_hash": "778c095dd764625ba91cb02a45d8b79b", "sha1_hash": "f9bd6b2e018bef5da8ff61692557e479508faabb", "sha256_hash": "1f8ad422fad46dd52ad19bb2d405328d2ee0dfe994553a6eddcddd7032ec9484", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-bf55d3d8-fd0b023dc035.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-0B96A441-A5B4A8D7B326.lukitus", "hashes": [ { "md5_hash": "38bc4d603488cc1bdf138a94299c719a", "sha1_hash": "5d2fade9ae38856a1651e4d9adcd5e1defdf44a8", "sha256_hash": "700f05e8c8782542b907f30658135ca9d809de5993e4fe4f5979d75697cc1f7d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-0b96a441-a5b4a8d7b326.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-F670BB2A-DBB903142DC9.lukitus", "hashes": [ { "md5_hash": "87422ffe4d179c759661451418dc5c0e", "sha1_hash": "f7a56f39047837c4d9eb0c17aece9148b38a67f3", "sha256_hash": "e3052feddeb687b540cf36fbc2f353a77beac747ef2baf1ec2d2f668116229e4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-f670bb2a-dbb903142dc9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-69CD54EB-8041B408A46D.lukitus", "hashes": [ { "md5_hash": "527a009eada45914230997dbe319f744", "sha1_hash": "e9ebe047e60645131442e4999dbbaef4b4d72d55", "sha256_hash": "92ae45e2789eeef9af01d394c7586046d0ba7c18beed3acc081b3647cbb3d8b2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-69cd54eb-8041b408a46d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-25C14B11-AF52ACE93C08.lukitus", "hashes": [ { "md5_hash": "28e0fc035da4b2cdf85f74342fcbe79d", "sha1_hash": "00aaefd97a6bcce113b08407b97301dfcac679ee", "sha256_hash": "95109a28540b2216b4d2491da0b871bca5e9c69407cff7ed2b1ab70618e7fe6a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-25c14b11-af52ace93c08.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-63BEBF75-6E4F6B50A466.lukitus", "hashes": [ { "md5_hash": "e79ba289e2d4677465c0b352e8b31a45", "sha1_hash": "7568bfc6ee9542d5d1888dd7b796b4a4741bcb19", "sha256_hash": "12f426255c244da1ef318667f562233e7d52ea34dc614f94561e478ee4346c02", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-63bebf75-6e4f6b50a466.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-CFA9A4CA-C26C379710F3.lukitus", "hashes": [ { "md5_hash": "f8e8da7c94060c384549189ad7e9a85e", "sha1_hash": "ec519505672ac06ab384dac4a6fa3d955a72f91f", "sha256_hash": "978ecbea2eed5472b4a16c113db07aba71c9a29e0aa666052a421690d6dbb5cf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-cfa9a4ca-c26c379710f3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\qiS5lOMJG\\F56924BE-9663-41BB-085A70D2-BAEF6BF91BE0.lukitus", "hashes": [ { "md5_hash": "c04e000a69cf0d784dcfecd3f7572e80", "sha1_hash": "0fdd43461e5afdbf61284b55555a9dcb45f8346b", "sha256_hash": "60bc2a7d92061560c6d097fe903729cb8e302c280a84c57a80629fe25b387d0b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-085a70d2-baef6bf91be0.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-9FE00690-5BE45D83E6B9.lukitus", "hashes": [ { "md5_hash": "9ca72d4068da96a387e6392bf4241fa3", "sha1_hash": "e64d9e73f82986b365da4b34e9e020f7c55571de", "sha256_hash": "7cbe132bdec46a9cb394f6c6ca57a84edeaf770d385cecc23b3504fbb01205d5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-9fe00690-5be45d83e6b9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-DBCBC906-02DE713DF07B.lukitus", "hashes": [ { "md5_hash": "9d8f05c7fa3f17c4c1cb8a150bead52b", "sha1_hash": "0ce59d13adeda605423db1c4676a3ad9b022455e", "sha256_hash": "d4c6a8e910d320d7af494614de77895bdaf2c70deb5de28d1586f764bc72061c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-dbcbc906-02de713df07b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-C35B48E2-8851B50EB3F0.lukitus", "hashes": [ { "md5_hash": "6c45ed783a20717bb246b66194afdeb2", "sha1_hash": "e464d7ff8e610668d9e25e8f4f458a5fbcf7371a", "sha256_hash": "548c23541add5a2533d53033bc25656d8e8d23ddcfca75171dac5503f9057e43", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-c35b48e2-8851b50eb3f0.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-A9F24C29-70CE3C53B5EF.lukitus", "hashes": [ { "md5_hash": "e134b68ea240a77b60839677c62b4e80", "sha1_hash": "be2d5250b8280fdf5aeb7723c42295520f25ba3a", "sha256_hash": "0d157a8c158dc633e4132381d26a851dfb9db3301d63ba3a8999ffee87dceee9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-a9f24c29-70ce3c53b5ef.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-FB222AB3-C8884D7041DC.lukitus", "hashes": [ { "md5_hash": "22b1bef97fb7c8d48bb1c1633447ea72", "sha1_hash": "d656b5eee687b4521fd37457595d7a988e9213ea", "sha256_hash": "726fba39afe057b9496a033728e6347d3f0f61157cd458d181f1370280da0092", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-fb222ab3-c8884d7041dc.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-1D408981-C958DFF9603C.lukitus", "hashes": [ { "md5_hash": "7dac62939254c5ee724eab8baa666234", "sha1_hash": "53fb6c22d4791e153b049f5879548dee66b270ca", "sha256_hash": "3aac024af5b5d6868acc10678110102c9f36bdb38cd84f363ea34d8cec9e2ee7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-1d408981-c958dff9603c.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-D452C080-EA561CA54681.lukitus", "hashes": [ { "md5_hash": "259ad629fc43052d44e053a2e4f6255e", "sha1_hash": "4d0f3f58225dc39aabed48f172b0660078a81274", "sha256_hash": "0161073e077b6e1a3650501b67100b3b56dcc0ecf28415788b51db269b1a6a01", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-d452c080-ea561ca54681.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-24BB1763-4852852A6D22.lukitus", "hashes": [ { "md5_hash": "46c91fdcad6cf3fd10fff4f24210f6be", "sha1_hash": "683da0f7d3c641dffae4099855ca00be4f031f65", "sha256_hash": "2ead205eec2d739201e209a84c0e6ef8ea608569775cd1341ffd3627c51b98ab", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-24bb1763-4852852a6d22.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-DB63BF46-1ADCD8C466E4.lukitus", "hashes": [ { "md5_hash": "688abd0ab7bde445363c651a8dddb420", "sha1_hash": "3379dd7340fedc09f4c84c0d711bb6be6d97457d", "sha256_hash": "77747dc67090ce03d1c92174ae682dfd794f32c0bdaaf3c63146428d65dcd234", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-db63bf46-1adcd8c466e4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-A2DE357B-0DEE598770CE.lukitus", "hashes": [ { "md5_hash": "f1897eb375886c29b3bb58cdeb1e6d59", "sha1_hash": "25bd3908d4b46f172731ab4e9884fcaa8fdcf942", "sha256_hash": "c5a30b160b8cb332a7b573504c8b11c21f305d53cd4ff816597219e342e253ea", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-a2de357b-0dee598770ce.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-5252DC25-66A07229C2E2.lukitus", "hashes": [ { "md5_hash": "9a231b3055fda7177f92291c49411a98", "sha1_hash": "348dcceac3d2f6108b89d72f28538b65778566a5", "sha256_hash": "fd019c2bad4d8fd4590e3b280677c3ffb39a437803cb306f8fb0a4db9a323b26", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-5252dc25-66a07229c2e2.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-EC268A58-9F88B8863DE1.lukitus", "hashes": [ { "md5_hash": "8ad153dd6bce94f8d1a84cf049f74600", "sha1_hash": "67346109fc8e0d481ac5e55d0a2ab6a1bbd45e88", "sha256_hash": "a418dced3cb9198b0b028347eb57a5042f11d091ae54c507489aca80fe0c286b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-ec268a58-9f88b8863de1.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-B8F49F95-F22F2A860953.lukitus", "hashes": [ { "md5_hash": "d1be15064fde393875ec13209434815e", "sha1_hash": "c8e39e8e1dfe318ef978a3a35458b0f157355fe6", "sha256_hash": "a5146ba4fe73ca7a449fe450af91aea7598b9fd41f0d5a25dafb1a28066a6609", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-b8f49f95-f22f2a860953.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-AE89F080-8D2CF75E7B09.lukitus", "hashes": [ { "md5_hash": "d53b58628cfcb2f92a628f6801094ee1", "sha1_hash": "948e66ce622efb2421c61b1c01a3bd0b8f0e7c32", "sha256_hash": "d5708115123be56a4a45f9ae4ac2885abbb1dbe5f6882f992bb1e8517f1dec54", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-ae89f080-8d2cf75e7b09.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-1CE0B2C6-914F0C6C68E9.lukitus", "hashes": [ { "md5_hash": "408a6040b4e2fab164e1d4f4c97ad1a1", "sha1_hash": "9ec4ddb5fb5bcfca0a26e6fa8ab400e255c17d94", "sha256_hash": "2eea8e15ed3234a94f69110e4c946f887ae243104cdb320ee4a296eed8967d93", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-1ce0b2c6-914f0c6c68e9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-55B2160B-4B57C0D92397.lukitus", "hashes": [ { "md5_hash": "067252106fb22407c3a59bea275016b7", "sha1_hash": "372ca3f7baa13c1682308609bb577a77949aa08b", "sha256_hash": "dd0afa1260efa943debb2946d304760b340fa68304afe7f16781d9db1c3312e3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-55b2160b-4b57c0d92397.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-3FCF7E2A-E81A367BF706.lukitus", "hashes": [ { "md5_hash": "838bbff7d30530037e60f0db95b1f4b5", "sha1_hash": "8fef3c275f4a6c95844319921adb2ee8d2216f7d", "sha256_hash": "56815971ad0ebe4992e1e5660353bb18b40fc53380450f95988559b5167da304", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-3fcf7e2a-e81a367bf706.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\F56924BE-9663-41BB-51FECB82-FFCD7A7B4612.lukitus", "hashes": [ { "md5_hash": "5740358983c3e255afe2f3a83be38f45", "sha1_hash": "c642ca2aea02126c6dd567f596b235dbd0b065b3", "sha256_hash": "2290a70fe09e2f76ef4c3494a153dc65bb39e5373880b5f2ba8a9d99a5f72843", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-51fecb82-ffcd7a7b4612.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\aLldt37So 5xCJ\\F56924BE-9663-41BB-B1710BE7-DD08C11B7FEF.lukitus", "hashes": [ { "md5_hash": "120f764a0532c59275d1f3d9e1f4069e", "sha1_hash": "f44f3897b9ab4fca51353df7339b0c53b4198a9b", "sha256_hash": "ae04d627ac34b01e4e482212de1b7e91248a4b3f6d2da23f3a4eecf9e83b26f1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\alldt37so 5xcj\\f56924be-9663-41bb-b1710be7-dd08c11b7fef.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\F56924BE-9663-41BB-0BE52A62-0D79B43742F3.lukitus", "hashes": [ { "md5_hash": "f00c99f41344338948a8770d37d059fa", "sha1_hash": "c830e67d96a30de8190ef3f3b92d86ac8a9169e4", "sha256_hash": "c32462e95e4fec0464d5c6f518cf42b5e69e8b8053dea4974c7adb2cb4eb8abd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-0be52a62-0d79b43742f3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\F56924BE-9663-41BB-5915827A-35CC304703C8.lukitus", "hashes": [ { "md5_hash": "8cb45793aa531604293c54708f0b3572", "sha1_hash": "6324d6e3993c14c1c0f3dbfffa4795fa0ac90355", "sha256_hash": "012aecd1a1d0b90c68671a9de62800bf93fe16fac2748b2f1aaf924f525c0e7e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-5915827a-35cc304703c8.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\F56924BE-9663-41BB-165E2571-3D1F7BCD1A64.lukitus", "hashes": [ { "md5_hash": "bd747e7eaf7f74d4b53075bb89f51e08", "sha1_hash": "6af46424a520289a176c182cdacc0a39f629c600", "sha256_hash": "82c528ec5ceb79cc7d1f5faa47afe50b515ed58e10f66a54799daf6dbae9ca1e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-165e2571-3d1f7bcd1a64.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-AD0F9D60-FC98F622FDAF.lukitus", "hashes": [ { "md5_hash": "bf928ec856820e18f9d3e4138784ebe2", "sha1_hash": "d265ea534b0294cd17499d5bc6338ec0c23fe795", "sha256_hash": "8bfdee965a60673890a36a1c123a5f8ddf928bffd51678cf2e31904aa854b17f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-ad0f9d60-fc98f622fdaf.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-5221E3EB-AE9961740B1D.lukitus", "hashes": [ { "md5_hash": "5603615584c0bb164ef270554131aa20", "sha1_hash": "8a9d37ae3e1e9a12d95d8382f867c3cbacaf56c7", "sha256_hash": "041effeec859e2a328378b17e2519cde46952e126c65c40088a54eb10ef0c829", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-5221e3eb-ae9961740b1d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-11DB606C-975B3B3752B2.lukitus", "hashes": [ { "md5_hash": "56f1ae52071314f7e34aa5e9b085f64b", "sha1_hash": "56ae13bb83b07122399af1e7eed28ca10031a26d", "sha256_hash": "34edac547b0627a18549a0eef4f8585c64ccd62861c0378c969b32e1859448e7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-11db606c-975b3b3752b2.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-603C0E3A-FCB2203116A2.lukitus", "hashes": [ { "md5_hash": "61939f055f45fd1446bd80cd43c3b520", "sha1_hash": "3bcc3c022a132c2acfd4dcccc5ef886b2d846fa0", "sha256_hash": "8e42952087b32c6d5f3cbe47288108c6e16fd493375c4de6b2da2c95a2dc55f6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-603c0e3a-fcb2203116a2.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-75BCC747-2718C1ED972A.lukitus", "hashes": [ { "md5_hash": "d661c4e7d2f17fe51cf748c5c6106eed", "sha1_hash": "acfe817e31f4f0a9b404828db8adaef649ce59e6", "sha256_hash": "9049a85acf7fcf2f967094b5975344796952946f516b5af565b1bbe743529da1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-75bcc747-2718c1ed972a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-4B0F12D1-CA564F6CF8E9.lukitus", "hashes": [ { "md5_hash": "571fe4aeb25b128c01be131af5144649", "sha1_hash": "bb1d78aa67aa148cda814ed8502428ce8b18146d", "sha256_hash": "a27ba12304af4242a75723280f7fe0994884776a017bce38d909a2d79fac60d2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-4b0f12d1-ca564f6cf8e9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-67143CE2-1F8F7E2FED94.lukitus", "hashes": [ { "md5_hash": "aa53a594fd9c19a4e7f273a52d4feb81", "sha1_hash": "f6290016a5495b73f2255b279e7d735b57531f98", "sha256_hash": "5e1dd59328eb93902adddd3cbe6a347b6ae740639b8cb22d057a6379032bbf72", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-67143ce2-1f8f7e2fed94.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-C97E94D5-143F175BE5A4.lukitus", "hashes": [ { "md5_hash": "b5ba93e7deef72cbfaae83f2bb8eee05", "sha1_hash": "446e8f6efe27297697efaa26724404e037cd0864", "sha256_hash": "545d7bcd71ecafa39b3f04569e2e22b978293087b176f43ad4b42e08366532d0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-c97e94d5-143f175be5a4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\4fq0\\F56924BE-9663-41BB-994D93DA-180F73254B26.lukitus", "hashes": [ { "md5_hash": "54db4bafcc17d1e7225c6cb6eb859f8c", "sha1_hash": "b943e46ddb39d57d243ba9a9459ce11c4afed928", "sha256_hash": "93acf39189250cffdee9d779d364e4bea2bc59858457ecf0710ce11c8377d83e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-994d93da-180f73254b26.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\F56924BE-9663-41BB-E7CE6B36-6FF2A591CA6B.lukitus", "hashes": [ { "md5_hash": "f66d6520380c9349940f6709b3ddf1a1", "sha1_hash": "5708b28b11de725c2c19c968284eca8d9d3212e1", "sha256_hash": "ffb5e75f62f1e012d9685cbaf5c0409cd3d4ecd5dbb29b9d4ffc194dc0031103", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-e7ce6b36-6ff2a591ca6b.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\7 hNkoOuqhuUPb4WBN\\F56924BE-9663-41BB-F403E2BA-F520D5A5373D.lukitus", "hashes": [ { "md5_hash": "a8d3c25da4a9dfe1c82502e4b938822a", "sha1_hash": "bfc59bba3c19965814ea6f4b91b4ab2e17bcc450", "sha256_hash": "8bb20981da5b3d8cf08616fa0121d85f960340c162b667ff2cce872eb660d090", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\f56924be-9663-41bb-f403e2ba-f520d5a5373d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\7 hNkoOuqhuUPb4WBN\\F56924BE-9663-41BB-6CEE6528-76D95B986EF6.lukitus", "hashes": [ { "md5_hash": "b79f218bcd01cb004ea19607b3b166db", "sha1_hash": "600da0e928cf1abd7054c4d32356990dc8d2ecef", "sha256_hash": "0861d8b594d309f6173f9b6fbe0233586642808d918920bc1c50aaa58309b19f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\f56924be-9663-41bb-6cee6528-76d95b986ef6.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\7 hNkoOuqhuUPb4WBN\\F56924BE-9663-41BB-C00EFD39-06B140A3FA21.lukitus", "hashes": [ { "md5_hash": "c7b47747946c3556b7518f90c65c2e36", "sha1_hash": "23c412c7b01139a182bd5e63aae60ad2caad00e3", "sha256_hash": "51710ee201327cf74c282bba2ee3f9c94cda50a742b4343d7761059d6345cb66", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\f56924be-9663-41bb-c00efd39-06b140a3fa21.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\F56924BE-9663-41BB-6295A539-7A67CBEDDB7F.lukitus", "hashes": [ { "md5_hash": "3c27319eb253306db714b17203eca4aa", "sha1_hash": "0c369f4de822c4b31ad5ac44ed28cd6c1af5b538", "sha256_hash": "7a408d03b467136cf757e259225c178eae9167bcf0f55c144307d09a239cdd07", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-6295a539-7a67cbeddb7f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\gq2odSlVTX32RO7-UPJ\\F56924BE-9663-41BB-B99EF73A-C9F832ABEEC4.lukitus", "hashes": [ { "md5_hash": "699483b18d58231bc9fb17b6a309db2d", "sha1_hash": "94fb16af4c4376548de5b21c0e07c85ecdcc8ff4", "sha256_hash": "819d40027e16332a35fcfcdc0e2dc691150b774b733d0bbe8cbf59acd5d3ba95", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\f56924be-9663-41bb-b99ef73a-c9f832abeec4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\gq2odSlVTX32RO7-UPJ\\F56924BE-9663-41BB-65151815-9CA1B64A11E4.lukitus", "hashes": [ { "md5_hash": "cba2f2bf8e9063cce67c432a9bfa59ac", "sha1_hash": "a837b39f6943b6ee0d3de4cae96a34d5c3388e77", "sha256_hash": "6811020799539ebeeb594ef725f6447157c1837a3e8b5f3369168ce860511062", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\f56924be-9663-41bb-65151815-9ca1b64a11e4.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\gq2odSlVTX32RO7-UPJ\\F56924BE-9663-41BB-3E6508BD-D29B57D1C2AC.lukitus", "hashes": [ { "md5_hash": "fc0528505b83da7f0838afe43951727d", "sha1_hash": "ce35707989f8e3bbd3637f977e417dde2a5bf444", "sha256_hash": "dda28e4837bc4c79dc2e74cc808d1659b9580ed31c066bdaf4b57da6c2891eb0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\f56924be-9663-41bb-3e6508bd-d29b57d1c2ac.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\F56924BE-9663-41BB-D017408C-A1C491103B3C.lukitus", "hashes": [ { "md5_hash": "eb093b328d9293d50baf829d165cbe30", "sha1_hash": "826e1b46ca1566992f40c5b2be6f89613a28fcb6", "sha256_hash": "eef94175368709f31f5079f11a6a3450aa4f298ed1eef07f5430c52f3516e28b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-d017408c-a1c491103b3c.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\F56924BE-9663-41BB-45ED5AE6-C311E03F5420.lukitus", "hashes": [ { "md5_hash": "c4625cf93087a53767363d3f02c9e530", "sha1_hash": "36a42aaf330ce3bad9f9613435a8750b4443fd68", "sha256_hash": "3c813d9ba0c018963546881c63d3dd57c92c4058adf8e9bce799cd89f180cc6d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-45ed5ae6-c311e03f5420.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\F56924BE-9663-41BB-5163FD42-2B989A19C670.lukitus", "hashes": [ { "md5_hash": "80b1947b66ae98de244465a9f5a683a7", "sha1_hash": "c9e4e4e810ccedaddce1c5b7eab009c91ecd9194", "sha256_hash": "5da3dcaddc06323cd53344a3fddd697d1b9f2d678f8fec9834aeb347db922b06", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-5163fd42-2b989a19c670.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\h0HlIK4-OKRqwTJCKj\\F56924BE-9663-41BB-4BD5A65F-19DB8AEF6518.lukitus", "hashes": [ { "md5_hash": "e32d72bfd844007d427df0c9132e4c22", "sha1_hash": "3dfbc796f87d6cda13dc456ec74df3084a65d774", "sha256_hash": "dc2a464f19a3afd37924a1d51cbea7db1b5dbb4f93a45bb1d2a7681e79f80fae", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-4bd5a65f-19db8aef6518.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\F56924BE-9663-41BB-09D24D7F-1993D32C1FBE.lukitus", "hashes": [ { "md5_hash": "9b6731b3f77a395388bc63e30a5911da", "sha1_hash": "e6c16361560652d8b8dcaac9ab29fb4468266b8f", "sha256_hash": "083b26bc2e88cf153d42b6f5089d035b44f0e5a266a474b82736426858c4e08c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-09d24d7f-1993d32c1fbe.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\F56924BE-9663-41BB-B340460A-8184FDA16B6E.lukitus", "hashes": [ { "md5_hash": "21f3b01113a99156755c9069aaf01c07", "sha1_hash": "304c3f70532416128806de045683184cc3f76584", "sha256_hash": "018bf8a7fe4c8d8c54590c512b03537b9fd96b621148ef0051993b19fb856025", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-b340460a-8184fda16b6e.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\F56924BE-9663-41BB-693A5B37-95AAFD86E03D.lukitus", "hashes": [ { "md5_hash": "bcbcb1cdbd40ddcae46ab36e8c8518c9", "sha1_hash": "771858b88759f48686c877b9a23c4cd876d018fa", "sha256_hash": "f2fe751b43659b6210d811d0ecb15a178a3090ce3ba8df5475dbae1785324b0a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-693a5b37-95aafd86e03d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\F56924BE-9663-41BB-03B5ADAF-240C69733345.lukitus", "hashes": [ { "md5_hash": "c24eadb3953d4066b2adc5acaf6a448b", "sha1_hash": "3df74e510303b8f3f7e9df74ab572e42da0b630b", "sha256_hash": "64afb51e3699402697d173b45bc1e58a6e49321e06aecece8c01d5c7666760df", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-03b5adaf-240c69733345.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\H1UVhZaX1OE 6HQDG\\F56924BE-9663-41BB-4A8325C8-D3DD48FE9B0E.lukitus", "hashes": [ { "md5_hash": "56643e679f0b7a48d1d2400c481d6e67", "sha1_hash": "444ea7793a3b382e60f62b1db8c5822b8413cff9", "sha256_hash": "51f167799570293e6986b0f4a9403ab1753e81c5ad92c246065cd9ee779001c8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-4a8325c8-d3dd48fe9b0e.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\F56924BE-9663-41BB-8A8002EE-8EAA9E43EA07.lukitus", "hashes": [ { "md5_hash": "21f75e218d8cebb3151fed997798f097", "sha1_hash": "5bfb09142e763f477f2b43be39d470704d8102e6", "sha256_hash": "eb911b9f9ba7e9374dccb891aa3949a9da4b9297cbee558f1dd727e0ee8d91cb", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-8a8002ee-8eaa9e43ea07.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\F56924BE-9663-41BB-6DBB5E47-DBEBE7A5FEA3.lukitus", "hashes": [ { "md5_hash": "62373a720fcb4497f5f0ddadc676f2d6", "sha1_hash": "5b17b9c8821bd43f499f91ca9e1de7b39ce82474", "sha256_hash": "3f30f28a1a8c1abde66e7604dc4d6650da4378af9d25a79743a3e0f9e57bbe21", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-6dbb5e47-dbebe7a5fea3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Videos\\F56924BE-9663-41BB-113D17D0-3236FCFAE43F.lukitus", "hashes": [ { "md5_hash": "6e3921cc546b4007b58cc6228285fa18", "sha1_hash": "6227ac7558249be71b9639fd7165f2a563e1ac98", "sha256_hash": "fa60f1a8fcb458396b0b6d35f7f85a57c86f82e15cf74362d0523c5ce534078b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-113d17d0-3236fcfae43f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\dMOD_L2_N\\F56924BE-9663-41BB-451C9042-7ACDCA4814EF.lukitus", "hashes": [ { "md5_hash": "65e85a90d35220c43e98c9e6a0d1a457", "sha1_hash": "0af57082feb3df53070ed8d5209d786cebb5bb7a", "sha256_hash": "a779bacaa948aa5a52fa81cccd0ab569526f7ee26f620f3482d329d7b2b2f3c7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-451c9042-7acdca4814ef.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\F56924BE-9663-41BB-D6925DAC-48972570B93F.lukitus", "hashes": [ { "md5_hash": "d9f0f7dc3adf14a1f811b408c6d47126", "sha1_hash": "16293d9d722cd6943ee639ac37908c961e10e11b", "sha256_hash": "3ee535b5e084b25c0ee1ad3d37bae7b8ddd34addb2b1fbe12899a09a73933905", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-d6925dac-48972570b93f.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\F56924BE-9663-41BB-80B53F29-CCF6DCD53775.lukitus", "hashes": [ { "md5_hash": "646e8e0e0aab24e7ecf0e33f802c943c", "sha1_hash": "91428ffa3f3bfd1e3382acc20ac003aefec044bc", "sha256_hash": "87799c054f838612a6674db54a58eb518f21e48da61a5289d353c450ec4d4cec", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-80b53f29-ccf6dcd53775.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\HmCN--W\\F56924BE-9663-41BB-9F971724-7F39278F3E87.lukitus", "hashes": [ { "md5_hash": "d9e667726b2b35a90411d993cc07ebd1", "sha1_hash": "50bf11d477674d1cd6f4ca5297dd5d50e1a7f6f7", "sha256_hash": "f770bb0a9edcc9d54123230bcf5bf75dafaae641f33e2b3956e97d749bb657bf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f56924be-9663-41bb-9f971724-7f39278f3e87.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\zZG5e5YF\\HmCN--W\\F56924BE-9663-41BB-5C2AB183-DBFCA67372B1.lukitus", "hashes": [ { "md5_hash": "2f99738b4fc865ea65d4103f47978aab", "sha1_hash": "357a466e2ef0b71f9f78bc582005ad89f92e9aa0", "sha256_hash": "7aac1bb4236eea8f1ff7cc8855584a5ee941b3260b6aef2ce1c6c9b497f6d554", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f56924be-9663-41bb-5c2ab183-dbfca67372b1.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-370A4C85-1F80AE0D9C7A.lukitus", "hashes": [ { "md5_hash": "f6ae64125b4601fced0a37e4350104fc", "sha1_hash": "166fac48e9533bf01391c780e2de4ef2508bf79c", "sha256_hash": "8c08c19d8810a389585cb5673c40b474e2f7fd74cf72767f214ce2bdcfad13d2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-370a4c85-1f80ae0d9c7a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-B3B4D02E-9E627B39C235.lukitus", "hashes": [ { "md5_hash": "21d6f837de95e3045a4f9c4ed82093d8", "sha1_hash": "ec8e7e4c66b653f98ca39f5daaad1a74e4a3f602", "sha256_hash": "9a8a01a76d6bdef3777edc7996970d3532642cecb8fc0e0c700afee1f74880d4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-b3b4d02e-9e627b39c235.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Music\\F56924BE-9663-41BB-1BB670A3-7CA494BB8764.lukitus", "hashes": [ { "md5_hash": "07f2114b7ced323965ffa3ec2b8f0138", "sha1_hash": "9b8142e6832b8f2a5c54163a4e120d2c6b8a0885", "sha256_hash": "5d6d7407daff418ee2354c24a23cda65fc5e985be5f61794d4076cafd4714c16", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-1bb670a3-7ca494bb8764.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Music\\Sample Music\\F56924BE-9663-41BB-E7ED6FE8-82778B4CB908.lukitus", "hashes": [ { "md5_hash": "709257a80b3b18541487dfa0e6c88ecd", "sha1_hash": "e89ad8af75f9ba40dd1e4c1d81b97752a4ee235e", "sha256_hash": "f1cf2919f4318e27423f9e60717b486d6a4a932bd847a2e86128303c0d1dca9e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\sample music\\f56924be-9663-41bb-e7ed6fe8-82778b4cb908.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Music\\Sample Music\\F56924BE-9663-41BB-FCD298FA-818189779DE9.lukitus", "hashes": [ { "md5_hash": "5b7b91781670dc88fcb3e6bc97d07058", "sha1_hash": "9d222b8020776d85bdd2a4451193ada595156d22", "sha256_hash": "b064f2b116e0fad51b4e71ec9dc7a44a7f0bf0ce4a6cba57d7ff6a9f6dd49096", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\sample music\\f56924be-9663-41bb-fcd298fa-818189779de9.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Music\\Sample Music\\F56924BE-9663-41BB-ADC81CE2-94215817FAE5.lukitus", "hashes": [ { "md5_hash": "b3505969d7586b2762b7efa27a13c4d4", "sha1_hash": "41503f95d7fc58a514dc88939bd065d5623d89b2", "sha256_hash": "1500b64cf32e095d3be75da6db2a120291238ec9e61a4b0cd40acfec890140a3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\sample music\\f56924be-9663-41bb-adc81ce2-94215817fae5.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\Public\\Videos\\Sample Videos\\F56924BE-9663-41BB-4B442157-696184C15ED5.lukitus", "hashes": [ { "md5_hash": "f0aab0fac27ec5381894722b56cfcf1d", "sha1_hash": "8fedf2d827c595e483d54c93f5edad64d07a81b2", "sha256_hash": "d4c78548aae642cba515ef0ea0dde187e8a9ba95374a5bf1c5dd0da115f5fbd7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\videos\\sample videos\\f56924be-9663-41bb-4b442157-696184c15ed5.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\F56924BE-9663-41BB-9708D0B4-8FF0AA0A752D.lukitus", "hashes": [ { "md5_hash": "b136ebbd86808f0def58ba9db07b8293", "sha1_hash": "91b7ca75eeae0cb8a25c694f993346cb4a6845eb", "sha256_hash": "3f35a29480968a2bff51a10c63c09aa4a37a9acef1187c4de16b012802d39716", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-9708d0b4-8ff0aa0a752d.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Mozilla\\logs\\F176919E2FDBB656461BC74C80CF566C.tmp", "hashes": [], "norm_filename": "c:\\programdata\\mozilla\\logs\\f176919e2fdbb656461bc74c80cf566c.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Microsoft\\RAC\\PublishedData\\40EEB5158C34DEBD2CB4E1B03CE6FB8A.tmp", "hashes": [], "norm_filename": "c:\\programdata\\microsoft\\rac\\publisheddata\\40eeb5158c34debd2cb4e1b03ce6fb8a.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\F56924BE-9663-41BB-3E83206B-222A0EAE7C38.lukitus", "hashes": [ { "md5_hash": "000f0ecf36a612c28663beebd117ae15", "sha1_hash": "a32a40c1d2818937ebf40053b7ac1baea2cc9443", "sha256_hash": "1c7f13fbe2f8107fabc8d88cf0959fc9327bc7c3adac817203f91a630ee2883a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-3e83206b-222a0eae7c38.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\F56924BE-9663-41BB-D8BE3C5C-B36FD1B73B13.lukitus", "hashes": [], "norm_filename": "c:\\programdata\\adobe\\arm\\reader_10.0.0\\f56924be-9663-41bb-d8be3c5c-b36fd1b73b13.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\F56924BE-9663-41BB-75322EBB-BE90A9784F44.lukitus", "hashes": [ { "md5_hash": "482c4a0d2f15c328cfdad3eb83ac896e", "sha1_hash": "533578ce5d74c6c59c63374c03571b7a577f3bf1", "sha256_hash": "5410a819c15ea7c8e7e3d2012c684cccf4cc9e15a6a16f68efe60afcfba57a8b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-75322ebb-be90a9784f44.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\F56924BE-9663-41BB-7BCE8B0A-B14ED50B7B3A.lukitus", "hashes": [ { "md5_hash": "562510b6f31bb8ded7335a656e4322d6", "sha1_hash": "b2d406452e805aa230cf72cc8d1299adcf875ffd", "sha256_hash": "fb89ad7ea3352472d4f1e45e12049ec46907a5dadf7680684cd39022bdb9cb73", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-7bce8b0a-b14ed50b7b3a.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\F56924BE-9663-41BB-432D0A28-59FA3E7273DF.lukitus", "hashes": [ { "md5_hash": "c86b88bbaa105cb200629e054eba49f2", "sha1_hash": "686e61001db4019dcb1686a47b3e44f8e12ed65e", "sha256_hash": "f3b4c7e3ea7102f2b717ca08384b058c1eed0392592e88d53faff45c2d2cc8af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-432d0a28-59fa3e7273df.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\F56924BE-9663-41BB-E1736BF8-B7B89FCE74B3.lukitus", "hashes": [ { "md5_hash": "1c91b3916354c9c534daff8d7f1158ce", "sha1_hash": "35c1cfc74e4c3808e68a5d1beb34304438d9f5d6", "sha256_hash": "9027a85c890092741d89f8e642dd731d112816a1a53497ddb8b6c053dbb1e54d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-e1736bf8-b7b89fce74b3.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Contacts\\F56924BE-9663-41BB-B8822C87-6D1307967B76.lukitus", "hashes": [ { "md5_hash": "0ec7928e304746303c71dc29961aa791", "sha1_hash": "5028d1a5874c2a8c7c5b92d2f391d7bf6779d207", "sha256_hash": "8027ddac200942373f2a5b6668ed49af4ad946086e19ddc6a1323d4c8fe32410", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-b8822c87-6d1307967b76.lukitus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\agraba8.exe", "hashes": [ { "md5_hash": "91a61e3be9cc7251972f6ee8d4836cb4", "sha1_hash": "f78c091a623c605e74511dd80d1a48376c2c4145", "sha256_hash": "3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\lukitus-2446.htm", "hashes": [ { "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\lukitus-2446.htm", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Documents\\Fwkh\\lukitus-547b.htm", "hashes": [ { "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\lukitus-547b.htm", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\lukitus-b59f.htm", "hashes": [ { "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\lukitus-b59f.htm", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\Users\\aETAdzjz\\Desktop\\F56924BE-9663-41BB-93FF195C-3BB52D679DDB.lukitus", "hashes": [ { "md5_hash": "73098251fc1b59b50a2cb4c346d0571f", "sha1_hash": "f1f2e412a8cd55d5d611a7e3d7d8ad7692ba3904", "sha256_hash": "11e3593f0c2516fae2140cf958637816e1c022a764effe30e34b870469e51fcf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-93ff195c-3bb52d679ddb.lukitus", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Sun\\Java\\Java Update\\F56924BE-9663-41BB-0FD4E971-761D2214F09F.lukitus", "hashes": [ { "md5_hash": "e5d7624acd733aeb46248b02a5ca37c9", "sha1_hash": "0395fd72c9dec4e630c9d3e172c865e9210521a6", "sha256_hash": "6f4c324050b26f7478cec8e26b863203838ed110269b72d6bb7fc4483002bcfd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\programdata\\sun\\java\\java update\\f56924be-9663-41bb-0fd4e971-761d2214f09f.lukitus", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Mozilla\\logs\\F56924BE-9663-41BB-8141530E-5B53D2BEEFEB.lukitus", "hashes": [ { "md5_hash": "28e3f1ee8d1f89dd67c5cbeb38519b59", "sha1_hash": "9997c51e0da6f8877b561d18349ddd33da33572a", "sha256_hash": "f4067ce0d6499fe8e49d157758bbc2392f0007ff2505a529622ba3d61e0a5a69", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\programdata\\mozilla\\logs\\f56924be-9663-41bb-8141530e-5b53d2beefeb.lukitus", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "c:\\ProgramData\\Microsoft\\RAC\\PublishedData\\F56924BE-9663-41BB-E502C16E-31B2BDF7F726.lukitus", "hashes": [ { "md5_hash": "4fd473699b4e1a06e46ee3b3d3b49fcb", "sha1_hash": "b78f6610bfee61249f4d11588c5a1fbb261d24e7", "sha256_hash": "3e65a3ccc624929cc36e5f73078af23289073b124737716b03a5675d405797a3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\programdata\\microsoft\\rac\\publisheddata\\f56924be-9663-41bb-e502c16e-31b2bdf7f726.lukitus", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\aETAdzjz\\Desktop\\lukitus.htm", "hashes": [ { "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\lukitus.htm", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\aETAdzjz\\Desktop\\lukitus.bmp", "hashes": [ { "md5_hash": "08f38151ed738d7bc5878b5dd106e524", "sha1_hash": "fa1a19df5a1788772d07a5f11874ee77b7efd7fb", "sha256_hash": "c2b5da0c579930ad5351749d20b702f62f31019bd4c2fda471aadb36b404bb24", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\aetadzjz\\desktop\\lukitus.bmp", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_INPUT_HANDLE", "hashes": [], "norm_filename": "std_input_handle", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_OUTPUT_HANDLE", "hashes": [], "norm_filename": "std_output_handle", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_ERROR_HANDLE", "hashes": [], "norm_filename": "std_error_handle", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\aETAdzjz\\Desktop", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\desktop", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\aETAdzjz\\AppData\\Local\\Temp", "hashes": [], "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\temp", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [ { "mutex_name": "Global\\Ga6a7a:a3a5aCaFa:a7a7a4a5a2aCaCa", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "Local\\Ga6a7a:a3a5aCaFa:a7a7a4a5a2aCaCa", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [ { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020905-0000-0000-C000-000000000046}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020430-0000-0000-C000-000000000046}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{000204EF-0000-0000-C000-000000000046}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{0D452EE1-E08F-101A-852E-02608C4D0BB4}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Typelib\\{0D452EE1-E08F-101A-852E-02608C4D0BB4}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Licenses", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020905-0000-0000-C000-000000000046}\\8.7", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020905-0000-0000-C000-000000000046}\\8.7\\409", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "win64", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020905-0000-0000-C000-000000000046}\\8.7\\0", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020430-0000-0000-C000-000000000046}\\2.0", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020430-0000-0000-C000-000000000046}\\2.0\\0", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020430-0000-0000-C000-000000000046}\\2.0\\0\\win64", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\\2.8", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\\2.8\\0", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\\2.8\\0\\win64", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{000204EF-0000-0000-C000-000000000046}\\4.2", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{000204EF-0000-0000-C000-000000000046}\\4.2\\9", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{000204EF-0000-0000-C000-000000000046}\\4.2\\9\\win64", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{00020905-0000-0000-C000-000000000046}\\8.7\\0\\win64", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\\2.0", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\\2.0\\0", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\TypeLib\\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\\2.0\\0\\win64", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\DesignerFeatures", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\InprocServer32", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Typelib", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02373-B5BC-11CF-810F-00A0C9030074}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02373-B5BC-11CF-810F-00A0C9030074}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02373-B5BC-11CF-810F-00A0C9030074}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02374-B5BC-11CF-810F-00A0C9030074}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02374-B5BC-11CF-810F-00A0C9030074}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02374-B5BC-11CF-810F-00A0C9030074}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02375-B5BC-11CF-810F-00A0C9030074}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02375-B5BC-11CF-810F-00A0C9030074}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{82B02375-B5BC-11CF-810F-00A0C9030074}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{8A683C92-BA84-11CF-8110-00A0C9030074}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{8A683C92-BA84-11CF-8110-00A0C9030074}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{8A683C92-BA84-11CF-8110-00A0C9030074}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{8A683C93-BA84-11CF-8110-00A0C9030074}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{8A683C93-BA84-11CF-8110-00A0C9030074}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{8A683C93-BA84-11CF-8110-00A0C9030074}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{AFC20920-DA4E-11CE-B943-00AA006887B4}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{AFC20920-DA4E-11CE-B943-00AA006887B4}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{AFC20920-DA4E-11CE-B943-00AA006887B4}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{5CEF5610-713D-11CE-80C9-00AA00611080}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{5CEF5610-713D-11CE-80C9-00AA00611080}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{5CEF5610-713D-11CE-80C9-00AA00611080}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100}", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100}\\Control", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Clsid\\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100}\\Insertable", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\VBE\\6.0\\Addins64", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\Licenses\\8804558B-B773-11d1-BC3E-0000F87552E7", "type": "registry_artifact", "version": 1 }, { "operations": [ "write", "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Control Panel\\Desktop", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor", "type": "registry_artifact", "version": 1 } ], "type": "artifacts", "urls": [ { "operations": [ "get" ], "type": "url_artifact", "url": "http://calster.be/87wifhFsdf", "version": 1 }, { "operations": [ "post" ], "type": "url_artifact", "url": "212.109.220.109/imageload.cgi", "version": 1 } ], "version": 1 }, "extracted_files": [ { "archive_path": "extracted_files/f78c091a623c605e74511dd80d1a48376c2c4145", "file_type": "created_file", "id": "file_2", "md5_hash": "91a61e3be9cc7251972f6ee8d4836cb4", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe", "sha1_hash": "f78c091a623c605e74511dd80d1a48376c2c4145", "sha256_hash": "3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca", "size": 620544, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d901d940a2e058da46f6fdae83e85ec4926edf48", "file_type": "created_file", "id": "file_3", "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "norm_filename": "c:\\users\\aetadzjz\\documents\\lukitus-2446.htm", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "size": 8874, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d901d940a2e058da46f6fdae83e85ec4926edf48", "file_type": "created_file", "id": "file_4", "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\lukitus-547b.htm", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "size": 8874, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d901d940a2e058da46f6fdae83e85ec4926edf48", "file_type": "created_file", "id": "file_5", "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "norm_filename": "c:\\users\\aetadzjz\\desktop\\lukitus-b59f.htm", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "size": 8874, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d901d940a2e058da46f6fdae83e85ec4926edf48", "file_type": "created_file", "id": "file_6", "md5_hash": "03ba639109a5ad5406f423d1d4d472fa", "norm_filename": "c:\\users\\aetadzjz\\desktop\\lukitus.htm", "sha1_hash": "d901d940a2e058da46f6fdae83e85ec4926edf48", "sha256_hash": "c6b06db3ab1d390036be63a15d2abd138dbc17c371fd9ec039a4becd7c3d584f", "size": 8874, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fa1a19df5a1788772d07a5f11874ee77b7efd7fb", "file_type": "created_file", "id": "file_7", "md5_hash": "08f38151ed738d7bc5878b5dd106e524", "norm_filename": "c:\\users\\aetadzjz\\desktop\\lukitus.bmp", "sha1_hash": "fa1a19df5a1788772d07a5f11874ee77b7efd7fb", "sha256_hash": "c2b5da0c579930ad5351749d20b702f62f31019bd4c2fda471aadb36b404bb24", "size": 3721466, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f1f2e412a8cd55d5d611a7e3d7d8ad7692ba3904", "file_type": "created_file", "id": "file_8", "md5_hash": "73098251fc1b59b50a2cb4c346d0571f", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-93ff195c-3bb52d679ddb.lukitus", "sha1_hash": "f1f2e412a8cd55d5d611a7e3d7d8ad7692ba3904", "sha256_hash": "11e3593f0c2516fae2140cf958637816e1c022a764effe30e34b870469e51fcf", "size": 50458, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5", "file_type": "created_file", "id": "file_9", "md5_hash": "bf619eac0cdf3f68d496ea9344137e8b", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\temp\\~dfe5d8e3f73a92a76c.tmp", "sha1_hash": "5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5", "sha256_hash": "076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560", "size": 512, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/444af778f297eccb339123c5959f07a8f89b4224", "file_type": "created_file", "id": "file_10", "md5_hash": "6abad91ef2ea344540ffc34da13283b6", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-b1dc6762-4f6cbab10e0b.lukitus", "sha1_hash": "444af778f297eccb339123c5959f07a8f89b4224", "sha256_hash": "0f1be91f6d873b31a92eb731c8724746101f75f78a758afcd1516957ec5dc43f", "size": 83779, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f57630ed5b959114fe4d1c15fb41fdbeea492764", "file_type": "created_file", "id": "file_11", "md5_hash": "776ba4d91050761e680a84012e71145b", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1fc77e46-75d0d332d675.lukitus", "sha1_hash": "f57630ed5b959114fe4d1c15fb41fdbeea492764", "sha256_hash": "17ee0c6ce1f0f32f4661c5aea15558cf056a6bdb20241a2094dc5f3b28d1a6e0", "size": 18350, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d7f39e3759e9360dd5629aa202acd3699409aa0a", "file_type": "created_file", "id": "file_12", "md5_hash": "a50862100d2462158111dcc9938ff0af", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-f71e2d7c-1a58c58cde47.lukitus", "sha1_hash": "d7f39e3759e9360dd5629aa202acd3699409aa0a", "sha256_hash": "674cd1b6db3d4f950ab79a328944aeaffc2811020ef10bc0ff55fcc037aeabe7", "size": 30374, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a40f092d065c3a19b9529198fe98d5eb4f170601", "file_type": "created_file", "id": "file_13", "md5_hash": "772a87a10bc58301219c75e82450f9d5", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-68c82df1-14b4d804bd61.lukitus", "sha1_hash": "a40f092d065c3a19b9529198fe98d5eb4f170601", "sha256_hash": "ffda15c8587df4ba7a0529d32594b6f46f9b99e8d1e6c16f5f9e18614bcd493c", "size": 70634, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/45837778384830ce66481c4b3605f60ff55c3bf3", "file_type": "created_file", "id": "file_14", "md5_hash": "9e0b618eea6c393041ab77e094c91cdf", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-49cf61ee-57465675bb4a.lukitus", "sha1_hash": "45837778384830ce66481c4b3605f60ff55c3bf3", "sha256_hash": "c0a44b8e12f625b0c73a5bcdf7cc38b0bc3152c16828ceb3c4232fc2d3eea4aa", "size": 998, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/40c83aacedbac1f5dabb83f01b4108745a619455", "file_type": "created_file", "id": "file_15", "md5_hash": "dca25bc771722b0031cd105fe3afb3de", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1e43a153-b4fa5bd13c64.lukitus", "sha1_hash": "40c83aacedbac1f5dabb83f01b4108745a619455", "sha256_hash": "9afc3f3637a2782cd25e488df9584bec16c21e41c0d12c8bae65588976fccabb", "size": 59848, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f756f23b8f219dd1a177efd5067d33895df91eba", "file_type": "created_file", "id": "file_16", "md5_hash": "1265daa90eedb3c9b3ec895a7e2cc859", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-746c6c5a-dddafa9fe1bd.lukitus", "sha1_hash": "f756f23b8f219dd1a177efd5067d33895df91eba", "sha256_hash": "44c237217af69cc53029b4335a8bf8f7c920494a683a857122b432d698fcf40b", "size": 89384, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/445fbf1d9de7746bd9f3abc64a580b6ac2806b6d", "file_type": "created_file", "id": "file_17", "md5_hash": "b9d9f966203227eda7672af260d586b5", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-d050f35d-df08fe665915.lukitus", "sha1_hash": "445fbf1d9de7746bd9f3abc64a580b6ac2806b6d", "sha256_hash": "144ba74c09c895dce58edace591b7e263326b38368c030a86de17061e82a1d8b", "size": 78385, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0519b3dc9527c0ffc2f0cd9e84ebc8bac072e291", "file_type": "created_file", "id": "file_18", "md5_hash": "bf911c31fe23672abda64b65389368f0", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-6562ef8e-9356a0b9d778.lukitus", "sha1_hash": "0519b3dc9527c0ffc2f0cd9e84ebc8bac072e291", "sha256_hash": "7b44f04bfd993affe249736dbbe704776ca010f61babf56c93c730094b282a74", "size": 7603, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/83958705c423b40e7cde22ba24fc4efb881695d1", "file_type": "created_file", "id": "file_19", "md5_hash": "4fc9141920f3a9a5d2267c61332fc10e", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-02ddbb2e-dda7eef606e5.lukitus", "sha1_hash": "83958705c423b40e7cde22ba24fc4efb881695d1", "sha256_hash": "4f574655f1fcc3084f0008008ab6c986fcd988602591aa6b9aa0af4ae8cc49bc", "size": 76545, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3a776d1c6650c69a2c7bd1b944b45b038df9b0b3", "file_type": "created_file", "id": "file_20", "md5_hash": "7e7be556fe089933e12989e93bee08fd", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-dd1f464e-1d4279836981.lukitus", "sha1_hash": "3a776d1c6650c69a2c7bd1b944b45b038df9b0b3", "sha256_hash": "07860428399bba38220f9ba9513d34b4dca67da2927fcdb7382f9129000b824c", "size": 81599, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4244ea22d4acbf5bb1ad36ecdb2b764166f1e92e", "file_type": "created_file", "id": "file_21", "md5_hash": "fb5d26ae8d42dca9f83189a46d7aafe6", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-7ccb072c-c1747aea88b6.lukitus", "sha1_hash": "4244ea22d4acbf5bb1ad36ecdb2b764166f1e92e", "sha256_hash": "d71b7fb4437a0406ad8f9874529946f5856714b53e38e831a8f4eeebcea3872a", "size": 96408, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b4133b1d05faa54df705f30a46c433a43014da51", "file_type": "created_file", "id": "file_22", "md5_hash": "6a52bfb9267d0f422a0184a0fe14d6f5", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-6f1f87e1-0611de322330.lukitus", "sha1_hash": "b4133b1d05faa54df705f30a46c433a43014da51", "sha256_hash": "e2015345d5922a8fe3676a1c7e8c940d64d169b1b8b7f5630052b49234f3c552", "size": 85483, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1c406fd6df0744789ec498a1abf925ad8ec60a3a", "file_type": "created_file", "id": "file_23", "md5_hash": "885fda6005971a82db16ad2bd29041a4", "norm_filename": "c:\\users\\aetadzjz\\documents\\onenote notebooks\\my notebook\\f56924be-9663-41bb-93122862-1b3365d6fc4a.lukitus", "sha1_hash": "1c406fd6df0744789ec498a1abf925ad8ec60a3a", "sha256_hash": "a5f248aec0548330dbb26391181cff2f72849242524d84870c8e30d7423c5b5e", "size": 7020, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7bcc4fae19b21c006c7425add419be78de3f1a68", "file_type": "created_file", "id": "file_24", "md5_hash": "c54fc8af819d898b850ac5fdd43254ed", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7f7df4f3-fee5a0f835d8.lukitus", "sha1_hash": "7bcc4fae19b21c006c7425add419be78de3f1a68", "sha256_hash": "72a36bd4de31602c8dd2e6eb16786c95f11cb307d0dd5ef5ff78bfe3edf0274d", "size": 63412, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/264c33cb60857a0dfd1b4d9d8f766188f8886e8c", "file_type": "created_file", "id": "file_25", "md5_hash": "c65660792799d623f815201d4ed54c7d", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-42da6451-74994b3b23eb.lukitus", "sha1_hash": "264c33cb60857a0dfd1b4d9d8f766188f8886e8c", "sha256_hash": "99c93e6b9ab37b41c663069c5355756c3a7d05fd75552452c2421dc877f743e3", "size": 35738, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/12f1365c7d8b0b5006eb5f7e660f34e6a2be5ffa", "file_type": "created_file", "id": "file_26", "md5_hash": "194a630851f7e2e2f5e013b0ab70e94e", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-e0725b46-87ead7fbfed8.lukitus", "sha1_hash": "12f1365c7d8b0b5006eb5f7e660f34e6a2be5ffa", "sha256_hash": "58d6317026fb76718b3b13e75763750a069dd1d491d260be1dd09ac2b4d618f9", "size": 89228, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/83fd7b53bef8f92179b46bb43bd887eff6c0e4dc", "file_type": "created_file", "id": "file_27", "md5_hash": "b2e545b0b9f937ee1514f461838326c3", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-527c0c14-e324030a4a6e.lukitus", "sha1_hash": "83fd7b53bef8f92179b46bb43bd887eff6c0e4dc", "sha256_hash": "29bc3313cf80fec7b70b8b0acf41d194d24abfb8d0edd3bdb9f0c75d2d813651", "size": 101122, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/35e503bddb6773d2ec4fa56fc0342551370bef18", "file_type": "created_file", "id": "file_28", "md5_hash": "31475f1b4f38f56ea9f3fb892a129ca1", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-526e1a2b-128166908518.lukitus", "sha1_hash": "35e503bddb6773d2ec4fa56fc0342551370bef18", "sha256_hash": "bd739976c57e1d7275a52304b7d7b0bdeba5516e08ae3024680f8fbdc41aa071", "size": 62473, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cd3895ed6ec7e35bc79691d6818a9cce1d3e75d6", "file_type": "created_file", "id": "file_29", "md5_hash": "f0a3789f2aaa76213cb01112e22b0a9b", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-15fbd8aa-4d0a91f58ed4.lukitus", "sha1_hash": "cd3895ed6ec7e35bc79691d6818a9cce1d3e75d6", "sha256_hash": "96c26e9da10586ee9dceed556236713e4798193d86c19e2a49f314385890e401", "size": 42378, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/312cfed40b006bd070a17d3598638c8a43cf9268", "file_type": "created_file", "id": "file_30", "md5_hash": "676f2fcb58be85dca079aed3c0307b14", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-f1fcdeaa-ff7f06504774.lukitus", "sha1_hash": "312cfed40b006bd070a17d3598638c8a43cf9268", "sha256_hash": "39f27549d5c9a2dcf360ea7730117d5db1057faf98f7505a6313319a837f64d7", "size": 72747, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b89a45a4d8203f18eae7505c41537ab488891a05", "file_type": "created_file", "id": "file_31", "md5_hash": "6d5e20a0682136d3786edaadd4386eca", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1d9844f4-6dce132fa911.lukitus", "sha1_hash": "b89a45a4d8203f18eae7505c41537ab488891a05", "sha256_hash": "50c7a84443a0102ed402d843e3066c78b171839a130533cbc4e4bb841710aab6", "size": 99519, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d73eb40b00de0979342b96cc29879cca7f62d509", "file_type": "created_file", "id": "file_32", "md5_hash": "01f852000bbcb39ac92aa22b36104f32", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-988e0a99-75c5268fa982.lukitus", "sha1_hash": "d73eb40b00de0979342b96cc29879cca7f62d509", "sha256_hash": "1bd6dfb3d97d3e31b19c4efc27c3676237153b34fea49aed5d7aea5bf1cbbfae", "size": 56980, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/be302c7a6536983bc29e6874b4eca6457a25c98d", "file_type": "created_file", "id": "file_33", "md5_hash": "d1ccedf54e7d148c94dd92abd10e0ebf", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-14d6a72b-e51a5d5dc391.lukitus", "sha1_hash": "be302c7a6536983bc29e6874b4eca6457a25c98d", "sha256_hash": "50534e5328d077935daf7c0fe860c489005810bab3d36edf768a5295e7405a6f", "size": 7712, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bbf0386872ddc6fc426beca0eaf5c1d76d4135bc", "file_type": "created_file", "id": "file_34", "md5_hash": "e15288fe1acec5be28093a52d52bf408", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-65272a78-f5925d3fa2a8.lukitus", "sha1_hash": "bbf0386872ddc6fc426beca0eaf5c1d76d4135bc", "sha256_hash": "f6871b99f685682d86176db35b1ca8b302607accc6ae0c8141ddfb4bd3d24708", "size": 69473, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a74b0c652eba8eaa1c10151253cf92475ffd9c8b", "file_type": "created_file", "id": "file_35", "md5_hash": "7e1d44b9e9949f1dcc44df1cb77b4ce3", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-ce32cc3f-ebe8612bbb20.lukitus", "sha1_hash": "a74b0c652eba8eaa1c10151253cf92475ffd9c8b", "sha256_hash": "1e1a422b1424e7f9340050fb708843f8c2d75a719d37512cbbb7cff41da80bde", "size": 81246, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dcd3ea567c7229127c1d74ebd2ad1cb5d081bad4", "file_type": "created_file", "id": "file_36", "md5_hash": "27db40185ac2b07a15df545ef2678a80", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-cda913e8-271056ab5827.lukitus", "sha1_hash": "dcd3ea567c7229127c1d74ebd2ad1cb5d081bad4", "sha256_hash": "d1225f27f37022bbd8bb885e22488197dd3374ad12bc452f1d40509a890c9484", "size": 51689, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7776d7c7d25d7877ec146943b7958f47dbb29c8", "file_type": "created_file", "id": "file_37", "md5_hash": "4c6380666702b4a9498f07e2116bb164", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-ba7682c3-ceef9fbf020c.lukitus", "sha1_hash": "c7776d7c7d25d7877ec146943b7958f47dbb29c8", "sha256_hash": "9c4266a994efdcd75b39a7f6fb17e4ee1106f9eb4643bf2fdb971e5735da886d", "size": 6354, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7cc914837ecff162b4c0fb7def66d3e3440bbe60", "file_type": "created_file", "id": "file_38", "md5_hash": "bfde86a708ed6f8850ba5b5ed119840c", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-fdd27ffa-d0b0af905888.lukitus", "sha1_hash": "7cc914837ecff162b4c0fb7def66d3e3440bbe60", "sha256_hash": "50b497246a384d66af186e1d98d2a475d97539a02729f805f8cb84b9e6e19782", "size": 55639, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/eb7f0255ad4028acd7bff986993f5a494f73e5d3", "file_type": "created_file", "id": "file_39", "md5_hash": "99dc604e6316b4a06151d52b041246b5", "norm_filename": "c:\\users\\aetadzjz\\documents\\outlook files\\f56924be-9663-41bb-612962ee-cda06faa83d1.lukitus", "sha1_hash": "eb7f0255ad4028acd7bff986993f5a494f73e5d3", "sha256_hash": "c3324f5e81082ff027fc770e463281b5876976b139f88cc24824e692ba27db81", "size": 272196, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b2b62d9a09d455bd5885cd1893316122781e7b4", "file_type": "created_file", "id": "file_40", "md5_hash": "e082a12ca21ea266ab9b9b161f174415", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-8c112abd-8e26aa86b08a.lukitus", "sha1_hash": "9b2b62d9a09d455bd5885cd1893316122781e7b4", "sha256_hash": "8b2e8cfe601fe954d4975dbc64d3b60ee4549ad080414aa799a9f849ecf02b09", "size": 98987, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2f4b40dd9a6f30a49f9b5235e9dd9a08fbf7efa5", "file_type": "created_file", "id": "file_41", "md5_hash": "0c4780c26232d65f38c435568a283c80", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-02ed3f77-9c606d75c05c.lukitus", "sha1_hash": "2f4b40dd9a6f30a49f9b5235e9dd9a08fbf7efa5", "sha256_hash": "bd13f30a9947916e13dddd18dc3aeced0fa40a9c1142b7248cf0d339a0016974", "size": 13942, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e685217ccfb73b9a6922d56404be0fdb6ecb7087", "file_type": "created_file", "id": "file_42", "md5_hash": "ef37e81fbcd78a587fe70e70bddcb967", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-781de6a6-e5a7705bb692.lukitus", "sha1_hash": "e685217ccfb73b9a6922d56404be0fdb6ecb7087", "sha256_hash": "43a0d03bf7797de26a60ecdea7139450823eccd41c68cca78580d5f86e0a0809", "size": 74356, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d7ddfa8b1202e255e5dba150958e6d1d85b420d4", "file_type": "created_file", "id": "file_43", "md5_hash": "9d9a97256dae66413e871a5f5d43a517", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7b55cf77-61f436ad3e42.lukitus", "sha1_hash": "d7ddfa8b1202e255e5dba150958e6d1d85b420d4", "sha256_hash": "29d9dceec2db1c66b2cd8064c1767557086c8b9157891564a6d5720f513b3e4c", "size": 73205, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8edcc53621f8ac41d272577daf0e159755638f93", "file_type": "created_file", "id": "file_44", "md5_hash": "3ee359090152ec94da64d6dbe5bbc799", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-a771a452-48dd4ba9679e.lukitus", "sha1_hash": "8edcc53621f8ac41d272577daf0e159755638f93", "sha256_hash": "5b8829637915f6af31bee9eba73a6f521217b94926fb3667631300397d41d5f7", "size": 93577, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a42f75fb6ccd7b090f873bb74bebd5dbabe36587", "file_type": "created_file", "id": "file_45", "md5_hash": "ab965e83e2eb2f180dc264c431a95365", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-b282f5d6-2a6d69715153.lukitus", "sha1_hash": "a42f75fb6ccd7b090f873bb74bebd5dbabe36587", "sha256_hash": "551327f7b8862e2682f26ff105ee328c7a99860c9b3b510501e483c92b093c18", "size": 101419, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c3954c511bc2521138ecc2e1d88bfbe26fe48e40", "file_type": "created_file", "id": "file_46", "md5_hash": "7f6c8851cc5ea831b374025e26aeee8d", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-3a6db1ca-755757c28fe3.lukitus", "sha1_hash": "c3954c511bc2521138ecc2e1d88bfbe26fe48e40", "sha256_hash": "21136f752aa9e46b591aa4b52dac4282a7a0789acfcdb71d47d5ce95079a7085", "size": 26492, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4b94289b0631439864046a593714b6e0e033c4d", "file_type": "created_file", "id": "file_47", "md5_hash": "641e0e999b0fb9f59ee67e99926ba912", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-a9142ec9-2efebc30ade8.lukitus", "sha1_hash": "d4b94289b0631439864046a593714b6e0e033c4d", "sha256_hash": "d12ac6afc663ddc778f3ecc28e5fc90729b65a5072ca33c192bb9422ce62e29f", "size": 85499, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a63de682a5feb2c95af786dd6df44823531810f6", "file_type": "created_file", "id": "file_48", "md5_hash": "6e9af0cc8bcf2fa16f861f5e58ec2628", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\alldt37so 5xcj\\f56924be-9663-41bb-d65a438b-83dfabbb8ced.lukitus", "sha1_hash": "a63de682a5feb2c95af786dd6df44823531810f6", "sha256_hash": "f35bd6b431d60d92171acb7e00fc7a8d9f542910d99619a390797bec49c929ba", "size": 71224, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dc3ef9c5cdb18b8094c6cb5a99da648b0abfb202", "file_type": "created_file", "id": "file_49", "md5_hash": "bbe54ff129630a5dfd8678ddd9aa3c59", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-bb96571e-96bbd2c0a8b9.lukitus", "sha1_hash": "dc3ef9c5cdb18b8094c6cb5a99da648b0abfb202", "sha256_hash": "660f420ce546f6714efa7a0a4cc6964fd2be7b29c46b2e15382753969a1ef9d0", "size": 49125, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/489c8f2431864bcbc1ea9803767f97782311f299", "file_type": "created_file", "id": "file_50", "md5_hash": "62b011e83e86e7077823d885d1bd2f6a", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-41fc6dd4-65a22d7f605c.lukitus", "sha1_hash": "489c8f2431864bcbc1ea9803767f97782311f299", "sha256_hash": "94e6b2608712fbb162be540f2a78632ed74cac57b3db7de1fc6f62898911d919", "size": 93546, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/114fca0136be8b192de0de76fe3203203382ec62", "file_type": "created_file", "id": "file_51", "md5_hash": "ea428f35f421f3a4b0d2a4a46bdc4051", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-6c56a97b-e7e6a4aa125b.lukitus", "sha1_hash": "114fca0136be8b192de0de76fe3203203382ec62", "sha256_hash": "d4e401cef6051ff974180b327f9c4234a67dfa07e56b9313dba5735ec0404ec5", "size": 43655, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/71a89ea03798dafd9228861e65f3570ce74b9164", "file_type": "created_file", "id": "file_52", "md5_hash": "e15198354fa0c3c3e4dc76f9a8208910", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-a60ce289-e55a447535d2.lukitus", "sha1_hash": "71a89ea03798dafd9228861e65f3570ce74b9164", "sha256_hash": "49caef250b7bc24751001002b12d043b17620e7aa8004696e19967bb8b2a790c", "size": 23489, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6eb90349f272dbea69efe746cbc394059f845dd8", "file_type": "created_file", "id": "file_53", "md5_hash": "8970e86ba4de3c42745f25fdd54ae197", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-21f0ca53-f69e38a75cc4.lukitus", "sha1_hash": "6eb90349f272dbea69efe746cbc394059f845dd8", "sha256_hash": "8fedbbb46e330730684e9a9d812a59fc57adb6c18d04ceacc35754277bd253d4", "size": 54748, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/49106e215048c20ce86bcfe9f908899a9399bcb0", "file_type": "created_file", "id": "file_54", "md5_hash": "4583cd56d09e37fc0ff4dfdf04479540", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-4b69e5a7-f60e62fe4654.lukitus", "sha1_hash": "49106e215048c20ce86bcfe9f908899a9399bcb0", "sha256_hash": "fbea91064706acd43c1fc6facec79a8c82cf6a6b6fb2cf0783a7f44d6dc9cb3c", "size": 15527, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/02f22b739ca7aa67f2c516ab3ea123f792331e61", "file_type": "created_file", "id": "file_55", "md5_hash": "5816b177c84d1e4b863230be0d9b9155", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-541108f9-2da524f314c7.lukitus", "sha1_hash": "02f22b739ca7aa67f2c516ab3ea123f792331e61", "sha256_hash": "1a8848a90f9aee5f5bdeed6888f423920691f2c5f39be46ed56a4c729404ad15", "size": 75497, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4348bad3bba73608970b5a077b1c55fd0d427ffa", "file_type": "created_file", "id": "file_56", "md5_hash": "30795453a10b70ca931d8fe543dfc0f8", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-43743ab0-5b4f9943c7b9.lukitus", "sha1_hash": "4348bad3bba73608970b5a077b1c55fd0d427ffa", "sha256_hash": "6a1a9268cbfd7e9c5f8ec150ac2551c2ff78a7a79ce2b0af9ebd049abc7a9398", "size": 64699, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fc1e5754c9fc56908667ecf8bdf6d267e951e90e", "file_type": "created_file", "id": "file_57", "md5_hash": "f18da71f888de931c6d290190ee237a4", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-3f7eea71-eeab13681eba.lukitus", "sha1_hash": "fc1e5754c9fc56908667ecf8bdf6d267e951e90e", "sha256_hash": "4e5f5f0e1e2724b82bfff92ab479d236385d5240fb370047bee42d15017ee289", "size": 50135, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/001b04bdf199936d2718ef025a2c138fec1e9b8b", "file_type": "created_file", "id": "file_58", "md5_hash": "f1e6b4a6cc6867fc03350e84c3c35441", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-44e29957-51107f7f4923.lukitus", "sha1_hash": "001b04bdf199936d2718ef025a2c138fec1e9b8b", "sha256_hash": "6016bd71e598ce5808efa9e10aa4ee25706b088817596649177a0db54b984650", "size": 24694, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/654428393afb60031d4d6dff4ae21170e19d1402", "file_type": "created_file", "id": "file_59", "md5_hash": "3aa6f3df2b8863ba677b0fce9d227f3b", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-b70504b4-e9a7156822c1.lukitus", "sha1_hash": "654428393afb60031d4d6dff4ae21170e19d1402", "sha256_hash": "d045abcd1d24931a3a988e8ab2f3ba2ee52178eb22ed4260d78392d133fc38d0", "size": 11937, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/69d4fbff5e0b93c276b12cd5df74f59cd7c68bd8", "file_type": "created_file", "id": "file_60", "md5_hash": "0f1e68e87c1e3926b00f03e9fd4314c6", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-3c30f310-5c6049e3f1c5.lukitus", "sha1_hash": "69d4fbff5e0b93c276b12cd5df74f59cd7c68bd8", "sha256_hash": "ec6da516a2e8ab7edc761e8dbf63ad5a39f144a559a54e3e9006d9d568d8708e", "size": 103194, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7c99aef210b09b55359f0b186e7ed6bba95ddc1a", "file_type": "created_file", "id": "file_61", "md5_hash": "10bdd7483abd5c15780cd187eec6d3e9", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-88736a33-a73fd1b5db9a.lukitus", "sha1_hash": "7c99aef210b09b55359f0b186e7ed6bba95ddc1a", "sha256_hash": "6cc4988052fc5268208c1aa802278a723729c40c317822f58603d3da4755a35b", "size": 78270, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/49684d357f3b02e62331a8799d388af9b3947fa5", "file_type": "created_file", "id": "file_62", "md5_hash": "ecde9114fa71134e4ecd50f6769477eb", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-49600478-a7543df24f7d.lukitus", "sha1_hash": "49684d357f3b02e62331a8799d388af9b3947fa5", "sha256_hash": "aa71a2986de776387f5ed629e5a672b004f7afa098b9d2d571ee8f4777454768", "size": 40561, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7b2faa090039ac242ec7963df62d2dfc747112d6", "file_type": "created_file", "id": "file_63", "md5_hash": "2c5ba72782c99ecea584b9c58bcfd905", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7b6afc43-b245cc6e1dd0.lukitus", "sha1_hash": "7b2faa090039ac242ec7963df62d2dfc747112d6", "sha256_hash": "afabc17789bc548a251043b4ee9b9d48237914694991bd44d596077a65729a9d", "size": 21053, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6ee7d9e79c939d896d8dfc59e93bfe1629f048ec", "file_type": "created_file", "id": "file_64", "md5_hash": "0b48798fab9d59f4cdc78ca9a7df98d7", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-026b0f52-b0ee23b731c2.lukitus", "sha1_hash": "6ee7d9e79c939d896d8dfc59e93bfe1629f048ec", "sha256_hash": "888e468487916657638ce4d470e13a0ad0bfda2a5d5176974ac9c5429dc81cfe", "size": 26401, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c4cdfb836256228e788c938afa5480544a43421f", "file_type": "created_file", "id": "file_65", "md5_hash": "4dece80ced1f7c0b40c0e71b9253ae6c", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-71ad6e57-d734bc0dc073.lukitus", "sha1_hash": "c4cdfb836256228e788c938afa5480544a43421f", "sha256_hash": "d57dd4c701f4d7ace0f4eb88b08855349155bbac8be1e050342a97259182f2e8", "size": 56640, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e47f983b65ea4bf4e521001b7332d875578f7457", "file_type": "created_file", "id": "file_66", "md5_hash": "6c589300bccff80e34e7ee89347ab822", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-7b4e72c9-ec40cc1387f6.lukitus", "sha1_hash": "e47f983b65ea4bf4e521001b7332d875578f7457", "sha256_hash": "970f3cf452bd4aa7938e2ed7ab8a4332e1b60156b1fb95b9cd01c6559f5ee597", "size": 61398, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c380c52ebfdb46add2fd95277002555716fbf9df", "file_type": "created_file", "id": "file_67", "md5_hash": "674111b049564a315cb77810334b6812", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-b233076a-f3f69be0de98.lukitus", "sha1_hash": "c380c52ebfdb46add2fd95277002555716fbf9df", "sha256_hash": "ecebe3573c7b92387ae8a27aa2d8f20f07c9b0ec02a574f2135601e7112883a6", "size": 58415, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5354fad509be0ae80298573ac94b0fb1e3ab3553", "file_type": "created_file", "id": "file_68", "md5_hash": "58629c03a02f8949cedeb4264ae04000", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-b0d08948-4afdf1d5a73f.lukitus", "sha1_hash": "5354fad509be0ae80298573ac94b0fb1e3ab3553", "sha256_hash": "fd3874cafd3e153d71614dc0040cc91995be12f1960887f6e02d82be1c480be7", "size": 47234, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f61aa973b6b13874aaec4e5552460ae34ab7b467", "file_type": "created_file", "id": "file_69", "md5_hash": "c5bba3c53d13a5b64cc017e0a01699c3", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-e6373d05-052cd23b85b0.lukitus", "sha1_hash": "f61aa973b6b13874aaec4e5552460ae34ab7b467", "sha256_hash": "89d4c40bd26112498cc38a463859197e73e7d268fa423dadf30c74a942680ce9", "size": 56070, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0305bcf827446971e40619ce39195e5d50e26299", "file_type": "created_file", "id": "file_70", "md5_hash": "fa8eeeb7176b52428f50c47cffda51a0", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-0b1192d3-83011f532cb4.lukitus", "sha1_hash": "0305bcf827446971e40619ce39195e5d50e26299", "sha256_hash": "acd89d750354acd177632d4f35b73cbb978c73410194e533d561ff26371eb022", "size": 100406, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fc13679abcbae212bd248c04369ee984829d5c21", "file_type": "created_file", "id": "file_71", "md5_hash": "390c978963fa6fcff45f6ff8fb706571", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-0bd9344f-59e2fd1b8612.lukitus", "sha1_hash": "fc13679abcbae212bd248c04369ee984829d5c21", "sha256_hash": "83978e3835fd145da977a36ff5594a90c8017549ab5978b7ec95d0034a3124cf", "size": 37942, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0830a240a25dd5b312f47e724372a29bc2814e60", "file_type": "created_file", "id": "file_72", "md5_hash": "fe9bfe26bfca15c48c16c7e07c895ddb", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-16ac9b2b-cf64176b99fb.lukitus", "sha1_hash": "0830a240a25dd5b312f47e724372a29bc2814e60", "sha256_hash": "872bdcfed75cf02be4290f4bec9a88b4a331d0bf181b6e69855b43c7dfa83fde", "size": 85976, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ac707c1fc026c0f9976e22bb661a0bad2d4c0293", "file_type": "created_file", "id": "file_73", "md5_hash": "e5518c14c1615ce72e9fe3f20ed115f6", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-6533c1e4-c0738507f428.lukitus", "sha1_hash": "ac707c1fc026c0f9976e22bb661a0bad2d4c0293", "sha256_hash": "4321f2bb650270e29efa859d59fdd1f367843abdaa1163231d36a0626ab23fd5", "size": 95738, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d5e6fe17cb9eb5de11f650c91e679aeaa52ee463", "file_type": "created_file", "id": "file_74", "md5_hash": "3c622893d523c4b4cb2aa0f86108bd61", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-d49bf973-e058168b454f.lukitus", "sha1_hash": "d5e6fe17cb9eb5de11f650c91e679aeaa52ee463", "sha256_hash": "f39349480a4152ea8aa13c8eda001d9324c0c665b8f7a171baa3ce008cd59b70", "size": 35566, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0395fd72c9dec4e630c9d3e172c865e9210521a6", "file_type": "created_file", "id": "file_75", "md5_hash": "e5d7624acd733aeb46248b02a5ca37c9", "norm_filename": "c:\\programdata\\sun\\java\\java update\\f56924be-9663-41bb-0fd4e971-761d2214f09f.lukitus", "sha1_hash": "0395fd72c9dec4e630c9d3e172c865e9210521a6", "sha256_hash": "6f4c324050b26f7478cec8e26b863203838ed110269b72d6bb7fc4483002bcfd", "size": 955, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c6e88abe0d62ed019a4a315ca93148e32d249887", "file_type": "created_file", "id": "file_76", "md5_hash": "f6d233d0e54794f515e43c3957b4bd36", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-13f942e8-48eb76e84f48.lukitus", "sha1_hash": "c6e88abe0d62ed019a4a315ca93148e32d249887", "sha256_hash": "0fd7093c5030e4b23a5cf48c98cd315c8caafca22a9ee2baf5797a3e1f79cb73", "size": 16502, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/75cb4df8e34e98118504825f6980de6615dc6f9e", "file_type": "created_file", "id": "file_77", "md5_hash": "38312e874cc6187dd6df21fa661996e5", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-29a7dc8c-dfc0e8056306.lukitus", "sha1_hash": "75cb4df8e34e98118504825f6980de6615dc6f9e", "sha256_hash": "aebeffb8b208901908b42efbbd6ada7818009df9cc6dbdd16d2d87003a8c0a6d", "size": 15250, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/840c8e1cf059750555b3c523d8f373879428ab8b", "file_type": "created_file", "id": "file_78", "md5_hash": "015ae1bde6e5fec87cf588c3e391a541", "norm_filename": "c:\\users\\aetadzjz\\documents\\fwkh\\f56924be-9663-41bb-44ce3cd7-afd504f36697.lukitus", "sha1_hash": "840c8e1cf059750555b3c523d8f373879428ab8b", "sha256_hash": "1522fed94f047caddf8819cb859caa543cf4dac5ddec13a0fc349bef54c148e0", "size": 47429, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dccdceb4b973ae7415d377d29115ce5afa3c0c35", "file_type": "created_file", "id": "file_79", "md5_hash": "f437376e25b9953e5f49c245fb862780", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-1bcb39fd-c93e3b4c590b.lukitus", "sha1_hash": "dccdceb4b973ae7415d377d29115ce5afa3c0c35", "sha256_hash": "c81e0492c58eb3f5ccaa7d8567f4a827a8ea6f71a46f229354f0fd6d9ffddb3e", "size": 75786, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b15340ac53f9bb3ac3e42bb05be0b1f83cd966eb", "file_type": "created_file", "id": "file_80", "md5_hash": "3b91a491b3fa287c78a534a50d2cf296", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-8ec36e5c-ca39e2ca23e1.lukitus", "sha1_hash": "b15340ac53f9bb3ac3e42bb05be0b1f83cd966eb", "sha256_hash": "6a8232b65ca125b44bb33194492922fc42bb9250de0905e377de8a73314bb54b", "size": 22787, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1e6b31dadbe5ab38a5d91c548c66099f1841d165", "file_type": "created_file", "id": "file_81", "md5_hash": "c7a0cc1ec3308de7726404756f4224eb", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-db3a9c6c-b4a2996d18e4.lukitus", "sha1_hash": "1e6b31dadbe5ab38a5d91c548c66099f1841d165", "sha256_hash": "95d11560d5a43ec88a6abf98bf90599db244c3332565c0afb9b4cdc99e80f2f8", "size": 846777, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f45c343692c552032c1becc8c04dcf524f980b9b", "file_type": "created_file", "id": "file_82", "md5_hash": "eb2b55105302183288147363c55327b2", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-63f06b4d-40748180c2c9.lukitus", "sha1_hash": "f45c343692c552032c1becc8c04dcf524f980b9b", "sha256_hash": "d49aecda2c122fc9c5b0bfcf377297600ddf2a77d9d9a456f995682250a20890", "size": 596120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/30e07368b76be57ad85cbc1ddc0f0ec6546b891e", "file_type": "created_file", "id": "file_83", "md5_hash": "c992e8f974b5f9f9cde843e199bbe780", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-2128228c-3ef411e166f1.lukitus", "sha1_hash": "30e07368b76be57ad85cbc1ddc0f0ec6546b891e", "sha256_hash": "93f55ef6b0be02288a81713828056490fa63b92618a0e94a767f4c1ca9ba77fe", "size": 776538, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3d5c85361e5d94a474785e5226a0d904814c89f2", "file_type": "created_file", "id": "file_84", "md5_hash": "609dd4e8666f15060b352c277496b383", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-7d28049f-ca2dc98d9072.lukitus", "sha1_hash": "3d5c85361e5d94a474785e5226a0d904814c89f2", "sha256_hash": "027d71512c9a53eeb25f3a1a1f151cd86dc44de15e6c205bf121e658ed28fa09", "size": 69235, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8deb398747c130d5b16251a6bcf6832f71931bde", "file_type": "created_file", "id": "file_85", "md5_hash": "0cae6416a51b268c9180d03f59d92dc5", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-d0039c86-9e680ba77e12.lukitus", "sha1_hash": "8deb398747c130d5b16251a6bcf6832f71931bde", "sha256_hash": "7480b58b1ab6137d68cc828284920c935c30038e6f196380c3cc0818667a6191", "size": 781667, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b12037b8e0b3ca3118e5af1c01800ca5b3616b1c", "file_type": "created_file", "id": "file_86", "md5_hash": "69cd8258f01125b41414f4441106351e", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-16db964b-ddb43481f1db.lukitus", "sha1_hash": "b12037b8e0b3ca3118e5af1c01800ca5b3616b1c", "sha256_hash": "d31ab02d80c5e8b60eeab53a17c4ad59e35596ccd71ffbbee9f7e7fb1ee30506", "size": 99891, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bca7b2364baf01c154f886b21b8d20cbfa0ada6d", "file_type": "created_file", "id": "file_87", "md5_hash": "ff5c86ab51b783858399547f89eecd26", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-8ea4d603-5a2874fae3fc.lukitus", "sha1_hash": "bca7b2364baf01c154f886b21b8d20cbfa0ada6d", "sha256_hash": "78c50b44e3fc2ce3ec7fc8869c4119d1f1b34bd5f9196f82fce154c846827fe7", "size": 562112, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f59c4f09d5aafd93b52f7db3ec872fab6abe73f7", "file_type": "created_file", "id": "file_88", "md5_hash": "4e52eca69058b5b90c3cde991c6fd074", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-bea9b2d7-58d4fa770e74.lukitus", "sha1_hash": "f59c4f09d5aafd93b52f7db3ec872fab6abe73f7", "sha256_hash": "3fbc6b06e92ec7067183adefbc0b01b2d8eb5d74cd05a24f67cb83f0af1a63a3", "size": 778671, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d08c6626fc2d953917239146aa9dd157967f9c8c", "file_type": "created_file", "id": "file_89", "md5_hash": "ad9fc03fdd67cd9298591ea0d12f9347", "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-34c63d6d-4a50106c55be.lukitus", "sha1_hash": "d08c6626fc2d953917239146aa9dd157967f9c8c", "sha256_hash": "efa59c6e1aceb673a673a44fa7259970adced9049ad1ba518793a34a9bcc31b3", "size": 2436, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/826b2d4b79875fb6b9ed0b54c41c8b47c6b80e34", "file_type": "created_file", "id": "file_90", "md5_hash": "5ac26135af6fc8fe57d50c009b23a973", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-6ae0090e-6cdcb46c0311.lukitus", "sha1_hash": "826b2d4b79875fb6b9ed0b54c41c8b47c6b80e34", "sha256_hash": "86be99489223371ded8182569b025831e04cd54239c4d688aa021ae5f5b1fc07", "size": 16229, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/af3fa4ea7f69bc944db7bc8a8c7604524aab4960", "file_type": "created_file", "id": "file_91", "md5_hash": "cc16e88d461b2a64a0a07952011b6c78", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-3b2b7f6f-812656df84c6.lukitus", "sha1_hash": "af3fa4ea7f69bc944db7bc8a8c7604524aab4960", "sha256_hash": "af85ec3bf7280380e72c235d78709e7503ae93b9202d26e23ddd92882c7371b5", "size": 67908, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d088416707db0ee6142c662e65102f48d5fb884", "file_type": "created_file", "id": "file_92", "md5_hash": "ca8ce82168e9cf9cf3e17e811d8012ae", "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-fa0d154b-245888d727e3.lukitus", "sha1_hash": "4d088416707db0ee6142c662e65102f48d5fb884", "sha256_hash": "a7f002038faba925f927b8f413df6a76340dc71e88918357bc7562ccda14c087", "size": 65088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5e9a50e85d5b48227b523c373a7b9440f2efa9db", "file_type": "created_file", "id": "file_93", "md5_hash": "186014ca84f18a2a0a4cf027197c3659", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-85ab3cab-1a0670314428.lukitus", "sha1_hash": "5e9a50e85d5b48227b523c373a7b9440f2efa9db", "sha256_hash": "be55916dfabe1669c8523e6e0a87df65e73faa665875aa26e99e8f0369499714", "size": 621724, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/17987b1957027fa4bcea9f3296c4f4b2a696256f", "file_type": "created_file", "id": "file_94", "md5_hash": "125ed2e35e1356ec3ce7af04d089cf6b", "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-1753ef9e-5a7f628573fd.lukitus", "sha1_hash": "17987b1957027fa4bcea9f3296c4f4b2a696256f", "sha256_hash": "5ae802bc9c55e110e649bc8f375bb060218f0138e31d071f76f82363c00c87f0", "size": 25290, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/354e90bd9f3f0b30ca32b69be03bd8fb4f638125", "file_type": "created_file", "id": "file_95", "md5_hash": "8d9d2ea39d85168297b0c8463aa91048", "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-6edc54f4-2a6316bc2a6d.lukitus", "sha1_hash": "354e90bd9f3f0b30ca32b69be03bd8fb4f638125", "sha256_hash": "7561bca5b6c8df3f4f7f7e36f03bb0bc3edea4025ad99b1b03630f355a63678a", "size": 83817, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f0bf0b4046527293854810e644625d675019bdc2", "file_type": "created_file", "id": "file_96", "md5_hash": "4ce15772a2aac9a6add35ad06980e018", "norm_filename": "c:\\users\\public\\pictures\\sample pictures\\f56924be-9663-41bb-ad1ca3c0-3165ab58af89.lukitus", "sha1_hash": "f0bf0b4046527293854810e644625d675019bdc2", "sha256_hash": "9df69ae1c809db7fb5cbe188b0f9d88e86dec488d44d5ac8f33fe284e3615294", "size": 880230, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/70cc3921b3c6718efc69b559c044e47aaab3b4dd", "file_type": "created_file", "id": "file_97", "md5_hash": "263038a221405a16c3acb6db5ebe9c65", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-5d8cb0e5-0f44328ecaf2.lukitus", "sha1_hash": "70cc3921b3c6718efc69b559c044e47aaab3b4dd", "sha256_hash": "fa6a71c1b63fd9d33b7d252b8f53d7db96645299269b92028ba8d5ca5b34f023", "size": 89288, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/97e28ab0727fed8be616863e4994fc8e01ff028b", "file_type": "created_file", "id": "file_98", "md5_hash": "7db96eedf7fbf29176b3f971cc7850fc", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-0725fd16-48003b943989.lukitus", "sha1_hash": "97e28ab0727fed8be616863e4994fc8e01ff028b", "sha256_hash": "5ed5325f19dccd610d97e211a461e9e7c7bd3b2a76337074a57690d218aad144", "size": 91093, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/88fc8e84ec4a5a1df24c99ea8d9325b3150e1d07", "file_type": "created_file", "id": "file_99", "md5_hash": "6c5f6d6c1f9cb1698087815dae3ae6ad", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-21ea5f2c-8701a72f2220.lukitus", "sha1_hash": "88fc8e84ec4a5a1df24c99ea8d9325b3150e1d07", "sha256_hash": "6d78af00ca0852baa7fcb08b8a5cecb51fc1ed2451c1af3fc9832e35a8b24a5b", "size": 98928, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c40e0cf6dcefcc47bcb333be2ba4b36346a74fb1", "file_type": "created_file", "id": "file_100", "md5_hash": "875bd5e3e0eff4b0d987ae366d7e6041", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-5eeef7e5-307233feb153.lukitus", "sha1_hash": "c40e0cf6dcefcc47bcb333be2ba4b36346a74fb1", "sha256_hash": "6026dcd8bdb731eeebd07c9111a9eb27dadd78366758b155ff87d6b2d0ff5160", "size": 101738, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6d76f7c3d691e026700c5cdbe6158bd42b21972b", "file_type": "created_file", "id": "file_101", "md5_hash": "d17b3d430fde8beeed17cc0efb664ab1", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-105fd1e1-6c6be53496ea.lukitus", "sha1_hash": "6d76f7c3d691e026700c5cdbe6158bd42b21972b", "sha256_hash": "aeae24d279b192567f7a90b71371ada1d8a8f75855884e6ea1a734a5f454df7b", "size": 69504, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fc8889186c0193b52b3d54a4cbe509be027f330b", "file_type": "created_file", "id": "file_102", "md5_hash": "da6e9f7e90d23867edd35d848ddc5aaf", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-0dcfa9e5-faf41d841f89.lukitus", "sha1_hash": "fc8889186c0193b52b3d54a4cbe509be027f330b", "sha256_hash": "ff27ae1c3d97c77c38bc0dbbd43af610807a60b4110faa713837181384cfb326", "size": 60407, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6dc03568c39255efa7e4ea35913b0066d7a26a3f", "file_type": "created_file", "id": "file_103", "md5_hash": "5e564cee97c6dfe94cf72453127fd8f5", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-4fe46af0-e6208dfc4337.lukitus", "sha1_hash": "6dc03568c39255efa7e4ea35913b0066d7a26a3f", "sha256_hash": "d05b35f4f554bd90937a62728f4ddedb55ea1a932e794798c175ac0dd73ccbe9", "size": 58673, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b7c61c830e942ea271ffa047d6eda694058abf6", "file_type": "created_file", "id": "file_104", "md5_hash": "9dfa0bee9df987f02306da67434a65a7", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f56924be-9663-41bb-8ebdca29-fd38b8601764.lukitus", "sha1_hash": "9b7c61c830e942ea271ffa047d6eda694058abf6", "sha256_hash": "6566cb2b42873520944bbfeb9578d12caad563f5e945bade9314d867a9821ec7", "size": 87698, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c1ea0086f2d686ce51e87a19cf37b41e6fa90d14", "file_type": "created_file", "id": "file_105", "md5_hash": "3f844b86b9c824437f480abad28c6c99", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-bfe5064b-970c8f5a0518.lukitus", "sha1_hash": "c1ea0086f2d686ce51e87a19cf37b41e6fa90d14", "sha256_hash": "3a8f1508d6a20477182d64710204aa832adcc0699dff1e67da0b198a864dd5a6", "size": 16375, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5b8561902d5b06e84d2dca6e20495664de89175e", "file_type": "created_file", "id": "file_106", "md5_hash": "4df6e6740c263aa385de7ab8d612c2f0", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-85a5b08a-605b60b6ebd6.lukitus", "sha1_hash": "5b8561902d5b06e84d2dca6e20495664de89175e", "sha256_hash": "b33ac7b2c77c3f2feb83405ac5eaeb3fa4d60b20b2c05a8c06443a314a104a81", "size": 72206, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/53b90e5c4e2ad6c5b99484bc893a213e581b2b07", "file_type": "created_file", "id": "file_107", "md5_hash": "c7fc4e55b879a5c4bb78bf9364d2b18b", "norm_filename": "c:\\users\\aetadzjz\\pictures\\8lya8agxgsi0\\f56924be-9663-41bb-88881914-b3ae12b46247.lukitus", "sha1_hash": "53b90e5c4e2ad6c5b99484bc893a213e581b2b07", "sha256_hash": "b771cd820eed03b368ea27b206dea765c6c48ba4ed97cd48b3d2d320312ff033", "size": 12052, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8d5d1151035a895ad1c59328d8bfbb2873edf376", "file_type": "created_file", "id": "file_108", "md5_hash": "af7714a87bb259577f9cd70ba3b4a43f", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-786f2966-85dd58079d16.lukitus", "sha1_hash": "8d5d1151035a895ad1c59328d8bfbb2873edf376", "sha256_hash": "b6f4a6687bd21aed052c4ec0847537fce383cb022701e275145efc4844451766", "size": 72332, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3d38abbb116daa61173c8a05eb20eb14997fa28c", "file_type": "created_file", "id": "file_109", "md5_hash": "d6ffc919dd46ef2225ad09abb6b03cb3", "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-160875ab-8c16168ef4dd.lukitus", "sha1_hash": "3d38abbb116daa61173c8a05eb20eb14997fa28c", "sha256_hash": "4bdbe60d8db008ce218a5c184c91b41176025d6a18e09edefc28581ad4d86413", "size": 35461, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e2b9f0fe121aefc6def63636ca6f75dd12400811", "file_type": "created_file", "id": "file_110", "md5_hash": "0eb5d0a5a5a1c44e54259d4385118891", "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-169e6313-c430f979b7e3.lukitus", "sha1_hash": "e2b9f0fe121aefc6def63636ca6f75dd12400811", "sha256_hash": "82596611766de45740b6b6a930b97aff8f8053925a3173424bdf9b7f73fa2858", "size": 95725, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f0b7a35386e13258f201612900d830b72907839b", "file_type": "created_file", "id": "file_111", "md5_hash": "1336a8270def600025b9e56b32364fd2", "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-ed8e90b1-c99eeb3cd344.lukitus", "sha1_hash": "f0b7a35386e13258f201612900d830b72907839b", "sha256_hash": "b482c547d6c27c38404265e23e89eee5b08a2a9cda977c6777a586f9407f43d1", "size": 31098, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5819a5f2c9476cb1695b7be464e667c83cc4df23", "file_type": "created_file", "id": "file_112", "md5_hash": "54691b48c2c6a9cac8fc27e298e243c6", "norm_filename": "c:\\users\\aetadzjz\\pictures\\_2aelz\\f56924be-9663-41bb-d8d6a0be-1eeb096f86f6.lukitus", "sha1_hash": "5819a5f2c9476cb1695b7be464e667c83cc4df23", "sha256_hash": "c8a694b9b45d39f0e8cf97fa56356fe2e624aae6ab1b4d41326f3509d5696ffe", "size": 78539, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b630e4ae8ef2ffc2de66e87aac945a40a9287693", "file_type": "created_file", "id": "file_113", "md5_hash": "b8e392254147a37a185517b4f6b3042b", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-c18f2589-5c71bf4f3255.lukitus", "sha1_hash": "b630e4ae8ef2ffc2de66e87aac945a40a9287693", "sha256_hash": "5f578fde878f6aad06bc4d9e6595544840e9dd9a9380907ba4adedf8a3c4104b", "size": 56567, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/928b5cfed88226f6f8e55f44dab1511f603dfb39", "file_type": "created_file", "id": "file_114", "md5_hash": "6d481224bac4a1e375b34aaab96f3125", "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-a5d5084d-decb3b0c7615.lukitus", "sha1_hash": "928b5cfed88226f6f8e55f44dab1511f603dfb39", "sha256_hash": "98da131ca6f3fc566c73ced50216f3a3be3056925bcf15f2ac5f10827abae3e0", "size": 35842, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8518bd401583d47d3665e6e3a15e0351e4510f8e", "file_type": "created_file", "id": "file_115", "md5_hash": "042b78909f13410e288ac87979e83d61", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-a080fc17-79d47057b610.lukitus", "sha1_hash": "8518bd401583d47d3665e6e3a15e0351e4510f8e", "sha256_hash": "4943e008dee7cfaa9017bc5762d32aaab9612f3c4a32ce504de784774c63ed44", "size": 35092, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d355b436a6ceda728b93467c1c9dd5ace99e2c2d", "file_type": "created_file", "id": "file_116", "md5_hash": "006811bc5dafe18a5b3cbb8a6e05131d", "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-1d9631e8-90bf411c2fee.lukitus", "sha1_hash": "d355b436a6ceda728b93467c1c9dd5ace99e2c2d", "sha256_hash": "63cb3577f7b000f7b1525c50de49248fd795cfe7596afe1b4b16fa9fce8146e8", "size": 39731, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/89f8ac79a5abbfc6bcb18871f76291b4bcfe1d98", "file_type": "created_file", "id": "file_117", "md5_hash": "2bca9c801bae8b187e614854dcfe45d7", "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-8b683683-04f707d56484.lukitus", "sha1_hash": "89f8ac79a5abbfc6bcb18871f76291b4bcfe1d98", "sha256_hash": "ff741da1614409e35ab97081ccbbd0acdc727eab1faea2464556dfa6f382325a", "size": 9832, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/79f080fa37c9b8e4b7d8589ac7872a51a853f19f", "file_type": "created_file", "id": "file_118", "md5_hash": "133e56f297202ce2b8d6e56a58e51483", "norm_filename": "c:\\users\\aetadzjz\\pictures\\97sfy1rz\\f56924be-9663-41bb-ecb96fe5-208908824dc6.lukitus", "sha1_hash": "79f080fa37c9b8e4b7d8589ac7872a51a853f19f", "sha256_hash": "4d0b86aae98709ac16bfd3c7c70d361fad7f8862ab72fff806a89a2af71a96dd", "size": 64187, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/acc2618bc1f8047a7db70c0de263f554261b82eb", "file_type": "created_file", "id": "file_119", "md5_hash": "d139fc83092b0854111e706415920b0e", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-61116eca-f6682086be7a.lukitus", "sha1_hash": "acc2618bc1f8047a7db70c0de263f554261b82eb", "sha256_hash": "31b652297f9c7406cf1a8ba5821f9e5bef71bc5ecd9c7f5994d0312497f61b3c", "size": 24835, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/940d4cedf379e2194cc1cd1d716e6b97ffa35264", "file_type": "created_file", "id": "file_120", "md5_hash": "29b4e594c48dabb7444129b2a768267d", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-0a72e3e6-09c6bd33ae22.lukitus", "sha1_hash": "940d4cedf379e2194cc1cd1d716e6b97ffa35264", "sha256_hash": "0cb11a43748c609b624ba2f700c2ec2ca89295212fd8bafe18ea9470adbe366c", "size": 77945, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e0063d8ef02c58e1473c851668fc47340a1cfa99", "file_type": "created_file", "id": "file_121", "md5_hash": "131f61fb3e4a2e22a28b28f76cf85ea5", "norm_filename": "c:\\users\\aetadzjz\\pictures\\f56924be-9663-41bb-0f2db1b7-adea5382834b.lukitus", "sha1_hash": "e0063d8ef02c58e1473c851668fc47340a1cfa99", "sha256_hash": "3d36441a4038a8c4feb102ba50c6df7784b4dd07692988aa762a6d5931d948d1", "size": 3620, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7ced67dbf0f687ad3bf18c945555278d26d2b688", "file_type": "created_file", "id": "file_122", "md5_hash": "60b29baa2723f1c9fc8ce005d4114859", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-97bfbcf8-b516116e07da.lukitus", "sha1_hash": "7ced67dbf0f687ad3bf18c945555278d26d2b688", "sha256_hash": "ec2dfc3efb3c6b0dadb82899beedfc99c3603cb75ae30378ce14b59c80615058", "size": 62671, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/42b2837c3f3d166b08ace6d91c45a3c3f42e4a9a", "file_type": "created_file", "id": "file_123", "md5_hash": "a36d01388c5b36b44cfb81b19d7748ec", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-9d05ef54-2dbbb8a0a892.lukitus", "sha1_hash": "42b2837c3f3d166b08ace6d91c45a3c3f42e4a9a", "sha256_hash": "181df77c09a33d85e521fcda50da59471a616369e4465ab197782ee127af0c13", "size": 66650, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aa2fe6c8cd7b75981e0cc635814bb16547d10504", "file_type": "created_file", "id": "file_124", "md5_hash": "01511775c3f72b14aa155c2192ba8ab4", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-9260e0d0-755888374530.lukitus", "sha1_hash": "aa2fe6c8cd7b75981e0cc635814bb16547d10504", "sha256_hash": "df34c8df3cde7aab5b6a9cab0b987e65cdb9c2a4614729a1304264f7e79ecb43", "size": 63518, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5d9198f39a76648b546fafd1f7dc9bc94e089f56", "file_type": "created_file", "id": "file_125", "md5_hash": "56a3ddd0fa9090b7b512025e5a401e20", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-753475ac-25e968e13af6.lukitus", "sha1_hash": "5d9198f39a76648b546fafd1f7dc9bc94e089f56", "sha256_hash": "d0ac77f4c7c1c4a64007f1c59cf668897b490308b8ba956701e127409fed7ad4", "size": 18067, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/42c91cf8722c0480ecfb35f1265a2791911bbe14", "file_type": "created_file", "id": "file_126", "md5_hash": "57e9752de10254dc8fb5ef62a1f56410", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-3bb4b2f2-cd9a31ba95f9.lukitus", "sha1_hash": "42c91cf8722c0480ecfb35f1265a2791911bbe14", "sha256_hash": "fb58a6bbd7d1c99b7e253a680143a35ec66bd94b3f15dc1b0756904e57f134a2", "size": 28911, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7b5abaed205e052c48fce640dc3dcb1d10a5fca4", "file_type": "created_file", "id": "file_127", "md5_hash": "ee6948d23282c4d051ad0d84752b0b56", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-67a2c15b-ace8513d7dcf.lukitus", "sha1_hash": "7b5abaed205e052c48fce640dc3dcb1d10a5fca4", "sha256_hash": "0d64cc3faa9d4c777a382028cf622a067b843d0d8dab9a17780b72071292716a", "size": 24881, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f561518fee9ccba23ef7a8e607433fb91c522b09", "file_type": "created_file", "id": "file_128", "md5_hash": "a3aa6f24770c48403987ef6d3f661a52", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-1d8398a0-b0f041bd0889.lukitus", "sha1_hash": "f561518fee9ccba23ef7a8e607433fb91c522b09", "sha256_hash": "d7cae341a5b6bb064dcdcee0df2499049f58daf46bf77a68016ba9559a2b2212", "size": 41398, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0fa8e4ddac14120abf524660207c23f96f96c1c9", "file_type": "created_file", "id": "file_129", "md5_hash": "e7f11bfabe783d3b2bd6a97bed38a1e9", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-26890357-3e98a81805a4.lukitus", "sha1_hash": "0fa8e4ddac14120abf524660207c23f96f96c1c9", "sha256_hash": "fb8939676fabc1d3c0bfc48cfaadf45264d2674271df638ff6d9c36ea5e65c51", "size": 8658, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5fef2beafd23a7727ff7d302fe549303dc9d8375", "file_type": "created_file", "id": "file_130", "md5_hash": "84844a574b55c3fd72c43876e6f7a6ce", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-920974ec-cc3ab8381775.lukitus", "sha1_hash": "5fef2beafd23a7727ff7d302fe549303dc9d8375", "sha256_hash": "6597ae1e1846f265808e0a582ff3c728a875265a56d4573175c698fc6849420a", "size": 37652, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2cc8ab65b2660e4a04eed3b43414a1d4cda9c447", "file_type": "created_file", "id": "file_131", "md5_hash": "af7bc76a7aeaad2b5e06fb6c590e62df", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-2daadf60-e156096da44f.lukitus", "sha1_hash": "2cc8ab65b2660e4a04eed3b43414a1d4cda9c447", "sha256_hash": "e62fc3fe20b9eb1f99e723bc1d4be399b86685f22981769c5a17c9412252c397", "size": 55004, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b3ac71960dc96959e40b9cc11da8f90c5f9e9f35", "file_type": "created_file", "id": "file_132", "md5_hash": "f971962a5c41b255ea328959a1ea7f39", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-f0395898-eb4252148408.lukitus", "sha1_hash": "b3ac71960dc96959e40b9cc11da8f90c5f9e9f35", "sha256_hash": "4aa6348f1b51026680973444c6a9babd4e52aacd166577443929910cd2467093", "size": 69416, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ba5fb810268b57d4732ef05396b8b633dda1c839", "file_type": "created_file", "id": "file_133", "md5_hash": "165538794fdfd0e2328251c7c781a2ab", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-7c24ae20-0a25aa91c989.lukitus", "sha1_hash": "ba5fb810268b57d4732ef05396b8b633dda1c839", "sha256_hash": "2a760cfbb662cd8bd56d1d0f19f1fa92693ce12ec2d954de48009ca3fe8eb05f", "size": 80688, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/26ad476bdcde39d53378e9088319ca10783edd3e", "file_type": "created_file", "id": "file_134", "md5_hash": "4c31fe3f0361af9550ae36539b089839", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-fa254207-48d9bc68f536.lukitus", "sha1_hash": "26ad476bdcde39d53378e9088319ca10783edd3e", "sha256_hash": "90514fd2e74bd19016b4ad07e76f02c78879706943d54ab1d70fb5a9630b62f3", "size": 31491, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7bd54c718a37a7d4f9ae03d117c82ebc41c4cc89", "file_type": "created_file", "id": "file_135", "md5_hash": "140820055bf5e7d1660cd5bb1aade4e1", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-3ffd1798-470c2125eab8.lukitus", "sha1_hash": "7bd54c718a37a7d4f9ae03d117c82ebc41c4cc89", "sha256_hash": "084866ed274468828acc947e3fbfa62af63ce5d84d9dfd8982e6f24e970ec2ac", "size": 2699, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ac284339d35535076b2620db326c64c73fc65d40", "file_type": "created_file", "id": "file_136", "md5_hash": "50dd1e09cfcc59186ea70aab583a9014", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-7fc86d39-ef25d3b23399.lukitus", "sha1_hash": "ac284339d35535076b2620db326c64c73fc65d40", "sha256_hash": "bfb50446c27128c45569228fbe8ee381704ef171af508391dd8d095bc013f464", "size": 14848, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1c3f5d0b9bbae08814391da2f7880db56aafff34", "file_type": "created_file", "id": "file_137", "md5_hash": "5476591c0489ee38585f8992ca677a86", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-8e846290-5233b81c7d00.lukitus", "sha1_hash": "1c3f5d0b9bbae08814391da2f7880db56aafff34", "sha256_hash": "847bc50b4aa2ab63fd4a335b7e84d5c406cd8a52fed00056797f45a859219f5b", "size": 94581, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dc69d137034ba334da2e48950931ceee9f7bc66b", "file_type": "created_file", "id": "file_138", "md5_hash": "1173aaa14bf0f412fcd92b9265e318ca", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-f4705dfd-535cf3ef79b9.lukitus", "sha1_hash": "dc69d137034ba334da2e48950931ceee9f7bc66b", "sha256_hash": "3b14415e4304ecf7e1ac5f8004fa2a8b4ac5ced6423621044551142d0c710a7e", "size": 81997, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/805699c2d6570747117cc26e80f73ef464592e7a", "file_type": "created_file", "id": "file_139", "md5_hash": "d3f520654b53ca913a53cd3a859c1d82", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-e9f295fd-1189f8affe87.lukitus", "sha1_hash": "805699c2d6570747117cc26e80f73ef464592e7a", "sha256_hash": "5d94a353504c88bf20f4f5e87e613f4886ddceca86d6a45e778b0e8d5ea01c21", "size": 10897, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/565bab6130419a45e1c17abddf1653012684762c", "file_type": "created_file", "id": "file_140", "md5_hash": "7c9c466123107a3796f043f83db191b4", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-bcf63bc1-5bbe68e793e7.lukitus", "sha1_hash": "565bab6130419a45e1c17abddf1653012684762c", "sha256_hash": "54e7710271568c6e28b7f195071871debaa1586ec807077ea8d1282eda42b6aa", "size": 53967, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e0eb2903d9c2be66ac43753987ded0ebdeff7d2", "file_type": "created_file", "id": "file_141", "md5_hash": "44071515d6a0fc0c5cd8707c40ee2483", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-6a36d603-50f4deb3e87f.lukitus", "sha1_hash": "3e0eb2903d9c2be66ac43753987ded0ebdeff7d2", "sha256_hash": "a79d934f2434fe5f5c6340a63ac71012f4116a0d3f6ab24612d7643a5de4ceb8", "size": 72333, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/76157a8daff8551deb964be3c4f30592930af1c9", "file_type": "created_file", "id": "file_142", "md5_hash": "eaf9f4bca0dd2a177d12c2124c140ed5", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-952d529b-bd0be8b63751.lukitus", "sha1_hash": "76157a8daff8551deb964be3c4f30592930af1c9", "sha256_hash": "26ac8ac44fa8cf45758f3e251ba3b05a221e9c1695d6ba5891949af72b28e654", "size": 36098, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ca08c720a5a78050824ac3941315a2fb2ff7c042", "file_type": "created_file", "id": "file_143", "md5_hash": "081e4d7f2b3b835e92872d746282d832", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-b0bb4df0-6cf812a4840d.lukitus", "sha1_hash": "ca08c720a5a78050824ac3941315a2fb2ff7c042", "sha256_hash": "8800474b7b18b9a417a6602e0d2b8cbf9b65b36194622bc019bacf7e5c8f30d2", "size": 67656, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c2dd09e8573a0c2eb968e03ca3964b047c5fbae9", "file_type": "created_file", "id": "file_144", "md5_hash": "41b1031a19e81a8b286987b988a52a18", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-9bd64c04-ad5d37a21037.lukitus", "sha1_hash": "c2dd09e8573a0c2eb968e03ca3964b047c5fbae9", "sha256_hash": "0f4ee31358899953e6f01fd4401e129c08629cc51ad387f5468ce62dc4d4f42e", "size": 49747, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8ac4cc828f3c8d362b6d24b4d2b8ddc6b7afbea9", "file_type": "created_file", "id": "file_145", "md5_hash": "5b2280a98e3651768d842cc12b4f21aa", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-873ff873-535f0466eff8.lukitus", "sha1_hash": "8ac4cc828f3c8d362b6d24b4d2b8ddc6b7afbea9", "sha256_hash": "6285d80b671ce5a93871da7629e3304cf72026c1f241dcced7dcd57d1748a7ce", "size": 51305, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d2700f1c08658d04b42cd4f06936bca69c219d92", "file_type": "created_file", "id": "file_146", "md5_hash": "7c7a7952a000f04ce424b1c50f2f5b8b", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-5239650a-9efdef59c32f.lukitus", "sha1_hash": "d2700f1c08658d04b42cd4f06936bca69c219d92", "sha256_hash": "608e52f6978d52406745c1258d6185eb114452c84510fded24ab15804dd400d8", "size": 34847, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9682971234bf21b61d9a2b1fd397fc6e48af213b", "file_type": "created_file", "id": "file_147", "md5_hash": "645ecf9fa7463055bc11fde9b517cef6", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-6362e4f3-eaa74f3658b8.lukitus", "sha1_hash": "9682971234bf21b61d9a2b1fd397fc6e48af213b", "sha256_hash": "118bcd0d7817703514e9db00f8e3e4f4ae71c160b3110395abe6b321046f4c1d", "size": 97880, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7d63abe1ca6d4cfad0e8c588ebdf8dae91f1b368", "file_type": "created_file", "id": "file_148", "md5_hash": "ec4f2070501910b59af19537f5be8323", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-661ee13b-fdfc54f63d1b.lukitus", "sha1_hash": "7d63abe1ca6d4cfad0e8c588ebdf8dae91f1b368", "sha256_hash": "1cd36d416e41761b8859721de85ee4a52a098379ba15fe13524d6c466184b91d", "size": 6632, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f9bd6b2e018bef5da8ff61692557e479508faabb", "file_type": "created_file", "id": "file_149", "md5_hash": "778c095dd764625ba91cb02a45d8b79b", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-bf55d3d8-fd0b023dc035.lukitus", "sha1_hash": "f9bd6b2e018bef5da8ff61692557e479508faabb", "sha256_hash": "1f8ad422fad46dd52ad19bb2d405328d2ee0dfe994553a6eddcddd7032ec9484", "size": 2966, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5d2fade9ae38856a1651e4d9adcd5e1defdf44a8", "file_type": "created_file", "id": "file_150", "md5_hash": "38bc4d603488cc1bdf138a94299c719a", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-0b96a441-a5b4a8d7b326.lukitus", "sha1_hash": "5d2fade9ae38856a1651e4d9adcd5e1defdf44a8", "sha256_hash": "700f05e8c8782542b907f30658135ca9d809de5993e4fe4f5979d75697cc1f7d", "size": 48265, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f7a56f39047837c4d9eb0c17aece9148b38a67f3", "file_type": "created_file", "id": "file_151", "md5_hash": "87422ffe4d179c759661451418dc5c0e", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-f670bb2a-dbb903142dc9.lukitus", "sha1_hash": "f7a56f39047837c4d9eb0c17aece9148b38a67f3", "sha256_hash": "e3052feddeb687b540cf36fbc2f353a77beac747ef2baf1ec2d2f668116229e4", "size": 84282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e9ebe047e60645131442e4999dbbaef4b4d72d55", "file_type": "created_file", "id": "file_152", "md5_hash": "527a009eada45914230997dbe319f744", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-69cd54eb-8041b408a46d.lukitus", "sha1_hash": "e9ebe047e60645131442e4999dbbaef4b4d72d55", "sha256_hash": "92ae45e2789eeef9af01d394c7586046d0ba7c18beed3acc081b3647cbb3d8b2", "size": 30840, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/00aaefd97a6bcce113b08407b97301dfcac679ee", "file_type": "created_file", "id": "file_153", "md5_hash": "28e0fc035da4b2cdf85f74342fcbe79d", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-25c14b11-af52ace93c08.lukitus", "sha1_hash": "00aaefd97a6bcce113b08407b97301dfcac679ee", "sha256_hash": "95109a28540b2216b4d2491da0b871bca5e9c69407cff7ed2b1ab70618e7fe6a", "size": 24282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7568bfc6ee9542d5d1888dd7b796b4a4741bcb19", "file_type": "created_file", "id": "file_154", "md5_hash": "e79ba289e2d4677465c0b352e8b31a45", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-63bebf75-6e4f6b50a466.lukitus", "sha1_hash": "7568bfc6ee9542d5d1888dd7b796b4a4741bcb19", "sha256_hash": "12f426255c244da1ef318667f562233e7d52ea34dc614f94561e478ee4346c02", "size": 102432, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ec519505672ac06ab384dac4a6fa3d955a72f91f", "file_type": "created_file", "id": "file_155", "md5_hash": "f8e8da7c94060c384549189ad7e9a85e", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-cfa9a4ca-c26c379710f3.lukitus", "sha1_hash": "ec519505672ac06ab384dac4a6fa3d955a72f91f", "sha256_hash": "978ecbea2eed5472b4a16c113db07aba71c9a29e0aa666052a421690d6dbb5cf", "size": 59337, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0fdd43461e5afdbf61284b55555a9dcb45f8346b", "file_type": "created_file", "id": "file_156", "md5_hash": "c04e000a69cf0d784dcfecd3f7572e80", "norm_filename": "c:\\users\\aetadzjz\\music\\qis5lomjg\\f56924be-9663-41bb-085a70d2-baef6bf91be0.lukitus", "sha1_hash": "0fdd43461e5afdbf61284b55555a9dcb45f8346b", "sha256_hash": "60bc2a7d92061560c6d097fe903729cb8e302c280a84c57a80629fe25b387d0b", "size": 84182, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e64d9e73f82986b365da4b34e9e020f7c55571de", "file_type": "created_file", "id": "file_157", "md5_hash": "9ca72d4068da96a387e6392bf4241fa3", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-9fe00690-5be45d83e6b9.lukitus", "sha1_hash": "e64d9e73f82986b365da4b34e9e020f7c55571de", "sha256_hash": "7cbe132bdec46a9cb394f6c6ca57a84edeaf770d385cecc23b3504fbb01205d5", "size": 29216, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0ce59d13adeda605423db1c4676a3ad9b022455e", "file_type": "created_file", "id": "file_158", "md5_hash": "9d8f05c7fa3f17c4c1cb8a150bead52b", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-dbcbc906-02de713df07b.lukitus", "sha1_hash": "0ce59d13adeda605423db1c4676a3ad9b022455e", "sha256_hash": "d4c6a8e910d320d7af494614de77895bdaf2c70deb5de28d1586f764bc72061c", "size": 35445, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e464d7ff8e610668d9e25e8f4f458a5fbcf7371a", "file_type": "created_file", "id": "file_159", "md5_hash": "6c45ed783a20717bb246b66194afdeb2", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-c35b48e2-8851b50eb3f0.lukitus", "sha1_hash": "e464d7ff8e610668d9e25e8f4f458a5fbcf7371a", "sha256_hash": "548c23541add5a2533d53033bc25656d8e8d23ddcfca75171dac5503f9057e43", "size": 77957, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/be2d5250b8280fdf5aeb7723c42295520f25ba3a", "file_type": "created_file", "id": "file_160", "md5_hash": "e134b68ea240a77b60839677c62b4e80", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-a9f24c29-70ce3c53b5ef.lukitus", "sha1_hash": "be2d5250b8280fdf5aeb7723c42295520f25ba3a", "sha256_hash": "0d157a8c158dc633e4132381d26a851dfb9db3301d63ba3a8999ffee87dceee9", "size": 80250, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d656b5eee687b4521fd37457595d7a988e9213ea", "file_type": "created_file", "id": "file_161", "md5_hash": "22b1bef97fb7c8d48bb1c1633447ea72", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-fb222ab3-c8884d7041dc.lukitus", "sha1_hash": "d656b5eee687b4521fd37457595d7a988e9213ea", "sha256_hash": "726fba39afe057b9496a033728e6347d3f0f61157cd458d181f1370280da0092", "size": 22842, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/53fb6c22d4791e153b049f5879548dee66b270ca", "file_type": "created_file", "id": "file_162", "md5_hash": "7dac62939254c5ee724eab8baa666234", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-1d408981-c958dff9603c.lukitus", "sha1_hash": "53fb6c22d4791e153b049f5879548dee66b270ca", "sha256_hash": "3aac024af5b5d6868acc10678110102c9f36bdb38cd84f363ea34d8cec9e2ee7", "size": 39994, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d0f3f58225dc39aabed48f172b0660078a81274", "file_type": "created_file", "id": "file_163", "md5_hash": "259ad629fc43052d44e053a2e4f6255e", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-d452c080-ea561ca54681.lukitus", "sha1_hash": "4d0f3f58225dc39aabed48f172b0660078a81274", "sha256_hash": "0161073e077b6e1a3650501b67100b3b56dcc0ecf28415788b51db269b1a6a01", "size": 54651, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/683da0f7d3c641dffae4099855ca00be4f031f65", "file_type": "created_file", "id": "file_164", "md5_hash": "46c91fdcad6cf3fd10fff4f24210f6be", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-24bb1763-4852852a6d22.lukitus", "sha1_hash": "683da0f7d3c641dffae4099855ca00be4f031f65", "sha256_hash": "2ead205eec2d739201e209a84c0e6ef8ea608569775cd1341ffd3627c51b98ab", "size": 15187, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3379dd7340fedc09f4c84c0d711bb6be6d97457d", "file_type": "created_file", "id": "file_165", "md5_hash": "688abd0ab7bde445363c651a8dddb420", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-db63bf46-1adcd8c466e4.lukitus", "sha1_hash": "3379dd7340fedc09f4c84c0d711bb6be6d97457d", "sha256_hash": "77747dc67090ce03d1c92174ae682dfd794f32c0bdaaf3c63146428d65dcd234", "size": 102750, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/25bd3908d4b46f172731ab4e9884fcaa8fdcf942", "file_type": "created_file", "id": "file_166", "md5_hash": "f1897eb375886c29b3bb58cdeb1e6d59", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-a2de357b-0dee598770ce.lukitus", "sha1_hash": "25bd3908d4b46f172731ab4e9884fcaa8fdcf942", "sha256_hash": "c5a30b160b8cb332a7b573504c8b11c21f305d53cd4ff816597219e342e253ea", "size": 79253, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/348dcceac3d2f6108b89d72f28538b65778566a5", "file_type": "created_file", "id": "file_167", "md5_hash": "9a231b3055fda7177f92291c49411a98", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-5252dc25-66a07229c2e2.lukitus", "sha1_hash": "348dcceac3d2f6108b89d72f28538b65778566a5", "sha256_hash": "fd019c2bad4d8fd4590e3b280677c3ffb39a437803cb306f8fb0a4db9a323b26", "size": 36671, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/67346109fc8e0d481ac5e55d0a2ab6a1bbd45e88", "file_type": "created_file", "id": "file_168", "md5_hash": "8ad153dd6bce94f8d1a84cf049f74600", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-ec268a58-9f88b8863de1.lukitus", "sha1_hash": "67346109fc8e0d481ac5e55d0a2ab6a1bbd45e88", "sha256_hash": "a418dced3cb9198b0b028347eb57a5042f11d091ae54c507489aca80fe0c286b", "size": 65782, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c8e39e8e1dfe318ef978a3a35458b0f157355fe6", "file_type": "created_file", "id": "file_169", "md5_hash": "d1be15064fde393875ec13209434815e", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-b8f49f95-f22f2a860953.lukitus", "sha1_hash": "c8e39e8e1dfe318ef978a3a35458b0f157355fe6", "sha256_hash": "a5146ba4fe73ca7a449fe450af91aea7598b9fd41f0d5a25dafb1a28066a6609", "size": 3507, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/948e66ce622efb2421c61b1c01a3bd0b8f0e7c32", "file_type": "created_file", "id": "file_170", "md5_hash": "d53b58628cfcb2f92a628f6801094ee1", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-ae89f080-8d2cf75e7b09.lukitus", "sha1_hash": "948e66ce622efb2421c61b1c01a3bd0b8f0e7c32", "sha256_hash": "d5708115123be56a4a45f9ae4ac2885abbb1dbe5f6882f992bb1e8517f1dec54", "size": 7021, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9ec4ddb5fb5bcfca0a26e6fa8ab400e255c17d94", "file_type": "created_file", "id": "file_171", "md5_hash": "408a6040b4e2fab164e1d4f4c97ad1a1", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-1ce0b2c6-914f0c6c68e9.lukitus", "sha1_hash": "9ec4ddb5fb5bcfca0a26e6fa8ab400e255c17d94", "sha256_hash": "2eea8e15ed3234a94f69110e4c946f887ae243104cdb320ee4a296eed8967d93", "size": 86957, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/372ca3f7baa13c1682308609bb577a77949aa08b", "file_type": "created_file", "id": "file_172", "md5_hash": "067252106fb22407c3a59bea275016b7", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-55b2160b-4b57c0d92397.lukitus", "sha1_hash": "372ca3f7baa13c1682308609bb577a77949aa08b", "sha256_hash": "dd0afa1260efa943debb2946d304760b340fa68304afe7f16781d9db1c3312e3", "size": 26623, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8fef3c275f4a6c95844319921adb2ee8d2216f7d", "file_type": "created_file", "id": "file_173", "md5_hash": "838bbff7d30530037e60f0db95b1f4b5", "norm_filename": "c:\\users\\aetadzjz\\desktop\\f56924be-9663-41bb-3fcf7e2a-e81a367bf706.lukitus", "sha1_hash": "8fef3c275f4a6c95844319921adb2ee8d2216f7d", "sha256_hash": "56815971ad0ebe4992e1e5660353bb18b40fc53380450f95988559b5167da304", "size": 85934, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c642ca2aea02126c6dd567f596b235dbd0b065b3", "file_type": "created_file", "id": "file_174", "md5_hash": "5740358983c3e255afe2f3a83be38f45", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-51fecb82-ffcd7a7b4612.lukitus", "sha1_hash": "c642ca2aea02126c6dd567f596b235dbd0b065b3", "sha256_hash": "2290a70fe09e2f76ef4c3494a153dc65bb39e5373880b5f2ba8a9d99a5f72843", "size": 3341, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f44f3897b9ab4fca51353df7339b0c53b4198a9b", "file_type": "created_file", "id": "file_175", "md5_hash": "120f764a0532c59275d1f3d9e1f4069e", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\alldt37so 5xcj\\f56924be-9663-41bb-b1710be7-dd08c11b7fef.lukitus", "sha1_hash": "f44f3897b9ab4fca51353df7339b0c53b4198a9b", "sha256_hash": "ae04d627ac34b01e4e482212de1b7e91248a4b3f6d2da23f3a4eecf9e83b26f1", "size": 28108, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c830e67d96a30de8190ef3f3b92d86ac8a9169e4", "file_type": "created_file", "id": "file_176", "md5_hash": "f00c99f41344338948a8770d37d059fa", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-0be52a62-0d79b43742f3.lukitus", "sha1_hash": "c830e67d96a30de8190ef3f3b92d86ac8a9169e4", "sha256_hash": "c32462e95e4fec0464d5c6f518cf42b5e69e8b8053dea4974c7adb2cb4eb8abd", "size": 68390, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6324d6e3993c14c1c0f3dbfffa4795fa0ac90355", "file_type": "created_file", "id": "file_177", "md5_hash": "8cb45793aa531604293c54708f0b3572", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-5915827a-35cc304703c8.lukitus", "sha1_hash": "6324d6e3993c14c1c0f3dbfffa4795fa0ac90355", "sha256_hash": "012aecd1a1d0b90c68671a9de62800bf93fe16fac2748b2f1aaf924f525c0e7e", "size": 24978, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6af46424a520289a176c182cdacc0a39f629c600", "file_type": "created_file", "id": "file_178", "md5_hash": "bd747e7eaf7f74d4b53075bb89f51e08", "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-165e2571-3d1f7bcd1a64.lukitus", "sha1_hash": "6af46424a520289a176c182cdacc0a39f629c600", "sha256_hash": "82c528ec5ceb79cc7d1f5faa47afe50b515ed58e10f66a54799daf6dbae9ca1e", "size": 87614, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d265ea534b0294cd17499d5bc6338ec0c23fe795", "file_type": "created_file", "id": "file_179", "md5_hash": "bf928ec856820e18f9d3e4138784ebe2", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-ad0f9d60-fc98f622fdaf.lukitus", "sha1_hash": "d265ea534b0294cd17499d5bc6338ec0c23fe795", "sha256_hash": "8bfdee965a60673890a36a1c123a5f8ddf928bffd51678cf2e31904aa854b17f", "size": 14403, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8a9d37ae3e1e9a12d95d8382f867c3cbacaf56c7", "file_type": "created_file", "id": "file_180", "md5_hash": "5603615584c0bb164ef270554131aa20", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-5221e3eb-ae9961740b1d.lukitus", "sha1_hash": "8a9d37ae3e1e9a12d95d8382f867c3cbacaf56c7", "sha256_hash": "041effeec859e2a328378b17e2519cde46952e126c65c40088a54eb10ef0c829", "size": 42351, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/56ae13bb83b07122399af1e7eed28ca10031a26d", "file_type": "created_file", "id": "file_181", "md5_hash": "56f1ae52071314f7e34aa5e9b085f64b", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-11db606c-975b3b3752b2.lukitus", "sha1_hash": "56ae13bb83b07122399af1e7eed28ca10031a26d", "sha256_hash": "34edac547b0627a18549a0eef4f8585c64ccd62861c0378c969b32e1859448e7", "size": 32386, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3bcc3c022a132c2acfd4dcccc5ef886b2d846fa0", "file_type": "created_file", "id": "file_182", "md5_hash": "61939f055f45fd1446bd80cd43c3b520", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-603c0e3a-fcb2203116a2.lukitus", "sha1_hash": "3bcc3c022a132c2acfd4dcccc5ef886b2d846fa0", "sha256_hash": "8e42952087b32c6d5f3cbe47288108c6e16fd493375c4de6b2da2c95a2dc55f6", "size": 16853, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/acfe817e31f4f0a9b404828db8adaef649ce59e6", "file_type": "created_file", "id": "file_183", "md5_hash": "d661c4e7d2f17fe51cf748c5c6106eed", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-75bcc747-2718c1ed972a.lukitus", "sha1_hash": "acfe817e31f4f0a9b404828db8adaef649ce59e6", "sha256_hash": "9049a85acf7fcf2f967094b5975344796952946f516b5af565b1bbe743529da1", "size": 92339, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bb1d78aa67aa148cda814ed8502428ce8b18146d", "file_type": "created_file", "id": "file_184", "md5_hash": "571fe4aeb25b128c01be131af5144649", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-4b0f12d1-ca564f6cf8e9.lukitus", "sha1_hash": "bb1d78aa67aa148cda814ed8502428ce8b18146d", "sha256_hash": "a27ba12304af4242a75723280f7fe0994884776a017bce38d909a2d79fac60d2", "size": 35541, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f6290016a5495b73f2255b279e7d735b57531f98", "file_type": "created_file", "id": "file_185", "md5_hash": "aa53a594fd9c19a4e7f273a52d4feb81", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-67143ce2-1f8f7e2fed94.lukitus", "sha1_hash": "f6290016a5495b73f2255b279e7d735b57531f98", "sha256_hash": "5e1dd59328eb93902adddd3cbe6a347b6ae740639b8cb22d057a6379032bbf72", "size": 92792, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/446e8f6efe27297697efaa26724404e037cd0864", "file_type": "created_file", "id": "file_186", "md5_hash": "b5ba93e7deef72cbfaae83f2bb8eee05", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-c97e94d5-143f175be5a4.lukitus", "sha1_hash": "446e8f6efe27297697efaa26724404e037cd0864", "sha256_hash": "545d7bcd71ecafa39b3f04569e2e22b978293087b176f43ad4b42e08366532d0", "size": 86743, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b943e46ddb39d57d243ba9a9459ce11c4afed928", "file_type": "created_file", "id": "file_187", "md5_hash": "54db4bafcc17d1e7225c6cb6eb859f8c", "norm_filename": "c:\\users\\aetadzjz\\videos\\4fq0\\f56924be-9663-41bb-994d93da-180f73254b26.lukitus", "sha1_hash": "b943e46ddb39d57d243ba9a9459ce11c4afed928", "sha256_hash": "93acf39189250cffdee9d779d364e4bea2bc59858457ecf0710ce11c8377d83e", "size": 60312, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5708b28b11de725c2c19c968284eca8d9d3212e1", "file_type": "created_file", "id": "file_188", "md5_hash": "f66d6520380c9349940f6709b3ddf1a1", "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-e7ce6b36-6ff2a591ca6b.lukitus", "sha1_hash": "5708b28b11de725c2c19c968284eca8d9d3212e1", "sha256_hash": "ffb5e75f62f1e012d9685cbaf5c0409cd3d4ecd5dbb29b9d4ffc194dc0031103", "size": 54972, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bfc59bba3c19965814ea6f4b91b4ab2e17bcc450", "file_type": "created_file", "id": "file_189", "md5_hash": "a8d3c25da4a9dfe1c82502e4b938822a", "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\f56924be-9663-41bb-f403e2ba-f520d5a5373d.lukitus", "sha1_hash": "bfc59bba3c19965814ea6f4b91b4ab2e17bcc450", "sha256_hash": "8bb20981da5b3d8cf08616fa0121d85f960340c162b667ff2cce872eb660d090", "size": 61356, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/600da0e928cf1abd7054c4d32356990dc8d2ecef", "file_type": "created_file", "id": "file_190", "md5_hash": "b79f218bcd01cb004ea19607b3b166db", "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\f56924be-9663-41bb-6cee6528-76d95b986ef6.lukitus", "sha1_hash": "600da0e928cf1abd7054c4d32356990dc8d2ecef", "sha256_hash": "0861d8b594d309f6173f9b6fbe0233586642808d918920bc1c50aaa58309b19f", "size": 102198, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/23c412c7b01139a182bd5e63aae60ad2caad00e3", "file_type": "created_file", "id": "file_191", "md5_hash": "c7b47747946c3556b7518f90c65c2e36", "norm_filename": "c:\\users\\aetadzjz\\videos\\7 hnkoouqhuupb4wbn\\f56924be-9663-41bb-c00efd39-06b140a3fa21.lukitus", "sha1_hash": "23c412c7b01139a182bd5e63aae60ad2caad00e3", "sha256_hash": "51710ee201327cf74c282bba2ee3f9c94cda50a742b4343d7761059d6345cb66", "size": 19215, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0c369f4de822c4b31ad5ac44ed28cd6c1af5b538", "file_type": "created_file", "id": "file_192", "md5_hash": "3c27319eb253306db714b17203eca4aa", "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-6295a539-7a67cbeddb7f.lukitus", "sha1_hash": "0c369f4de822c4b31ad5ac44ed28cd6c1af5b538", "sha256_hash": "7a408d03b467136cf757e259225c178eae9167bcf0f55c144307d09a239cdd07", "size": 63008, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/94fb16af4c4376548de5b21c0e07c85ecdcc8ff4", "file_type": "created_file", "id": "file_193", "md5_hash": "699483b18d58231bc9fb17b6a309db2d", "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\f56924be-9663-41bb-b99ef73a-c9f832abeec4.lukitus", "sha1_hash": "94fb16af4c4376548de5b21c0e07c85ecdcc8ff4", "sha256_hash": "819d40027e16332a35fcfcdc0e2dc691150b774b733d0bbe8cbf59acd5d3ba95", "size": 37184, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a837b39f6943b6ee0d3de4cae96a34d5c3388e77", "file_type": "created_file", "id": "file_194", "md5_hash": "cba2f2bf8e9063cce67c432a9bfa59ac", "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\f56924be-9663-41bb-65151815-9ca1b64a11e4.lukitus", "sha1_hash": "a837b39f6943b6ee0d3de4cae96a34d5c3388e77", "sha256_hash": "6811020799539ebeeb594ef725f6447157c1837a3e8b5f3369168ce860511062", "size": 28418, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ce35707989f8e3bbd3637f977e417dde2a5bf444", "file_type": "created_file", "id": "file_195", "md5_hash": "fc0528505b83da7f0838afe43951727d", "norm_filename": "c:\\users\\aetadzjz\\videos\\gq2odslvtx32ro7-upj\\f56924be-9663-41bb-3e6508bd-d29b57d1c2ac.lukitus", "sha1_hash": "ce35707989f8e3bbd3637f977e417dde2a5bf444", "sha256_hash": "dda28e4837bc4c79dc2e74cc808d1659b9580ed31c066bdaf4b57da6c2891eb0", "size": 32159, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/826e1b46ca1566992f40c5b2be6f89613a28fcb6", "file_type": "created_file", "id": "file_196", "md5_hash": "eb093b328d9293d50baf829d165cbe30", "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-d017408c-a1c491103b3c.lukitus", "sha1_hash": "826e1b46ca1566992f40c5b2be6f89613a28fcb6", "sha256_hash": "eef94175368709f31f5079f11a6a3450aa4f298ed1eef07f5430c52f3516e28b", "size": 57675, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/36a42aaf330ce3bad9f9613435a8750b4443fd68", "file_type": "created_file", "id": "file_197", "md5_hash": "c4625cf93087a53767363d3f02c9e530", "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-45ed5ae6-c311e03f5420.lukitus", "sha1_hash": "36a42aaf330ce3bad9f9613435a8750b4443fd68", "sha256_hash": "3c813d9ba0c018963546881c63d3dd57c92c4058adf8e9bce799cd89f180cc6d", "size": 32207, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c9e4e4e810ccedaddce1c5b7eab009c91ecd9194", "file_type": "created_file", "id": "file_198", "md5_hash": "80b1947b66ae98de244465a9f5a683a7", "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-5163fd42-2b989a19c670.lukitus", "sha1_hash": "c9e4e4e810ccedaddce1c5b7eab009c91ecd9194", "sha256_hash": "5da3dcaddc06323cd53344a3fddd697d1b9f2d678f8fec9834aeb347db922b06", "size": 82139, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3dfbc796f87d6cda13dc456ec74df3084a65d774", "file_type": "created_file", "id": "file_199", "md5_hash": "e32d72bfd844007d427df0c9132e4c22", "norm_filename": "c:\\users\\aetadzjz\\videos\\h0hlik4-okrqwtjckj\\f56924be-9663-41bb-4bd5a65f-19db8aef6518.lukitus", "sha1_hash": "3dfbc796f87d6cda13dc456ec74df3084a65d774", "sha256_hash": "dc2a464f19a3afd37924a1d51cbea7db1b5dbb4f93a45bb1d2a7681e79f80fae", "size": 36959, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e6c16361560652d8b8dcaac9ab29fb4468266b8f", "file_type": "created_file", "id": "file_200", "md5_hash": "9b6731b3f77a395388bc63e30a5911da", "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-09d24d7f-1993d32c1fbe.lukitus", "sha1_hash": "e6c16361560652d8b8dcaac9ab29fb4468266b8f", "sha256_hash": "083b26bc2e88cf153d42b6f5089d035b44f0e5a266a474b82736426858c4e08c", "size": 92713, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/304c3f70532416128806de045683184cc3f76584", "file_type": "created_file", "id": "file_201", "md5_hash": "21f3b01113a99156755c9069aaf01c07", "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-b340460a-8184fda16b6e.lukitus", "sha1_hash": "304c3f70532416128806de045683184cc3f76584", "sha256_hash": "018bf8a7fe4c8d8c54590c512b03537b9fd96b621148ef0051993b19fb856025", "size": 43063, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/771858b88759f48686c877b9a23c4cd876d018fa", "file_type": "created_file", "id": "file_202", "md5_hash": "bcbcb1cdbd40ddcae46ab36e8c8518c9", "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-693a5b37-95aafd86e03d.lukitus", "sha1_hash": "771858b88759f48686c877b9a23c4cd876d018fa", "sha256_hash": "f2fe751b43659b6210d811d0ecb15a178a3090ce3ba8df5475dbae1785324b0a", "size": 69414, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3df74e510303b8f3f7e9df74ab572e42da0b630b", "file_type": "created_file", "id": "file_203", "md5_hash": "c24eadb3953d4066b2adc5acaf6a448b", "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-03b5adaf-240c69733345.lukitus", "sha1_hash": "3df74e510303b8f3f7e9df74ab572e42da0b630b", "sha256_hash": "64afb51e3699402697d173b45bc1e58a6e49321e06aecece8c01d5c7666760df", "size": 95334, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/444ea7793a3b382e60f62b1db8c5822b8413cff9", "file_type": "created_file", "id": "file_204", "md5_hash": "56643e679f0b7a48d1d2400c481d6e67", "norm_filename": "c:\\users\\aetadzjz\\videos\\h1uvhzax1oe 6hqdg\\f56924be-9663-41bb-4a8325c8-d3dd48fe9b0e.lukitus", "sha1_hash": "444ea7793a3b382e60f62b1db8c5822b8413cff9", "sha256_hash": "51f167799570293e6986b0f4a9403ab1753e81c5ad92c246065cd9ee779001c8", "size": 56452, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5bfb09142e763f477f2b43be39d470704d8102e6", "file_type": "created_file", "id": "file_205", "md5_hash": "21f75e218d8cebb3151fed997798f097", "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-8a8002ee-8eaa9e43ea07.lukitus", "sha1_hash": "5bfb09142e763f477f2b43be39d470704d8102e6", "sha256_hash": "eb911b9f9ba7e9374dccb891aa3949a9da4b9297cbee558f1dd727e0ee8d91cb", "size": 45132, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5b17b9c8821bd43f499f91ca9e1de7b39ce82474", "file_type": "created_file", "id": "file_206", "md5_hash": "62373a720fcb4497f5f0ddadc676f2d6", "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-6dbb5e47-dbebe7a5fea3.lukitus", "sha1_hash": "5b17b9c8821bd43f499f91ca9e1de7b39ce82474", "sha256_hash": "3f30f28a1a8c1abde66e7604dc4d6650da4378af9d25a79743a3e0f9e57bbe21", "size": 62617, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6227ac7558249be71b9639fd7165f2a563e1ac98", "file_type": "created_file", "id": "file_207", "md5_hash": "6e3921cc546b4007b58cc6228285fa18", "norm_filename": "c:\\users\\aetadzjz\\videos\\f56924be-9663-41bb-113d17d0-3236fcfae43f.lukitus", "sha1_hash": "6227ac7558249be71b9639fd7165f2a563e1ac98", "sha256_hash": "fa60f1a8fcb458396b0b6d35f7f85a57c86f82e15cf74362d0523c5ce534078b", "size": 14537, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0af57082feb3df53070ed8d5209d786cebb5bb7a", "file_type": "created_file", "id": "file_208", "md5_hash": "65e85a90d35220c43e98c9e6a0d1a457", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\dmod_l2_n\\f56924be-9663-41bb-451c9042-7acdca4814ef.lukitus", "sha1_hash": "0af57082feb3df53070ed8d5209d786cebb5bb7a", "sha256_hash": "a779bacaa948aa5a52fa81cccd0ab569526f7ee26f620f3482d329d7b2b2f3c7", "size": 12110, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/16293d9d722cd6943ee639ac37908c961e10e11b", "file_type": "created_file", "id": "file_209", "md5_hash": "d9f0f7dc3adf14a1f811b408c6d47126", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-d6925dac-48972570b93f.lukitus", "sha1_hash": "16293d9d722cd6943ee639ac37908c961e10e11b", "sha256_hash": "3ee535b5e084b25c0ee1ad3d37bae7b8ddd34addb2b1fbe12899a09a73933905", "size": 15558, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/91428ffa3f3bfd1e3382acc20ac003aefec044bc", "file_type": "created_file", "id": "file_210", "md5_hash": "646e8e0e0aab24e7ecf0e33f802c943c", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\f56924be-9663-41bb-80b53f29-ccf6dcd53775.lukitus", "sha1_hash": "91428ffa3f3bfd1e3382acc20ac003aefec044bc", "sha256_hash": "87799c054f838612a6674db54a58eb518f21e48da61a5289d353c450ec4d4cec", "size": 84388, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/50bf11d477674d1cd6f4ca5297dd5d50e1a7f6f7", "file_type": "created_file", "id": "file_211", "md5_hash": "d9e667726b2b35a90411d993cc07ebd1", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f56924be-9663-41bb-9f971724-7f39278f3e87.lukitus", "sha1_hash": "50bf11d477674d1cd6f4ca5297dd5d50e1a7f6f7", "sha256_hash": "f770bb0a9edcc9d54123230bcf5bf75dafaae641f33e2b3956e97d749bb657bf", "size": 26163, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/357a466e2ef0b71f9f78bc582005ad89f92e9aa0", "file_type": "created_file", "id": "file_212", "md5_hash": "2f99738b4fc865ea65d4103f47978aab", "norm_filename": "c:\\users\\aetadzjz\\desktop\\zzg5e5yf\\hmcn--w\\f56924be-9663-41bb-5c2ab183-dbfca67372b1.lukitus", "sha1_hash": "357a466e2ef0b71f9f78bc582005ad89f92e9aa0", "sha256_hash": "7aac1bb4236eea8f1ff7cc8855584a5ee941b3260b6aef2ce1c6c9b497f6d554", "size": 6758, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/166fac48e9533bf01391c780e2de4ef2508bf79c", "file_type": "created_file", "id": "file_213", "md5_hash": "f6ae64125b4601fced0a37e4350104fc", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-370a4c85-1f80ae0d9c7a.lukitus", "sha1_hash": "166fac48e9533bf01391c780e2de4ef2508bf79c", "sha256_hash": "8c08c19d8810a389585cb5673c40b474e2f7fd74cf72767f214ce2bdcfad13d2", "size": 42234, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ec8e7e4c66b653f98ca39f5daaad1a74e4a3f602", "file_type": "created_file", "id": "file_214", "md5_hash": "21d6f837de95e3045a4f9c4ed82093d8", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-b3b4d02e-9e627b39c235.lukitus", "sha1_hash": "ec8e7e4c66b653f98ca39f5daaad1a74e4a3f602", "sha256_hash": "9a8a01a76d6bdef3777edc7996970d3532642cecb8fc0e0c700afee1f74880d4", "size": 73576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b8142e6832b8f2a5c54163a4e120d2c6b8a0885", "file_type": "created_file", "id": "file_215", "md5_hash": "07f2114b7ced323965ffa3ec2b8f0138", "norm_filename": "c:\\users\\aetadzjz\\music\\f56924be-9663-41bb-1bb670a3-7ca494bb8764.lukitus", "sha1_hash": "9b8142e6832b8f2a5c54163a4e120d2c6b8a0885", "sha256_hash": "5d6d7407daff418ee2354c24a23cda65fc5e985be5f61794d4076cafd4714c16", "size": 44073, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e89ad8af75f9ba40dd1e4c1d81b97752a4ee235e", "file_type": "created_file", "id": "file_216", "md5_hash": "709257a80b3b18541487dfa0e6c88ecd", "norm_filename": "c:\\users\\public\\music\\sample music\\f56924be-9663-41bb-e7ed6fe8-82778b4cb908.lukitus", "sha1_hash": "e89ad8af75f9ba40dd1e4c1d81b97752a4ee235e", "sha256_hash": "f1cf2919f4318e27423f9e60717b486d6a4a932bd847a2e86128303c0d1dca9e", "size": 8415285, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9d222b8020776d85bdd2a4451193ada595156d22", "file_type": "created_file", "id": "file_217", "md5_hash": "5b7b91781670dc88fcb3e6bc97d07058", "norm_filename": "c:\\users\\public\\music\\sample music\\f56924be-9663-41bb-fcd298fa-818189779de9.lukitus", "sha1_hash": "9d222b8020776d85bdd2a4451193ada595156d22", "sha256_hash": "b064f2b116e0fad51b4e71ec9dc7a44a7f0bf0ce4a6cba57d7ff6a9f6dd49096", "size": 4114710, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/41503f95d7fc58a514dc88939bd065d5623d89b2", "file_type": "created_file", "id": "file_218", "md5_hash": "b3505969d7586b2762b7efa27a13c4d4", "norm_filename": "c:\\users\\public\\music\\sample music\\f56924be-9663-41bb-adc81ce2-94215817fae5.lukitus", "sha1_hash": "41503f95d7fc58a514dc88939bd065d5623d89b2", "sha256_hash": "1500b64cf32e095d3be75da6db2a120291238ec9e61a4b0cd40acfec890140a3", "size": 4843421, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8fedf2d827c595e483d54c93f5edad64d07a81b2", "file_type": "created_file", "id": "file_219", "md5_hash": "f0aab0fac27ec5381894722b56cfcf1d", "norm_filename": "c:\\users\\public\\videos\\sample videos\\f56924be-9663-41bb-4b442157-696184c15ed5.lukitus", "sha1_hash": "8fedf2d827c595e483d54c93f5edad64d07a81b2", "sha256_hash": "d4c78548aae642cba515ef0ea0dde187e8a9ba95374a5bf1c5dd0da115f5fbd7", "size": 10485760, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/91b7ca75eeae0cb8a25c694f993346cb4a6845eb", "file_type": "created_file", "id": "file_220", "md5_hash": "b136ebbd86808f0def58ba9db07b8293", "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-9708d0b4-8ff0aa0a752d.lukitus", "sha1_hash": "91b7ca75eeae0cb8a25c694f993346cb4a6845eb", "sha256_hash": "3f35a29480968a2bff51a10c63c09aa4a37a9acef1187c4de16b012802d39716", "size": 2014, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9997c51e0da6f8877b561d18349ddd33da33572a", "file_type": "created_file", "id": "file_221", "md5_hash": "28e3f1ee8d1f89dd67c5cbeb38519b59", "norm_filename": "c:\\programdata\\mozilla\\logs\\f56924be-9663-41bb-8141530e-5b53d2beefeb.lukitus", "sha1_hash": "9997c51e0da6f8877b561d18349ddd33da33572a", "sha256_hash": "f4067ce0d6499fe8e49d157758bbc2392f0007ff2505a529622ba3d61e0a5a69", "size": 1000, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b78f6610bfee61249f4d11588c5a1fbb261d24e7", "file_type": "created_file", "id": "file_223", "md5_hash": "4fd473699b4e1a06e46ee3b3d3b49fcb", "norm_filename": "c:\\programdata\\microsoft\\rac\\publisheddata\\f56924be-9663-41bb-e502c16e-31b2bdf7f726.lukitus", "sha1_hash": "b78f6610bfee61249f4d11588c5a1fbb261d24e7", "sha256_hash": "3e65a3ccc624929cc36e5f73078af23289073b124737716b03a5675d405797a3", "size": 480068, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a32a40c1d2818937ebf40053b7ac1baea2cc9443", "file_type": "created_file", "id": "file_224", "md5_hash": "000f0ecf36a612c28663beebd117ae15", "norm_filename": "c:\\users\\aetadzjz\\documents\\f56924be-9663-41bb-3e83206b-222a0eae7c38.lukitus", "sha1_hash": "a32a40c1d2818937ebf40053b7ac1baea2cc9443", "sha256_hash": "1c7f13fbe2f8107fabc8d88cf0959fc9327bc7c3adac817203f91a630ee2883a", "size": 361284, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/533578ce5d74c6c59c63374c03571b7a577f3bf1", "file_type": "created_file", "id": "file_226", "md5_hash": "482c4a0d2f15c328cfdad3eb83ac896e", "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-75322ebb-be90a9784f44.lukitus", "sha1_hash": "533578ce5d74c6c59c63374c03571b7a577f3bf1", "sha256_hash": "5410a819c15ea7c8e7e3d2012c684cccf4cc9e15a6a16f68efe60afcfba57a8b", "size": 2008, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b2d406452e805aa230cf72cc8d1299adcf875ffd", "file_type": "created_file", "id": "file_227", "md5_hash": "562510b6f31bb8ded7335a656e4322d6", "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-7bce8b0a-b14ed50b7b3a.lukitus", "sha1_hash": "b2d406452e805aa230cf72cc8d1299adcf875ffd", "sha256_hash": "fb89ad7ea3352472d4f1e45e12049ec46907a5dadf7680684cd39022bdb9cb73", "size": 2010, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/686e61001db4019dcb1686a47b3e44f8e12ed65e", "file_type": "created_file", "id": "file_228", "md5_hash": "c86b88bbaa105cb200629e054eba49f2", "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-432d0a28-59fa3e7273df.lukitus", "sha1_hash": "686e61001db4019dcb1686a47b3e44f8e12ed65e", "sha256_hash": "f3b4c7e3ea7102f2b717ca08384b058c1eed0392592e88d53faff45c2d2cc8af", "size": 2013, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/35c1cfc74e4c3808e68a5d1beb34304438d9f5d6", "file_type": "created_file", "id": "file_229", "md5_hash": "1c91b3916354c9c534daff8d7f1158ce", "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-e1736bf8-b7b89fce74b3.lukitus", "sha1_hash": "35c1cfc74e4c3808e68a5d1beb34304438d9f5d6", "sha256_hash": "9027a85c890092741d89f8e642dd731d112816a1a53497ddb8b6c053dbb1e54d", "size": 2007, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5028d1a5874c2a8c7c5b92d2f391d7bf6779d207", "file_type": "created_file", "id": "file_230", "md5_hash": "0ec7928e304746303c71dc29961aa791", "norm_filename": "c:\\users\\aetadzjz\\contacts\\f56924be-9663-41bb-b8822c87-6d1307967b76.lukitus", "sha1_hash": "5028d1a5874c2a8c7c5b92d2f391d7bf6779d207", "sha256_hash": "8027ddac200942373f2a5b6668ed49af4ad946086e19ddc6a1323d4c8fe32410", "size": 69218, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4480cc705cd39cf26adc2f7cd58561cd92e691fd", "file_type": "modified_file", "id": "file_222", "md5_hash": "80039ca09841855c3ee8ec73cd941036", "norm_filename": "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf", "sha1_hash": "4480cc705cd39cf26adc2f7cd58561cd92e691fd", "sha256_hash": "1515834129378b5fd8759b35c1561ae7413b34d6879c5ad6f10cb9828de77201", "size": 479232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f0dbde76b2c3ca0e60ff37ae5eab2204978f420c", "file_type": "modified_file", "id": "file_225", "md5_hash": "8ded640a6e355cadf1df2b462bda48e1", "norm_filename": "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adobearm.bin", "sha1_hash": "f0dbde76b2c3ca0e60ff37ae5eab2204978f420c", "sha256_hash": "dc155298478f78533c31b2d2093dfb992ed2b2ee957d753a032ef053bcce110d", "size": 383312, "type": "extracted_file", "version": 1 } ], "process_dumps": [ { "archive_path": "process_dumps/process_00000002-region_00000629-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000002-region_00000629-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_277", "md5_hash": "801c5d0a0a0e17d9741ae7e40af44cd0", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0a6721d7a61c38ed098d353befc24c5f07692822", "sha256_hash": "4b848f9ae638ee472dcfb7ed7bf90a47eb22adf8d646f5265bb6cb79d8be4c2a", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000630-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000002-region_00000630-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_278", "md5_hash": "470895a13d37cef95026f46f93dcfd82", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e672db35b7a8959d5792ee4ae10d523b01215d5c", "sha256_hash": "c32792ca291aada7774b7b6ad5b84d66b966ba3403e337c9bdf1b670b3f449c7", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000632-addr_0x0000000000050000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000632-addr_0x0000000000050000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_279", "md5_hash": "d0b6633e5355f651768ddb04fd790fee", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bdaf1ac160b93b1040acce7400ec8314986a913b", "sha256_hash": "007a3476830452abcf6ec99df2cd8a847c7108342c3e7d1e7216ad3411cc50c6", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000633-addr_0x0000000000090000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000002-region_00000633-addr_0x0000000000090000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_280", "md5_hash": "5d23cb46264e80ebb3e4cf03f15a450c", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a52b215ad47150397eae001ae34ac1467657bbf4", "sha256_hash": "6f85d0ca65a43e2c0eceb281074cd68dc41552cd83de0ebfc3de763ecbf157de", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000634-addr_0x0000000000400000-size_0x00000000000da000-perm_rwx.bin", "filename": "process_00000002-region_00000634-addr_0x0000000000400000-size_0x00000000000da000-perm_rwx.bin", "id": "proc_dump_281", "md5_hash": "b8aafb863bbac3e0eb4a0dfd77893131", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5221d2dcf445f797f6b28478b104a3957d3a7643", "sha256_hash": "7c02767f5b80a815c384e7cd197653e5f979d0a05cdacd4f4022a013de12e3b3", "size": 529920, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000638-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000638-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_282", "md5_hash": "c7c3faf1415fe013056ddd0eec627ab2", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "aec87dfeabd197b05ae8cb3592dfd16aec521a7f", "sha256_hash": "3adf97dbdc4ec4e99e0823141636f5c39300290db991290a70679dad68ef2c76", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000639-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000002-region_00000639-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_283", "md5_hash": "39963142426a86c9078860f285363428", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "193581b9ba61810a5e76cc4a523e426adf9afa79", "sha256_hash": "9e97f412f6b77e43fc375e7f59b0a6aadccd634b341d400b509d202c725e43c8", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000640-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000002-region_00000640-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_284", "md5_hash": "0639aa67060132c913a37902afe3276d", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "df5eaa95c8f13196afa9b90267ced7879b50f722", "sha256_hash": "934e167658ce1268142b7ca45f206a5ff36eba36d83d2df1728ea594531727b8", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000642-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000002-region_00000642-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_285", "md5_hash": "4518e3206191edd9b3fb7e646aef5d47", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b546b0a9731ee2276a01c9a7a95bc5f7dfc98975", "sha256_hash": "0ffe607af6439234c2ccbdc5bdc6ec54436a594f95aa4bec4d91230bc5925b9a", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000645-addr_0x0000000000290000-size_0x0000000000080000-perm_rw.bin", "filename": "process_00000002-region_00000645-addr_0x0000000000290000-size_0x0000000000080000-perm_rw.bin", "id": "proc_dump_286", "md5_hash": "aee215f7d94095629491b4c0c21893e4", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bce27d61c18ddbd3a0710ef4abf5f175c650c10e", "sha256_hash": "5696fa335b9002f30ddc9a63d348117610e5c48070e22c1eb27694b1389197b9", "size": 524288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000649-addr_0x00000000005d0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000002-region_00000649-addr_0x00000000005d0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_287", "md5_hash": "c2b8c8f37c9d4ca10c3ccc9f8e09ac5a", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "44ed27460a6c657bf18315ba88c7a3fa649aa390", "sha256_hash": "a3a7d85de352e36b749ab64ed7b01b28d4d335e0cd79ec43ec369a81a85382f7", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000652-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "filename": "process_00000002-region_00000652-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "id": "proc_dump_288", "md5_hash": "6eeea0bcbc21bd1c0d7f0d6ae3488f7b", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fad191d56abe255a03a7b4b3b641fcfa8a4f81fe", "sha256_hash": "938a68694e4495227ebc925be61a20adb5c6c82d7dd57cc67a2717e2f9f2bf70", "size": 1024000, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000653-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "filename": "process_00000002-region_00000653-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "id": "proc_dump_289", "md5_hash": "caf76e9dd8864dfb7d729847f3595e80", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "71745f0f20bf18b3813fbb1a30eed8d41dc1d51d", "sha256_hash": "f113bc4b90aa0447b7992c2783d7c3b16d63f0e65e2c54c6e93ba833e8e0c667", "size": 1175552, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000682-addr_0x0000000000810000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000002-region_00000682-addr_0x0000000000810000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_290", "md5_hash": "59e7ef810f634caa32b3c0d31ea35b47", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "27fcf23ce0ba65ed0fe048935e657eb083d89f3b", "sha256_hash": "9211ae008a8db5ac2c383736c07ec49bb987c083d12c2ebbaebdb8119ec973e9", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000686-addr_0x0000000000020000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000002-region_00000686-addr_0x0000000000020000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_291", "md5_hash": "6194ad8af0620c270fb10c9b7e7ad420", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "04b11b782108d4ab87a9a92c6b7fabf68d73fefd", "sha256_hash": "f0ff5c494542c0cb191a43a1ccfc754774afd7a11f5df44b923d1abd12ed8e0b", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000687-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000002-region_00000687-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_292", "md5_hash": "7e316bade79a8f5aad61c3f1ff43dcad", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7452dc317bd8313f41e68d13b9cd96a910079e5d", "sha256_hash": "a7aee037ff0ea210c9148f107c29c3b55360efacd20f7deab290188d7e7fd042", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000692-addr_0x0000000002210000-size_0x0000000000200000-perm_rw.bin", "filename": "process_00000002-region_00000692-addr_0x0000000002210000-size_0x0000000000200000-perm_rw.bin", "id": "proc_dump_293", "md5_hash": "b47240228bfa0c3d22eedbbc02cf1845", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4fa2483f01105934a9a8f1d12fbf4a48bafb81ae", "sha256_hash": "4236ce1b958987dfda060d3d48517fc7616b883a40c09422b2ec7a75d2c32173", "size": 2097152, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000725-addr_0x0000000000210000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000725-addr_0x0000000000210000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_318", "md5_hash": "2f18fd879dc0a3ced12c747e7dee475b", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "52ea901d5f361ea423640ad7b5c17cd61204c5f3", "sha256_hash": "f4097745281020c67ff8984e39a35a64b9506e7a740e535ad64f8a3f06ce65a2", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000726-addr_0x00000000006d0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000002-region_00000726-addr_0x00000000006d0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_319", "md5_hash": "3ee0ea959ddc4f8b11a2016e8b730c49", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7a2b3c6db79c49794f8329ce072135c89d65500b", "sha256_hash": "03d9e7efbaf36b745c6f95ded3b374cc19c66fce36f0c0c24512f190b1a98698", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000727-addr_0x000000007efd8000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000727-addr_0x000000007efd8000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_320", "md5_hash": "2c67b19feb0ee0decfd8dba2e039f451", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d846db69301acee48c84a2b803f6d66bfeeef4db", "sha256_hash": "6374763ad10a2f54d763ee325156c77c77d165bc3c29632d1df2de36f812859c", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000728-addr_0x0000000002330000-size_0x0000000000001000-perm_rwx.bin", "filename": "process_00000002-region_00000728-addr_0x0000000002330000-size_0x0000000000001000-perm_rwx.bin", "id": "proc_dump_321", "md5_hash": "bfd7aab47664062995ea50bd4813161a", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e8c211813b745422fef938fa1318512105d4beef", "sha256_hash": "6bfbb98836d9f0c9b3885f260e754ea0b58de3752f2c6cba03c4fd603ce81212", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000729-addr_0x00000000023d0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000729-addr_0x00000000023d0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_322", "md5_hash": "55422a164407f5a6c4387a74248e727d", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "92018dd60c7ab212c3354d6046140e6824e8078a", "sha256_hash": "10790a2a76b46f5a23143d219fd5c5c3ed72525379df0306a9918b21480956e4", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000730-addr_0x0000000000250000-size_0x0000000000001000-perm_rwx.bin", "filename": "process_00000002-region_00000730-addr_0x0000000000250000-size_0x0000000000001000-perm_rwx.bin", "id": "proc_dump_323", "md5_hash": "e6d31cc3d7df1c119089b654a24e0dcb", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8d19146082182030e012d7694006cb6a2603947a", "sha256_hash": "e247f00e8076f0ace4e76f35e223f3836945db6a590c723907d68893b2024af7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000731-addr_0x0000000000310000-size_0x0000000000082000-perm_rw.bin", "filename": "process_00000002-region_00000731-addr_0x0000000000310000-size_0x0000000000082000-perm_rw.bin", "id": "proc_dump_324", "md5_hash": "26130b7a8d93cbe95366eda74641a381", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6e99636e5a03a64d84dd084d6a09fe0339edf72e", "sha256_hash": "1a59d82f778b21f557e1a36245938b9c1579c4a783796a17ed3b55de924163e5", "size": 532480, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000741-addr_0x0000000000570000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000002-region_00000741-addr_0x0000000000570000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_325", "md5_hash": "cec7222e3b5b10ff13cd349a98ecf794", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b179eacb6b4dbb969c0cce250ed1e32aac5bba6c", "sha256_hash": "c643a5d8a2913b35e9b4e211fb528b48f7da4e6d279e98fc33c71d93f14d9ec7", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000742-addr_0x0000000000260000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000002-region_00000742-addr_0x0000000000260000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_326", "md5_hash": "ff98ce1914990e8c62c41446a5d92ab2", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "15b43d80a30213119dc98581775eaa906413aa64", "sha256_hash": "526dc664c409df6edc1b8b9ec3eae5ac2675752be39c6ad6a6e52606d9b152fb", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000743-addr_0x0000000000270000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000002-region_00000743-addr_0x0000000000270000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_327", "md5_hash": "5a0e7c649fb458354e33bfc2052f0aee", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fa02cc921982965b1e27ab7960de9858d6b2d67e", "sha256_hash": "fc3273b2be05f9821804bf2b3a2b596abba7f39992122cb02c4d17fcaa7d129d", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000775-addr_0x00000000003a0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000775-addr_0x00000000003a0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_328", "md5_hash": "4c6f13e3c9d6abfbd807e9bd44c6ae8c", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "61618932a3e61dbb13a2e2f93a5b0aef90000156", "sha256_hash": "436cfeb6b537b5308fa2e96be2b35dc201179150edfc4411df013976a1265123", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000776-addr_0x00000000004e0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000776-addr_0x00000000004e0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_329", "md5_hash": "f61ae6e2f52dbb871d76c1b8eb05ded1", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "48225b377bf2f4d0af868131a2ccfffc041de8f2", "sha256_hash": "9f41e06eb1570cbb7626410561ef54713cb6b6dffdb008a89b0ab194ae6b8428", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000777-addr_0x0000000000520000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000777-addr_0x0000000000520000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_330", "md5_hash": "baeccc306c9aa2b67ba2998e568eabe4", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4b26edbe5715583090b4002f9f9fe015e379f251", "sha256_hash": "0d8bbcd72e54476a537eb385fcbb0c504275873e4061443c1986011ae47f5991", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000778-addr_0x0000000000580000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000778-addr_0x0000000000580000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_331", "md5_hash": "f79b1811fc52400f8380874078a8aceb", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "044d05bc37e4db78c7d1a147149e73a06245996b", "sha256_hash": "765963e5f974fd0706170df08026b970383d319dcad44dd1e9b9dea61d371f45", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000780-addr_0x000000007efad000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000780-addr_0x000000007efad000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_332", "md5_hash": "0656aaf1cb2bba8818c8f912167728f1", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6673c5cb049a61c1531f68e8c9cda57327e67f52", "sha256_hash": "996cb29d860b6155ad6860f8250b9387d638644f3a4b407e8fca91d861c564d9", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000781-addr_0x000000007efd5000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000781-addr_0x000000007efd5000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_333", "md5_hash": "659ae5c2e6e62d2fb67cd1714a7becc0", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8b719cb51fdd990a73daddce81eb4ada810af793", "sha256_hash": "6ad92144f09f7507631189f5fa9859029742318a78e8f0bc7774813c38d70207", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000782-addr_0x0000000002410000-size_0x0000000000170000-perm_rw.bin", "filename": "process_00000002-region_00000782-addr_0x0000000002410000-size_0x0000000000170000-perm_rw.bin", "id": "proc_dump_334", "md5_hash": "34b82f10a373e7e20e5b78e91781f902", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6753cad0918823da14329a71da524c2acd7f0f7d", "sha256_hash": "135481b131a8f8a99f33935b004f44e9266c531869c9ff0b6cac29c440aef60c", "size": 1507328, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000795-addr_0x0000000002580000-size_0x0000000000220000-perm_rw.bin", "filename": "process_00000002-region_00000795-addr_0x0000000002580000-size_0x0000000000220000-perm_rw.bin", "id": "proc_dump_335", "md5_hash": "a266da0f276743ff6c1ca64c6ca8601e", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0e2e41316ce444a773d1f8d7040e5c28afa26678", "sha256_hash": "51406ebb3364f8111394d4dc33770db0bf19de30a4cfe4d9344ee533f67056b2", "size": 2228224, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000797-addr_0x0000000002340000-size_0x0000000000060000-perm_rw.bin", "filename": "process_00000002-region_00000797-addr_0x0000000002340000-size_0x0000000000060000-perm_rw.bin", "id": "proc_dump_336", "md5_hash": "3e28833516188d0f0fba88b51c9f5772", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7b788138dc718012ddde392d647d9fd3308b8732", "sha256_hash": "bdf95e1c9e701165cb2c6abe8359df1bc413a7eb9387f4a33df363e681962763", "size": 393216, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000800-addr_0x00000000007d0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000800-addr_0x00000000007d0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_337", "md5_hash": "24ecf0a480878bdebd6d61761de0331a", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a72055b356ea1f90d71bf713a36a454b8ae7bbe2", "sha256_hash": "bfda1433e25b9d00ecb82bbf2c14434d9b0f054d81b9bff29aed9ad987760a64", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000801-addr_0x00000000022f0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000801-addr_0x00000000022f0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_338", "md5_hash": "b9f34b4f5116217b9315e9bf3a6de3c0", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dc8dcc26a0b348e41b26c5489972b5db796a331c", "sha256_hash": "638d7326415d9a03a19a1b8c9362846667e77818ea74a612a13a4a39e086f9e4", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000803-addr_0x000000007efaa000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000803-addr_0x000000007efaa000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_339", "md5_hash": "5dfc4f1dd24b1a7794c90eb1604badac", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cab8da9f3632706b573eaf29d4453490cbd7d4b4", "sha256_hash": "d28fb4a9b0788a09aade8afa6433575e7e41a96210db7d5269d1a70fe87846bf", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000806-addr_0x0000000002410000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000806-addr_0x0000000002410000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_340", "md5_hash": "a7c46bd00db03a1882012ae99968a085", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "702ffb25ac0c89239480b04316c7c0df1396e6ed", "sha256_hash": "7b0e8e98fc83fc464dec32e4c2eee0bfa8bf2f8d401e313119c7080805853594", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000807-addr_0x0000000002450000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000807-addr_0x0000000002450000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_341", "md5_hash": "4505da1024ef1f1d576d69b999fe041d", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "747123816e53800a55d0799e0c60de41cceb5976", "sha256_hash": "6bfc1546f2e0ffb32026f8c92071cd67a10594daf8c0c95a06f7aa21f65d6563", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000808-addr_0x0000000002540000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000808-addr_0x0000000002540000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_342", "md5_hash": "92f90f68cab58e8800277720facb777d", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "86ed00b52b16f5a822180fcc8632aaf1d4154cd4", "sha256_hash": "10e131196eee3aed3c1ad18686ab9636e6ab5c49f1ce69c2e0c43bdb404e7d4a", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000809-addr_0x0000000002580000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000002-region_00000809-addr_0x0000000002580000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_343", "md5_hash": "bd106cd02ba51cdeaafa39372d2e0814", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2387209f649171188f6f142f9a24b837d8d81d5d", "sha256_hash": "dc4a03b773497d2c6ccc106e4de9e18f6488882041786a6fdb9817404a62c601", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000810-addr_0x0000000002760000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000810-addr_0x0000000002760000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_344", "md5_hash": "a931fece21a6e74cdde317eed154a287", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f4dddd214a02dfb4de97f70b9c619292218e00a1", "sha256_hash": "bb53caeefe66b9b3c469df395ea79d5fb294ce97f5fe62e5c46eae6425b32202", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000811-addr_0x000000007efa7000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000811-addr_0x000000007efa7000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_345", "md5_hash": "fbfa06def331f433b31e125cf6a1ed44", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1a4cccc4d987b423b1ab697b9e9cbc09ae5b0eec", "sha256_hash": "68d586e5141e09d9b55f421fe69b81d43e0b9d7453304d3a5c159e6a45319d5a", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000812-addr_0x0000000002340000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000002-region_00000812-addr_0x0000000002340000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_346", "md5_hash": "6f4133579d081ffe260081e35f703dea", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1b969baef0fb313b79b1904ecc5f6512a5abfce9", "sha256_hash": "7bd973e7a614c7a3015e9596f8de2f8949f02d27165c40688d0096b74607b007", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000813-addr_0x0000000002360000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000813-addr_0x0000000002360000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_347", "md5_hash": "a09ba9b4b5f039a3aa9cc96300c353c6", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e7339abd55d63c035e6494ffe33dc02d3ce613b3", "sha256_hash": "8330f674c2c32db16b6a8bac16240ab2921fe144ac40bae8cc7930549703fa4a", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000817-addr_0x0000000002490000-size_0x0000000000050000-perm_rw.bin", "filename": "process_00000002-region_00000817-addr_0x0000000002490000-size_0x0000000000050000-perm_rw.bin", "id": "proc_dump_348", "md5_hash": "f9a70fbb470e8ee722a6a861f92e77fd", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1fe9b15888b611ac2daf72ed05d3eb9596355d21", "sha256_hash": "94a8ae99fbdd545a4574c96197929edb8913a9f5921e90cb543ca9e13ee5e22a", "size": 327680, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000818-addr_0x00000000023a0000-size_0x0000000000030000-perm_rw.bin", "filename": "process_00000002-region_00000818-addr_0x00000000023a0000-size_0x0000000000030000-perm_rw.bin", "id": "proc_dump_349", "md5_hash": "82c11efa69fb7481675f14e7dd91774e", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "faa50cf89773afccb56265c8b7f531a8a6fbbac6", "sha256_hash": "b6eb834188d31740d44f40ba9e4e813cde95a74672b337aafe29ce85fd486a82", "size": 196608, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000819-addr_0x00000000027a0000-size_0x00000000001e0000-perm_rw.bin", "filename": "process_00000002-region_00000819-addr_0x00000000027a0000-size_0x00000000001e0000-perm_rw.bin", "id": "proc_dump_350", "md5_hash": "a5d3159a1fae7ca34bbd1c28abc2948e", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cb8e41edb5d4a8ffb61bca15dec603e1e8d94447", "sha256_hash": "55ecc771f95e61222774eff33b1a25556ce8dbb8eb9fcbf9f32bd7827c0c8ea4", "size": 1966080, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000822-addr_0x00000000027a0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000002-region_00000822-addr_0x00000000027a0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_351", "md5_hash": "135f7f7045df4d74fabd26d021f70f8c", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "030c66cd89f1e3ffdcd7e12e2736a66da1fc603c", "sha256_hash": "c82dafe4f5fe2e40007d684f5732e816cfc5c7ae163961123df2894814821a53", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000826-addr_0x00000000023c0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000002-region_00000826-addr_0x00000000023c0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_352", "md5_hash": "c97f8ea4f79030771e4bf8a5583de28d", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "95c399cd767525f98116cddc6bbea907246e2599", "sha256_hash": "f8916e28c6921c9c924c0fdf837fa2078cf499d305f2908cc8d513e9edb6103d", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000827-addr_0x0000000002490000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000827-addr_0x0000000002490000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_353", "md5_hash": "e82d0ec49f40b20c4539411450bcc6f3", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1419a8b27d56481be9ee60d073aacbae8feb9311", "sha256_hash": "382875db7211f4c00c44ced34dbddee919f75317040550c32caa8e84347d27da", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000828-addr_0x00000000024d0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000002-region_00000828-addr_0x00000000024d0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_354", "md5_hash": "373c042f9bef585610c3f5f471e0f024", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "36bacb5f7ca4541165a9b76aa85485bbb3b62142", "sha256_hash": "b24120a7d139181345187e8e2b5593354efadddb63efa852df3936e5ffac96ab", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000829-addr_0x00000000024e0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000002-region_00000829-addr_0x00000000024e0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_355", "md5_hash": "40f46bfaf2cd28cf15ad870bc218ebde", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a0cfd1b07ce1e2d37ac738f84213efade2f1a7c7", "sha256_hash": "5f99b469c49c45d165bfa4842ad820de3f1b9f45a1c7dbdd7a436657d2b309f3", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000830-addr_0x00000000028a0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000002-region_00000830-addr_0x00000000028a0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_356", "md5_hash": "d81df28376312133add1e867fb49e008", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6dce1a9ae30e6154da2bbc70e9ab9471ecee06ea", "sha256_hash": "9ef24a480d5a8b1b60d0ecc113a1242022830732d0be37f502468471f9c4d853", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000002-region_00000833-addr_0x000000007efa4000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000002-region_00000833-addr_0x000000007efa4000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_357", "md5_hash": "5cc354d0af929ec8d85279ea75ea532f", "ref_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6b71977f8c949a075fc592c7896cc27937a2d494", "sha256_hash": "b1d505368bb6a62ee088d7e6db8b5db66b9b4eba8ecce4fd15439c953ccb3972", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000948-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000005-region_00000948-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_374", "md5_hash": "d3f9e26c4c6662deae7e1623ed313f14", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dc06c8668050bea78bb495af052fff0fb1af160d", "sha256_hash": "8f7474360291425d3b4fb5ca8d815fa689529bfabf65cd804ee6717951205446", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000949-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000005-region_00000949-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_375", "md5_hash": "7e063911456da24f98ed0df71ea30e5e", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "692e0c7de9d1027d0395c6ee28546cf311fd40b0", "sha256_hash": "c91a97a0aa897b6e6180c90d23392a9d69c51dcd8a3f0bc399dfc641add656a7", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000952-addr_0x0000000000190000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00000952-addr_0x0000000000190000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_376", "md5_hash": "4d0e69ef4eaf27373e1287bee03f24bf", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9229b50d770729a6536ae8fd5bb2b593e04aec58", "sha256_hash": "2c9fd99c4db7463451228af8668ba66369ead5fa7d6b7444d82cffcff04d1b46", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000953-addr_0x0000000000240000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000953-addr_0x0000000000240000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_377", "md5_hash": "f831d4eab56aa2944278e8fe46ad4abd", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "402fbb55649eb16e8706e2137fb3c2e4ce42be04", "sha256_hash": "cfb6444b6a6747216c38be24a829c7d5ef64d6a25c0becdb8ccd816ddc5a526c", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000958-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00000958-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_378", "md5_hash": "2dacfbbae1d41d07b8f3fcc35c1824e2", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "129997ccd881e64bfbecffb52fe761d2bd7c2365", "sha256_hash": "fde1cfd4fb6cf9a8c818bfd3d5d5efd9b8d6a786d12b2daf9c109591c7908b5a", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000959-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00000959-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_379", "md5_hash": "82eafce1ff59fca58887ff7e3baa4404", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a5ad138acaa015c3e82121c0dadfe69b734ced4d", "sha256_hash": "f11cf864f822363f9a8f229e30813303af47b55f3177350fa2aa7465ddd12815", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000960-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00000960-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_380", "md5_hash": "a67ddd176af4d389900ae10de85a8642", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2e0192f570fcda04e7549bffabcffeba723d6119", "sha256_hash": "ced9fc3291ae7dc0d37f20acf97d3696cefe6eccb2e037402e6a57c2aea999d4", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000962-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000005-region_00000962-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_381", "md5_hash": "1ccb2610a5a9adc0e94434ad2ecc66c3", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1a7c9737cf6f401bb78cb1adc28542b1614b2007", "sha256_hash": "6951e76cb2dd9531e981dac30afd5be43cb8a795358a1c1a73c6ad0b2d759881", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000964-addr_0x00000000004a0000-size_0x0000000000080000-perm_rw.bin", "filename": "process_00000005-region_00000964-addr_0x00000000004a0000-size_0x0000000000080000-perm_rw.bin", "id": "proc_dump_382", "md5_hash": "64cef1b3b0ec04a74194c6443c57daa7", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "07d90a44ebb3d4aef3ad06dec1817a6bd5aa63e2", "sha256_hash": "ec63e9190f65d1280f15c5c7af602a07695ed320db6aeb98755072364bc4452a", "size": 524288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000968-addr_0x0000000000680000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000968-addr_0x0000000000680000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_383", "md5_hash": "a30a34e97be9ba0c6857c155bccd127e", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dfaaf6a2b751eb3d202c2818d5e277d7c4e32187", "sha256_hash": "78852146ef407aea90a2bc49c0a8c0b8162beb60ceb117856b0fe4da5cfa2181", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000971-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "filename": "process_00000005-region_00000971-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "id": "proc_dump_384", "md5_hash": "6eeea0bcbc21bd1c0d7f0d6ae3488f7b", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fad191d56abe255a03a7b4b3b641fcfa8a4f81fe", "sha256_hash": "938a68694e4495227ebc925be61a20adb5c6c82d7dd57cc67a2717e2f9f2bf70", "size": 1024000, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000972-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "filename": "process_00000005-region_00000972-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "id": "proc_dump_385", "md5_hash": "caf76e9dd8864dfb7d729847f3595e80", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "71745f0f20bf18b3813fbb1a30eed8d41dc1d51d", "sha256_hash": "f113bc4b90aa0447b7992c2783d7c3b16d63f0e65e2c54c6e93ba833e8e0c667", "size": 1175552, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000997-addr_0x0000000000920000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000005-region_00000997-addr_0x0000000000920000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_386", "md5_hash": "98afe699b7bd81a7fa09dfb3471e9317", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "656fb539d309caef44a1f6331a28f810dea972b8", "sha256_hash": "ea929aaf8c3a7a92661cccfe693b37b2fd5c674a6e0ef913c58c4293c9002933", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001003-addr_0x00000000000e0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00001003-addr_0x00000000000e0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_387", "md5_hash": "71bc630ffa5792a966e292c7354f2c39", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "028bf3f438913171e11a3fec9b7a89320b6be1fe", "sha256_hash": "6ddf41a571cae5f80e96f7d85f9dc92d5232f0a4589c4c50860ca9336a04ed5c", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001004-addr_0x00000000000f0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00001004-addr_0x00000000000f0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_388", "md5_hash": "38a14a4616175a48d9adc81671957f97", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "62505f30088a82c7c98896facaeac4ae530ef2a8", "sha256_hash": "a5dbc9df036ce53c374182bb345fe73b0d0e28fe329fdd99f1fd7b5fe16dc7d1", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001024-addr_0x0000000000f20000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001024-addr_0x0000000000f20000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_389", "md5_hash": "e29e1ca8b2a7f29d93b5d2fd7f6a8f13", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1d87ca8296c70ac069017725dc79ec5533cd92bb", "sha256_hash": "a8f82d7f763dde7e69853ca44263a9f68b59649d6b31dbc24dcc30a7a2079a60", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001028-addr_0x0000000000340000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001028-addr_0x0000000000340000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_390", "md5_hash": "3799735a1d03e06b43355445857a5bbb", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "047183ccf8e1b7c72cef742d3fba4d0607f07339", "sha256_hash": "765d4c351313e13bdfdd575e7e331a892c719a5be2d9afe9cc222a4b5fd2df27", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001029-addr_0x00000000005f0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001029-addr_0x00000000005f0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_391", "md5_hash": "62e10470dbf1cef5e172ec497d15399b", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e8824e0a24b5bf29ee369505dbd39dec49297cd1", "sha256_hash": "c22f7ff72b0346f405843ffd4fa6c89d3563587f1cb3e021542477ae22247d05", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001030-addr_0x0000000000fc0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001030-addr_0x0000000000fc0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_392", "md5_hash": "e0f27179dc328748740bb8e28a0a27a9", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cea7d62278b95ac59ad58bbddc7b7d21aef48202", "sha256_hash": "323614d63b46794396a0fe4460f2d2e5281d30bcb86cc2ad1298126a0336375f", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001032-addr_0x000000007efd8000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001032-addr_0x000000007efd8000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_393", "md5_hash": "39d0eaf7701a45bb94153ede63b1fa3d", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "312bae0cd637e1ece8993844253b6bb0a80fef5c", "sha256_hash": "cb44874678ad7f5736b0827c425bcdb7b87bdb249911752f709a9bd198048b47", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001036-addr_0x0000000000210000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000005-region_00001036-addr_0x0000000000210000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_394", "md5_hash": "989bd54e98cbc14b97689da774fd5c65", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3220a05bbf6fbe00f4814ffdac234488d23178a0", "sha256_hash": "71a2676c31f410a5e509b73e54ef4985389a0b34649240cd4882086a8ba26b34", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001037-addr_0x0000000000460000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001037-addr_0x0000000000460000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_395", "md5_hash": "c2edc870b519add80e371ada0549fc71", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d7100bc43e32fa8712c36357f7c23bb47856578b", "sha256_hash": "02493220a59eb50cf4f151dace7805f901f4d41b24125a683c4b7cf7e2f865b2", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001038-addr_0x0000000000eb0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001038-addr_0x0000000000eb0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_396", "md5_hash": "fa5a35be1639ed031f32ebb2c72c7ee1", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eb337e48201d0047df5421fa4f93a8bbb3581e02", "sha256_hash": "505386a331128d17a7af8cb41b312627083d868ab57da73b8d74d1a2b9098ad2", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001039-addr_0x00000000010e0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001039-addr_0x00000000010e0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_397", "md5_hash": "f930a51ae165d74360bc57be6bb9a32e", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6f9fb13e941e172ef818b7fcb33cb789cdf05b1c", "sha256_hash": "e9db488cdbcff187fcce8f78d5c09c790381489649df7fc2b0a7040eec341404", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001040-addr_0x0000000002850000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001040-addr_0x0000000002850000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_398", "md5_hash": "61619e522912c4aa5a141e664e49f99a", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "acbc39fcb18c55306e1f9962d259a05ae92cbd20", "sha256_hash": "cbf88acae4eef9cda7f3ea7b4e6d81089088b0f03ad84b83030da2f58e193776", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001042-addr_0x000000007efad000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001042-addr_0x000000007efad000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_399", "md5_hash": "b24b53a20baff840ba644422bd849808", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "569ac92201b61d45c5197048358f1a24206be0f0", "sha256_hash": "e06ca06df609bb1794ffbf2353a28928fd9e7d50b719adea27d4f35f96683a01", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001043-addr_0x000000007efd5000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001043-addr_0x000000007efd5000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_400", "md5_hash": "a931e20c2454a475a7b03ed5f2e7b4c8", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3c0d2333eb2a9f7b312a69bbed91e8d1db6f9d3d", "sha256_hash": "6ea31aa6d385ed70b6c9d7379ea3c9c65ae335b13d69cc0175c3184bba8fb90a", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001046-addr_0x0000000000630000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001046-addr_0x0000000000630000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_401", "md5_hash": "02e38506fbaecc050707c3a9291286ce", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c6ece660dff9e911a901f21f621206fc88919e8e", "sha256_hash": "f69cea078671ae42221a0ffbf59372b609e1f8fa445f1ee732da9278379a3a22", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001047-addr_0x0000000000e30000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001047-addr_0x0000000000e30000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_402", "md5_hash": "0ac38b0ed019ab1a03b93e6e8898e63f", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "193ffa049f6b28bf7cdb37ed4efed4950fd5d09d", "sha256_hash": "85b9747fbc41e26bf7fb4f0a011482bf0c36434bbba36877b6ba2f2ca25eda4d", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001048-addr_0x0000000002a50000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001048-addr_0x0000000002a50000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_403", "md5_hash": "bd5c787d510c9d7496bc31dda0d16a88", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a9e7b8f0b8e5b16651ebf04d499aa9e5a6d42a05", "sha256_hash": "f4787e9cc1ea48184b4ac5512a5257b681f33eb005a72f019f2f1d3ef5916fc7", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001049-addr_0x0000000002c50000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001049-addr_0x0000000002c50000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_404", "md5_hash": "2b4a195c6d465a4801d8f6c6a7302242", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "65d94c43935b5b319c6334c22a2c776b7b445753", "sha256_hash": "8a8445c73ce8407303b350477db97e8051e9a9268f761c36647dbf8c728549f6", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001051-addr_0x000000007efa7000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001051-addr_0x000000007efa7000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_405", "md5_hash": "2837b58d6b0eeb3f5a6ad9f641f1068b", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3d92d933d322970a8a35a4e28c0c3fbc9d3357dc", "sha256_hash": "e0872cd47eaa8fb60f3dfd2a5b633b69cb0bc9f1c6a1482726effea71b7529f0", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001052-addr_0x000000007efaa000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001052-addr_0x000000007efaa000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_406", "md5_hash": "fd86679dc5b59e67a1ea63b2a62669f3", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "74da709879fa1aca5971c81e74081efaf7784d3d", "sha256_hash": "9c9f51f20ec521b28d6db31f7a5fb62ae25fccf7a1d5335019ecec5e98fdee1b", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001193-addr_0x000000005fff0000-size_0x0000000000010000-perm_rwx.bin", "filename": "process_00000005-region_00001193-addr_0x000000005fff0000-size_0x0000000000010000-perm_rwx.bin", "id": "proc_dump_407", "md5_hash": "5cf597ba166d405f7079d5657746e21a", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "97b7f5abbe44be2c807132d974a25e5cdeb8ed31", "sha256_hash": "e416076b415ec3570c9f0a576a2aa1191155fa8ab3dcf0eb67292aefe8033655", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001198-addr_0x0000000003280000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001198-addr_0x0000000003280000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_408", "md5_hash": "dd0d2ecce7c2a594860dfc31f4b20ea5", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4108eed8b1b869631c782aeb571192fef77a242b", "sha256_hash": "e572196f65c6872ad1365b22c9a181f529e57009d4658af6ea52d7780f9ccc46", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001203-addr_0x00000000001f0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00001203-addr_0x00000000001f0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_409", "md5_hash": "664fe1f711c118870f5495f24aab794c", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7d698a671e50d01803fc12a81416d2cb2dff2bc5", "sha256_hash": "b2d35294eb68bf6febcf9e8bd73f020c84d54fe582833ae52bea15b5cdeb7ad5", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001204-addr_0x0000000000200000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00001204-addr_0x0000000000200000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_410", "md5_hash": "2c5393d8947059deef3137d86c05a709", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "01a2011798984e058d92f5d0dcc5b4fd774b655a", "sha256_hash": "f192fbe7dfd3e34b08e5fd96f6d25a635cfa8e135424b5e704a8bf5717389a73", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001211-addr_0x0000000000f60000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001211-addr_0x0000000000f60000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_411", "md5_hash": "a39ccf812c0fc4a58d65a1d1d9039e30", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4e8e55e9d10bd23e829c7984a250041ab70a1bc4", "sha256_hash": "ee013dc7a7fd67ec10afdb32a0760df313644606ce835faffa4ce714999cedc0", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001212-addr_0x0000000002b70000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001212-addr_0x0000000002b70000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_412", "md5_hash": "72d171ef62443ed271f5f7175f0be973", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f0d9f9f3154c58d927c226a0b3a802715d66da0d", "sha256_hash": "b513a62138ba857794bc3bb47ccbc6136f42a0e544a88a922aa8b81dcc0a45b6", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001213-addr_0x00000000030d0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001213-addr_0x00000000030d0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_413", "md5_hash": "043588cb6b895ab9bfa3866e84102bc7", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bcf23cf5cc9ad2729b5da74972125b924ba3d4f5", "sha256_hash": "f2672f250d42d1c29dabeadc20eed8a3453ba7735ac642aaacafb621ffe80132", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001214-addr_0x0000000003470000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001214-addr_0x0000000003470000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_414", "md5_hash": "310529fe0fa191d4e024a7a40360bf62", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "85abb90517f4c15cfccdf9533c1b1f51c31da990", "sha256_hash": "f6ad6073c966205522918eb67fb76a66f49c49bcbf3a5d9638d775ee278d91f9", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001215-addr_0x0000000003560000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001215-addr_0x0000000003560000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_415", "md5_hash": "dbea05790308ab35846d0f73ac362fe3", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "15d81ba01752ee2395b3c3b21ad2a7b9e4ca61b7", "sha256_hash": "7294c763af889a5c09c4d599d40d51996803a6991aa1897e1211d5473c2d12f7", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001217-addr_0x000000007efa1000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001217-addr_0x000000007efa1000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_416", "md5_hash": "0c07d941c63e8d56d3be0900feff0f28", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "78db5320daccd867be1e003570fcbd246864b63b", "sha256_hash": "6cd1f52e7da5a0e8bf553c7e93909c214e560bd3d2422df257eef8d35e1deacd", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001218-addr_0x000000007efa4000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001218-addr_0x000000007efa4000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_417", "md5_hash": "73eae5a09b96f5a4f4eb68b6db3f0ea1", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4e7340fdf6be5119eedbbb8c8d24325fc18db8c1", "sha256_hash": "1fb0f4bfd1c31b62709224783326e890948ee8d7e831bf412cd7276cf09e2070", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001220-addr_0x0000000002a10000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001220-addr_0x0000000002a10000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_418", "md5_hash": "1d770ab9b4cd618738946d54091a9547", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "347f53d3de3aa701097aaa1f99fa89b6437deb4c", "sha256_hash": "6eac228c52039238b7dde7787373ccc73313fbc093fa4a565c327274157a0783", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001221-addr_0x0000000003320000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001221-addr_0x0000000003320000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_419", "md5_hash": "66f2fd34387461a0cb662c69702b01e8", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f621ba293cca087ebb6473767f5728fca9fb648d", "sha256_hash": "94c8dd2561abaf3935d9d489afc5a16080be2133f3dd041c39fe0435fb49f1ae", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001224-addr_0x000000007ef9e000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001224-addr_0x000000007ef9e000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_420", "md5_hash": "c7bf89eaff241dd65d3b7c9bcd68bc88", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7b37d7dfc5660dbf4858ba148975e53692a74447", "sha256_hash": "52a6c35b3a4579ad85b517a0faf3e4df0946c209154448cedeca26bac084d745", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001228-addr_0x0000000002960000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00001228-addr_0x0000000002960000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_421", "md5_hash": "46cbe8a4a1079cfc123f9134f92393bc", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "47b773a4e64ef17ac65fd7b30d056f1f7cd6d274", "sha256_hash": "05f84a851ff0a0a2e1cf582e8cc424950d7b8593189e20cdeb811ae746e6af24", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001229-addr_0x0000000003780000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00001229-addr_0x0000000003780000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_422", "md5_hash": "34a3dd7fcb90d8bb3d7ec12303487c89", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5462be4f14f07cb4ee14f52e780e08c3610ee3fc", "sha256_hash": "ee8751cee6ad8fa28ad8028b6e38516d3c6c01f7ffe80709d6b682bfb57030f6", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00001231-addr_0x000000007ef9b000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00001231-addr_0x000000007ef9b000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_423", "md5_hash": "190a1e2787fcb956dc7d76be2214fbf3", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "db70993be89980c7653b98f75dfc7a7a491d08b2", "sha256_hash": "3e827e9e9130a257f662cc8ccdeec87613eacb9ce8683f41ab13624408304df3", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001461-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000009-region_00001461-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_502", "md5_hash": "b3d0b0c74055b1eeba83f33ae33fe0f3", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5b3d2d447e6991a46e335c234ea573fd894c9fbf", "sha256_hash": "02f0e49faf18b8fd7d677e1ce0d1ebfae51623116262bf1dec1ec63d4396ab69", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001462-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000009-region_00001462-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_503", "md5_hash": "324d91736b90c75944cb3c00575f77fa", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ca477767be7f0c147be6df052b11ef0e06b2b15a", "sha256_hash": "71629c0fd2624922782be0ad2c816fbf37e1cff9a8c0a94427def1457cd44024", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001465-addr_0x00000000001f0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000009-region_00001465-addr_0x00000000001f0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_504", "md5_hash": "02d953e9c6222b85b1c7b62db864d7f1", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d15e306364c4ca9bf6f9ab012958db3d035be046", "sha256_hash": "b024ffaf9db48c288b0ac2f80a7df9555a98d4edf91c9e950433d320eec3c1a5", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001466-addr_0x0000000000340000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000009-region_00001466-addr_0x0000000000340000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_505", "md5_hash": "f6ef228c3e12ff32dbbd672e11bbf0ca", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b5f283fed06801e6e06026c8893e00e2db347bbb", "sha256_hash": "469265116ed78822eb91b7e5267ccf6579920a05ff08897c0d5ace7f25d5d3c2", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001471-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000009-region_00001471-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_506", "md5_hash": "6ba96d28566f66e50be2ff4b57da63bf", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "52bb3c2207cb2930ec7063eafba5494f708ed996", "sha256_hash": "b8b05acaf6b956f51ba0f48bb1f64987f1e378007d2945b560176d24b6e6e469", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001472-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000009-region_00001472-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_507", "md5_hash": "90e96cdb389684cca95394941d1eefff", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "87abe86a840475ded04cbc5eecde3df1ba637272", "sha256_hash": "4025824f0a49fc252168bc61b629d1c61874d38f7f586deb26aeab01fde6d6c3", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001473-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000009-region_00001473-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_508", "md5_hash": "9549a12370f88f1ea2342ccc10b227de", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8a6ce92289edc56432e0be6fcef3c4a1d31d535e", "sha256_hash": "4c578a8d5080cc1f123f554a05b69b16c1de50f99f881fc439a8a13bb9040c4d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001475-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000009-region_00001475-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_509", "md5_hash": "297eed674ae9d0683cab0a715f001af2", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f43c40e2cbbdaae4c3cf2a2a75ac3caf8e97537f", "sha256_hash": "dde3206f98ee8542e78f07c8b92e7ef688da9335fed05cd499a8d23d767e6202", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001477-addr_0x0000000000590000-size_0x0000000000080000-perm_rw.bin", "filename": "process_00000009-region_00001477-addr_0x0000000000590000-size_0x0000000000080000-perm_rw.bin", "id": "proc_dump_510", "md5_hash": "7a4a8320b110e389b3cfc3521235857f", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "31f22d3b5f0db6fa04d40ec9f8abef8b48396bda", "sha256_hash": "4148cf8ab57c87854e476273070deff758d3df525f622a36019382b5f95205af", "size": 524288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001488-addr_0x0000000000760000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000009-region_00001488-addr_0x0000000000760000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_515", "md5_hash": "f564d3903cdd6b47cf3f8bd7e2d712e9", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8c5a88b9aa9a3b0717bf20cbea202d13e88b6cbf", "sha256_hash": "9f6205fd6235e9198ffe90bd58bec28a999f405cf756a0a908f8927438dc8844", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001489-addr_0x0000000000a00000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000009-region_00001489-addr_0x0000000000a00000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_516", "md5_hash": "8fdd4971d8c90986a10717ac66fa078b", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d5c365b52145b7f9c8b879adff857b8218964f2c", "sha256_hash": "d0b1da25fca5641719bee64f095953f33a9cfe42aa2fed3f302dc536e47eea43", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001511-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "filename": "process_00000009-region_00001511-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "id": "proc_dump_517", "md5_hash": "6eeea0bcbc21bd1c0d7f0d6ae3488f7b", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fad191d56abe255a03a7b4b3b641fcfa8a4f81fe", "sha256_hash": "938a68694e4495227ebc925be61a20adb5c6c82d7dd57cc67a2717e2f9f2bf70", "size": 1024000, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001512-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "filename": "process_00000009-region_00001512-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "id": "proc_dump_518", "md5_hash": "caf76e9dd8864dfb7d729847f3595e80", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "71745f0f20bf18b3813fbb1a30eed8d41dc1d51d", "sha256_hash": "f113bc4b90aa0447b7992c2783d7c3b16d63f0e65e2c54c6e93ba833e8e0c667", "size": 1175552, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001521-addr_0x00000000000e0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000009-region_00001521-addr_0x00000000000e0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_519", "md5_hash": "a91b79e9c02806119e6da60bc844a307", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c242e2556a585b81cdef152a43f855af968815f8", "sha256_hash": "6667ac22ec6bdeb4a440fa0a57823329946aeac920a173b74677b85848808c06", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001522-addr_0x00000000000f0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000009-region_00001522-addr_0x00000000000f0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_520", "md5_hash": "23d77e882a483276f42c1093b6c76d12", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2a9876e9538bfd201a10ba5b4cea61512638069b", "sha256_hash": "214fe0c77f1676e7ef4072c733e2df80fdd75e89230066843d01c3dc4cd7762f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001533-addr_0x0000000000140000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000009-region_00001533-addr_0x0000000000140000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_521", "md5_hash": "35128d2e8a4346e59915030911a61c1b", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "583e330a7ca3d4c7442970792a46309adb52d9ac", "sha256_hash": "e96c795c1c5cce2c1a84bbe41324f7238c8b86708ee9c3e25b93d0a4ead6ed77", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001536-addr_0x000000005fff0000-size_0x0000000000010000-perm_rwx.bin", "filename": "process_00000009-region_00001536-addr_0x000000005fff0000-size_0x0000000000010000-perm_rwx.bin", "id": "proc_dump_522", "md5_hash": "bc500fd9dc3df4cbbca1e31d37924a3a", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6e636a3484d4f9f33f8309d9231640fd8cdf45ec", "sha256_hash": "dbf4c6af722cd08520bf5fb9447cacb59fba5454bd8f40135f80875e9503b870", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000009-region_00001540-addr_0x00000000002c0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000009-region_00001540-addr_0x00000000002c0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_523", "md5_hash": "531a10a3bf733fd099cfe9d1446af059", "ref_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6f43203019063520d0a9923cf553768afa6bc250", "sha256_hash": "47469920a592aee8d6df501a99c53608293482e3984349252c5cd76657744927", "size": 262144, "type": "process_dump", "version": 1 } ], "processes": [ { "cmd_line": "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"", "filename": "c:\\program files\\microsoft office\\root\\office16\\winword.exe", "id": "proc_1", "image_name": "winword.exe", "monitor_reason": "analysis_target", "monitored_id": 1, "origin_monitor_id": 0, "ref_parent_process": null, "regions": [ { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_134", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 135167, "entry_point": 0, "filename": null, "id": "region_135", "name": "pagefile_0x0000000000020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 131072, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 212991, "entry_point": 0, "filename": null, "id": "region_136", "name": "pagefile_0x0000000000030000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 196608, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 278527, "entry_point": 0, "filename": null, "id": "region_137", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 749567, "entry_point": 327680, "filename": "\\Windows\\System32\\locale.nls", "id": "region_138", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 327680, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 786432, "type": "region", "version": 1 }, "end_va": 790527, "entry_point": 0, "filename": null, "id": "region_139", "name": "pagefile_0x00000000000c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 786432, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 851968, "type": "region", "version": 1 }, "end_va": 1900543, "entry_point": 0, "filename": null, "id": "region_140", "name": "private_0x00000000000d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 851968, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 1904639, "entry_point": 0, "filename": null, "id": "region_141", "name": "private_0x00000000001d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1900544, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1966080, "type": "region", "version": 1 }, "end_va": 1970175, "entry_point": 0, "filename": null, "id": "region_142", "name": "private_0x00000000001e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1966080, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2031616, "type": "region", "version": 1 }, "end_va": 3080191, "entry_point": 0, "filename": null, "id": "region_143", "name": "private_0x00000000001f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2031616, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3080192, "type": "region", "version": 1 }, "end_va": 3084287, "entry_point": 0, "filename": null, "id": "region_144", "name": "pagefile_0x00000000002f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3080192, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 3145728, "type": "region", "version": 1 }, "end_va": 3174399, "entry_point": 0, "filename": null, "id": "region_145", "name": "pagefile_0x0000000000300000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3145728, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3219455, "entry_point": 0, "filename": null, "id": "region_146", "name": "pagefile_0x0000000000310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3211264, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3276800, "type": "region", "version": 1 }, "end_va": 3280895, "entry_point": 0, "filename": null, "id": "region_147", "name": "private_0x0000000000320000", "norm_filename": null, "region_type": "private_memory", "start_va": 3276800, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3342336, "type": "region", "version": 1 }, "end_va": 3346431, "entry_point": 0, "filename": null, "id": "region_148", "name": "private_0x0000000000330000", "norm_filename": null, "region_type": "private_memory", "start_va": 3342336, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 3416063, "entry_point": 0, "filename": null, "id": "region_149", "name": "pagefile_0x0000000000340000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3407872, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 3473408, "type": "region", "version": 1 }, "end_va": 3481599, "entry_point": 0, "filename": null, "id": "region_150", "name": "pagefile_0x0000000000350000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3473408, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 3538944, "type": "region", "version": 1 }, "end_va": 3551231, "entry_point": 0, "filename": null, "id": "region_151", "name": "pagefile_0x0000000000360000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3538944, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "" ], "ref_process_dump": null, "size": 65536, "start_va": 3604480, "type": "region", "version": 1 }, "end_va": 3670015, "entry_point": 0, "filename": null, "id": "region_152", "name": "private_0x0000000000370000", "norm_filename": null, "region_type": "private_memory", "start_va": 3604480, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 3670016, "type": "region", "version": 1 }, "end_va": 3682303, "entry_point": 0, "filename": null, "id": "region_153", "name": "pagefile_0x0000000000380000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3670016, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 3735552, "type": "region", "version": 1 }, "end_va": 3747839, "entry_point": 0, "filename": null, "id": "region_154", "name": "pagefile_0x0000000000390000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3735552, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 3801088, "type": "region", "version": 1 }, "end_va": 3813375, "entry_point": 0, "filename": null, "id": "region_155", "name": "pagefile_0x00000000003a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3801088, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 3866624, "type": "region", "version": 1 }, "end_va": 3878911, "entry_point": 0, "filename": null, "id": "region_156", "name": "pagefile_0x00000000003b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3866624, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 32768, "start_va": 3932160, "type": "region", "version": 1 }, "end_va": 3964927, "entry_point": 0, "filename": null, "id": "region_157", "name": "private_0x00000000003c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3932160, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 3997696, "type": "region", "version": 1 }, "end_va": 4005887, "entry_point": 0, "filename": null, "id": "region_158", "name": "pagefile_0x00000000003d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3997696, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 4063232, "type": "region", "version": 1 }, "end_va": 5111807, "entry_point": 0, "filename": null, "id": "region_159", "name": "private_0x00000000003e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4063232, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 6717439, "entry_point": 0, "filename": null, "id": "region_160", "name": "pagefile_0x00000000004e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5111808, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 6750208, "type": "region", "version": 1 }, "end_va": 6754303, "entry_point": 0, "filename": null, "id": "region_161", "name": "private_0x0000000000670000", "norm_filename": null, "region_type": "private_memory", "start_va": 6750208, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6815744, "type": "region", "version": 1 }, "end_va": 6881279, "entry_point": 0, "filename": null, "id": "region_162", "name": "private_0x0000000000680000", "norm_filename": null, "region_type": "private_memory", "start_va": 6815744, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 6881280, "type": "region", "version": 1 }, "end_va": 8458239, "entry_point": 0, "filename": null, "id": "region_163", "name": "pagefile_0x0000000000690000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6881280, "timestamp": "00:00:20.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 29491199, "entry_point": 0, "filename": null, "id": "region_164", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 2945024, "start_va": 29491200, "type": "region", "version": 1 }, "end_va": 32436223, "entry_point": 29491200, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_165", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 29491200, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4141056, "start_va": 32440320, "type": "region", "version": 1 }, "end_va": 36581375, "entry_point": 0, "filename": null, "id": "region_166", "name": "pagefile_0x0000000001ef0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 32440320, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 36634624, "type": "region", "version": 1 }, "end_va": 37683199, "entry_point": 0, "filename": null, "id": "region_167", "name": "private_0x00000000022f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 36634624, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 37683200, "type": "region", "version": 1 }, "end_va": 37945343, "entry_point": 0, "filename": null, "id": "region_168", "name": "private_0x00000000023f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 37683200, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 37945344, "type": "region", "version": 1 }, "end_va": 37949439, "entry_point": 0, "filename": null, "id": "region_169", "name": "private_0x0000000002430000", "norm_filename": null, "region_type": "private_memory", "start_va": 37945344, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 38010880, "type": "region", "version": 1 }, "end_va": 38014975, "entry_point": 0, "filename": null, "id": "region_170", "name": "private_0x0000000002440000", "norm_filename": null, "region_type": "private_memory", "start_va": 38010880, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 38076416, "type": "region", "version": 1 }, "end_va": 38080511, "entry_point": 0, "filename": null, "id": "region_171", "name": "private_0x0000000002450000", "norm_filename": null, "region_type": "private_memory", "start_va": 38076416, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 38141952, "type": "region", "version": 1 }, "end_va": 38146047, "entry_point": 0, "filename": null, "id": "region_172", "name": "private_0x0000000002460000", "norm_filename": null, "region_type": "private_memory", "start_va": 38141952, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 20480, "start_va": 38207488, "type": "region", "version": 1 }, "end_va": 38227967, "entry_point": 0, "filename": null, "id": "region_173", "name": "pagefile_0x0000000002470000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 38207488, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 38273024, "type": "region", "version": 1 }, "end_va": 38338559, "entry_point": 0, "filename": null, "id": "region_174", "name": "private_0x0000000002480000", "norm_filename": null, "region_type": "private_memory", "start_va": 38273024, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 38338560, "type": "region", "version": 1 }, "end_va": 39251967, "entry_point": 0, "filename": null, "id": "region_175", "name": "pagefile_0x0000000002490000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 38338560, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 163840, "start_va": 39256064, "type": "region", "version": 1 }, "end_va": 39419903, "entry_point": 0, "filename": null, "id": "region_176", "name": "private_0x0000000002570000", "norm_filename": null, "region_type": "private_memory", "start_va": 39256064, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 39452672, "type": "region", "version": 1 }, "end_va": 39456767, "entry_point": 0, "filename": null, "id": "region_177", "name": "pagefile_0x00000000025a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 39452672, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 39518208, "type": "region", "version": 1 }, "end_va": 39522303, "entry_point": 0, "filename": null, "id": "region_178", "name": "pagefile_0x00000000025b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 39518208, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 39583744, "type": "region", "version": 1 }, "end_va": 39587839, "entry_point": 0, "filename": null, "id": "region_179", "name": "private_0x00000000025c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 39583744, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 39649280, "type": "region", "version": 1 }, "end_va": 39657471, "entry_point": 0, "filename": null, "id": "region_180", "name": "pagefile_0x00000000025d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 39649280, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 39714816, "type": "region", "version": 1 }, "end_va": 39718911, "entry_point": 39714816, "filename": "\\Windows\\System32\\msxml6r.dll", "id": "region_181", "name": "msxml6r.dll", "norm_filename": "c:\\windows\\system32\\msxml6r.dll", "region_type": "memory_mapped_file", "start_va": 39714816, "timestamp": "00:00:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 39780352, "type": "region", "version": 1 }, "end_va": 40304639, "entry_point": 0, "filename": null, "id": "region_182", "name": "private_0x00000000025f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 39780352, "timestamp": "00:00:20.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 786432, "start_va": 40304640, "type": "region", "version": 1 }, "end_va": 41091071, "entry_point": 40304640, "filename": "\\Windows\\System32\\en-US\\KernelBase.dll.mui", "id": "region_183", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 40304640, "timestamp": "00:00:20.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 438272, "start_va": 41091072, "type": "region", "version": 1 }, "end_va": 41529343, "entry_point": 0, "filename": null, "id": "region_184", "name": "private_0x0000000002730000", "norm_filename": null, "region_type": "private_memory", "start_va": 41091072, "timestamp": "00:00:20.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 41549824, "type": "region", "version": 1 }, "end_va": 41771007, "entry_point": 41549824, "filename": "\\Windows\\System32\\cfgmgr32.dll", "id": "region_185", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\system32\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 41549824, "timestamp": "00:00:20.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 41811968, "type": "region", "version": 1 }, "end_va": 41816063, "entry_point": 0, "filename": null, "id": "region_186", "name": "pagefile_0x00000000027e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 41811968, "timestamp": "00:00:20.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 41877504, "type": "region", "version": 1 }, "end_va": 42926079, "entry_point": 0, "filename": null, "id": "region_187", "name": "private_0x00000000027f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 41877504, "timestamp": "00:00:20.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 126976, "start_va": 42926080, "type": "region", "version": 1 }, "end_va": 43053055, "entry_point": 42926080, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000011.db", "id": "region_188", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db", "region_type": "memory_mapped_file", "start_va": 42926080, "timestamp": "00:00:20.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 43057152, "type": "region", "version": 1 }, "end_va": 43061247, "entry_point": 0, "filename": null, "id": "region_189", "name": "private_0x0000000002910000", "norm_filename": null, "region_type": "private_memory", "start_va": 43057152, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 43122688, "type": "region", "version": 1 }, "end_va": 43130879, "entry_point": 0, "filename": null, "id": "region_190", "name": "pagefile_0x0000000002920000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 43122688, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 69632, "start_va": 43188224, "type": "region", "version": 1 }, "end_va": 43257855, "entry_point": 43188224, "filename": "\\Windows\\System32\\C_1255.NLS", "id": "region_191", "name": "c_1255.nls", "norm_filename": "c:\\windows\\system32\\c_1255.nls", "region_type": "memory_mapped_file", "start_va": 43188224, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 43319296, "type": "region", "version": 1 }, "end_va": 43384831, "entry_point": 0, "filename": null, "id": "region_192", "name": "private_0x0000000002950000", "norm_filename": null, "region_type": "private_memory", "start_va": 43319296, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "" ], "ref_process_dump": null, "size": 131072, "start_va": 43384832, "type": "region", "version": 1 }, "end_va": 43515903, "entry_point": 0, "filename": null, "id": "region_193", "name": "private_0x0000000002960000", "norm_filename": null, "region_type": "private_memory", "start_va": 43384832, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 43515904, "type": "region", "version": 1 }, "end_va": 44040191, "entry_point": 0, "filename": null, "id": "region_194", "name": "private_0x0000000002980000", "norm_filename": null, "region_type": "private_memory", "start_va": 43515904, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "" ], "ref_process_dump": null, "size": 131072, "start_va": 44040192, "type": "region", "version": 1 }, "end_va": 44171263, "entry_point": 0, "filename": null, "id": "region_195", "name": "private_0x0000000002a00000", "norm_filename": null, "region_type": "private_memory", "start_va": 44040192, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 126976, "start_va": 44171264, "type": "region", "version": 1 }, "end_va": 44298239, "entry_point": 0, "filename": null, "id": "region_196", "name": "private_0x0000000002a20000", "norm_filename": null, "region_type": "private_memory", "start_va": 44171264, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 44302336, "type": "region", "version": 1 }, "end_va": 45350911, "entry_point": 0, "filename": null, "id": "region_197", "name": "private_0x0000000002a40000", "norm_filename": null, "region_type": "private_memory", "start_va": 44302336, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "" ], "ref_process_dump": null, "size": 131072, "start_va": 45350912, "type": "region", "version": 1 }, "end_va": 45481983, "entry_point": 0, "filename": null, "id": "region_198", "name": "private_0x0000000002b40000", "norm_filename": null, "region_type": "private_memory", "start_va": 45350912, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "" ], "ref_process_dump": null, "size": 131072, "start_va": 45481984, "type": "region", "version": 1 }, "end_va": 45613055, "entry_point": 0, "filename": null, "id": "region_199", "name": "private_0x0000000002b60000", "norm_filename": null, "region_type": "private_memory", "start_va": 45481984, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 45613056, "type": "region", "version": 1 }, "end_va": 45633535, "entry_point": 45613056, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\ONBttnWD.dll", "id": "region_200", "name": "onbttnwd.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\onbttnwd.dll", "region_type": "memory_mapped_file", "start_va": 45613056, "timestamp": "00:00:20.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 45678592, "type": "region", "version": 1 }, "end_va": 45694975, "entry_point": 45678592, "filename": "\\Windows\\System32\\stdole2.tlb", "id": "region_201", "name": "stdole2.tlb", "norm_filename": "c:\\windows\\system32\\stdole2.tlb", "region_type": "memory_mapped_file", "start_va": 45678592, "timestamp": "00:00:20.929", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 45744128, "type": "region", "version": 1 }, "end_va": 46792703, "entry_point": 0, "filename": null, "id": "region_202", "name": "private_0x0000000002ba0000", "norm_filename": null, "region_type": "private_memory", "start_va": 45744128, "timestamp": "00:00:20.936", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 46792704, "type": "region", "version": 1 }, "end_va": 48889855, "entry_point": 0, "filename": null, "id": "region_203", "name": "private_0x0000000002ca0000", "norm_filename": null, "region_type": "private_memory", "start_va": 46792704, "timestamp": "00:00:20.936", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1253376, "start_va": 48889856, "type": "region", "version": 1 }, "end_va": 50143231, "entry_point": 0, "filename": null, "id": "region_204", "name": "private_0x0000000002ea0000", "norm_filename": null, "region_type": "private_memory", "start_va": 48889856, "timestamp": "00:00:20.936", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 520192, "start_va": 50200576, "type": "region", "version": 1 }, "end_va": 50720767, "entry_point": 50200576, "filename": "\\Windows\\Fonts\\segoeui.ttf", "id": "region_205", "name": "segoeui.ttf", "norm_filename": "c:\\windows\\fonts\\segoeui.ttf", "region_type": "memory_mapped_file", "start_va": 50200576, "timestamp": "00:00:20.936", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 50790400, "type": "region", "version": 1 }, "end_va": 50855935, "entry_point": 0, "filename": null, "id": "region_206", "name": "private_0x0000000003070000", "norm_filename": null, "region_type": "private_memory", "start_va": 50790400, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 50987008, "type": "region", "version": 1 }, "end_va": 52035583, "entry_point": 0, "filename": null, "id": "region_207", "name": "private_0x00000000030a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 50987008, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 52559872, "type": "region", "version": 1 }, "end_va": 53608447, "entry_point": 0, "filename": null, "id": "region_208", "name": "private_0x0000000003220000", "norm_filename": null, "region_type": "private_memory", "start_va": 52559872, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 53608448, "type": "region", "version": 1 }, "end_va": 54657023, "entry_point": 0, "filename": null, "id": "region_209", "name": "private_0x0000000003320000", "norm_filename": null, "region_type": "private_memory", "start_va": 53608448, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 54657024, "type": "region", "version": 1 }, "end_va": 54722559, "entry_point": 0, "filename": null, "id": "region_210", "name": "private_0x0000000003420000", "norm_filename": null, "region_type": "private_memory", "start_va": 54657024, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 54919168, "type": "region", "version": 1 }, "end_va": 55967743, "entry_point": 0, "filename": null, "id": "region_211", "name": "private_0x0000000003460000", "norm_filename": null, "region_type": "private_memory", "start_va": 54919168, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4194304, "start_va": 55967744, "type": "region", "version": 1 }, "end_va": 60162047, "entry_point": 0, "filename": null, "id": "region_212", "name": "pagefile_0x0000000003560000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 55967744, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 9633792, "start_va": 60162048, "type": "region", "version": 1 }, "end_va": 69795839, "entry_point": 60162048, "filename": "\\Windows\\Fonts\\StaticCache.dat", "id": "region_213", "name": "staticcache.dat", "norm_filename": "c:\\windows\\fonts\\staticcache.dat", "region_type": "memory_mapped_file", "start_va": 60162048, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 69795840, "type": "region", "version": 1 }, "end_va": 70844415, "entry_point": 0, "filename": null, "id": "region_214", "name": "private_0x0000000004290000", "norm_filename": null, "region_type": "private_memory", "start_va": 69795840, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 71172096, "type": "region", "version": 1 }, "end_va": 72220671, "entry_point": 0, "filename": null, "id": "region_215", "name": "private_0x00000000043e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 71172096, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 72548352, "type": "region", "version": 1 }, "end_va": 73596927, "entry_point": 0, "filename": null, "id": "region_216", "name": "private_0x0000000004530000", "norm_filename": null, "region_type": "private_memory", "start_va": 72548352, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 73859072, "type": "region", "version": 1 }, "end_va": 74907647, "entry_point": 0, "filename": null, "id": "region_217", "name": "private_0x0000000004670000", "norm_filename": null, "region_type": "private_memory", "start_va": 73859072, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 524288, "start_va": 74973184, "type": "region", "version": 1 }, "end_va": 75497471, "entry_point": 0, "filename": null, "id": "region_218", "name": "private_0x0000000004780000", "norm_filename": null, "region_type": "private_memory", "start_va": 74973184, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8388608, "start_va": 75497472, "type": "region", "version": 1 }, "end_va": 83886079, "entry_point": 0, "filename": null, "id": "region_219", "name": "pagefile_0x0000000004800000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 75497472, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 83886080, "type": "region", "version": 1 }, "end_va": 84934655, "entry_point": 0, "filename": null, "id": "region_220", "name": "private_0x0000000005000000", "norm_filename": null, "region_type": "private_memory", "start_va": 83886080, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 84934656, "type": "region", "version": 1 }, "end_va": 85983231, "entry_point": 0, "filename": null, "id": "region_221", "name": "private_0x0000000005100000", "norm_filename": null, "region_type": "private_memory", "start_va": 84934656, "timestamp": "00:00:20.937", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 85983232, "type": "region", "version": 1 }, "end_va": 87031807, "entry_point": 0, "filename": null, "id": "region_222", "name": "private_0x0000000005200000", "norm_filename": null, "region_type": "private_memory", "start_va": 85983232, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 87818240, "type": "region", "version": 1 }, "end_va": 87883775, "entry_point": 0, "filename": null, "id": "region_223", "name": "private_0x00000000053c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 87818240, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4194304, "start_va": 87883776, "type": "region", "version": 1 }, "end_va": 92078079, "entry_point": 0, "filename": null, "id": "region_224", "name": "private_0x00000000053d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 87883776, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16777216, "start_va": 92078080, "type": "region", "version": 1 }, "end_va": 108855295, "entry_point": 0, "filename": null, "id": "region_225", "name": "pagefile_0x00000000057d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 92078080, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 109445120, "type": "region", "version": 1 }, "end_va": 109969407, "entry_point": 0, "filename": null, "id": "region_226", "name": "private_0x0000000006860000", "norm_filename": null, "region_type": "private_memory", "start_va": 109445120, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 110755840, "type": "region", "version": 1 }, "end_va": 111280127, "entry_point": 0, "filename": null, "id": "region_227", "name": "private_0x00000000069a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 110755840, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 111869952, "type": "region", "version": 1 }, "end_va": 112394239, "entry_point": 0, "filename": null, "id": "region_228", "name": "private_0x0000000006ab0000", "norm_filename": null, "region_type": "private_memory", "start_va": 111869952, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4194304, "start_va": 112394240, "type": "region", "version": 1 }, "end_va": 116588543, "entry_point": 0, "filename": null, "id": "region_229", "name": "private_0x0000000006b30000", "norm_filename": null, "region_type": "private_memory", "start_va": 112394240, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 116719616, "type": "region", "version": 1 }, "end_va": 117768191, "entry_point": 0, "filename": null, "id": "region_230", "name": "private_0x0000000006f50000", "norm_filename": null, "region_type": "private_memory", "start_va": 116719616, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8388608, "start_va": 117768192, "type": "region", "version": 1 }, "end_va": 126156799, "entry_point": 0, "filename": null, "id": "region_231", "name": "private_0x0000000007050000", "norm_filename": null, "region_type": "private_memory", "start_va": 117768192, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4198400, "start_va": 126156800, "type": "region", "version": 1 }, "end_va": 130355199, "entry_point": 0, "filename": null, "id": "region_232", "name": "private_0x0000000007850000", "norm_filename": null, "region_type": "private_memory", "start_va": 126156800, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4198400, "start_va": 130416640, "type": "region", "version": 1 }, "end_va": 134615039, "entry_point": 0, "filename": null, "id": "region_233", "name": "private_0x0000000007c60000", "norm_filename": null, "region_type": "private_memory", "start_va": 130416640, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4198400, "start_va": 134676480, "type": "region", "version": 1 }, "end_va": 138874879, "entry_point": 0, "filename": null, "id": "region_234", "name": "private_0x0000000008070000", "norm_filename": null, "region_type": "private_memory", "start_va": 134676480, "timestamp": "00:00:20.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 138936320, "type": "region", "version": 1 }, "end_va": 141033471, "entry_point": 0, "filename": null, "id": "region_235", "name": "private_0x0000000008480000", "norm_filename": null, "region_type": "private_memory", "start_va": 138936320, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4980736, "start_va": 141033472, "type": "region", "version": 1 }, "end_va": 146014207, "entry_point": 0, "filename": null, "id": "region_236", "name": "private_0x0000000008680000", "norm_filename": null, "region_type": "private_memory", "start_va": 141033472, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4194304, "start_va": 146014208, "type": "region", "version": 1 }, "end_va": 150208511, "entry_point": 0, "filename": null, "id": "region_237", "name": "private_0x0000000008b40000", "norm_filename": null, "region_type": "private_memory", "start_va": 146014208, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 150208512, "type": "region", "version": 1 }, "end_va": 151257087, "entry_point": 0, "filename": null, "id": "region_238", "name": "private_0x0000000008f40000", "norm_filename": null, "region_type": "private_memory", "start_va": 150208512, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 922484736, "type": "region", "version": 1 }, "end_va": 922550271, "entry_point": 0, "filename": null, "id": "region_239", "name": "private_0x0000000036fc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 922484736, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 1878982656, "type": "region", "version": 1 }, "end_va": 1879048191, "entry_point": 0, "filename": null, "id": "region_240", "name": "private_0x000000006fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1878982656, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 1951334400, "type": "region", "version": 1 }, "end_va": 1951543295, "entry_point": 1951334400, "filename": "\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", "id": "region_241", "name": "osppc.dll", "norm_filename": "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll", "region_type": "memory_mapped_file", "start_va": 1951334400, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 1996161024, "filename": "\\Windows\\System32\\user32.dll", "id": "region_242", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1996161024, "timestamp": "00:00:20.947", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 1997209600, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_243", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1997209600, "timestamp": "00:00:21.003", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_244", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:00:21.160", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 2000289792, "type": "region", "version": 1 }, "end_va": 2000318463, "entry_point": 2000289792, "filename": "\\Windows\\System32\\psapi.dll", "id": "region_245", "name": "psapi.dll", "norm_filename": "c:\\windows\\system32\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 2000289792, "timestamp": "00:00:21.232", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_246", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:00:21.240", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_247", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:00:21.240", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_248", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:21.240", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1945600, "start_va": 5356060672, "type": "region", "version": 1 }, "end_va": 5358006271, "entry_point": 5356060672, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE", "id": "region_249", "name": "winword.exe", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\winword.exe", "region_type": "memory_mapped_file", "start_va": 5356060672, "timestamp": "00:00:21.240", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 8790690299904, "type": "region", "version": 1 }, "end_va": 8790690365439, "entry_point": 0, "filename": null, "id": "region_250", "name": "private_0x000007febdf90000", "norm_filename": null, "region_type": "private_memory", "start_va": 8790690299904, "timestamp": "00:00:21.250", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 11505664, "start_va": 8791327375360, "type": "region", "version": 1 }, "end_va": 8791338881023, "entry_point": 8791327375360, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL", "id": "region_251", "name": "chart.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\chart.dll", "region_type": "memory_mapped_file", "start_va": 8791327375360, "timestamp": "00:00:21.250", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2240512, "start_va": 8791338909696, "type": "region", "version": 1 }, "end_va": 8791341150207, "entry_point": 8791338909696, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL", "id": "region_252", "name": "riched20.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll", "region_type": "memory_mapped_file", "start_va": 8791338909696, "timestamp": "00:00:21.263", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1507328, "start_va": 8791342383104, "type": "region", "version": 1 }, "end_va": 8791343890431, "entry_point": 8791342383104, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL", "id": "region_253", "name": "msptls.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msptls.dll", "region_type": "memory_mapped_file", "start_va": 8791342383104, "timestamp": "00:00:21.292", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1552384, "start_va": 8791343890432, "type": "region", "version": 1 }, "end_va": 8791345442815, "entry_point": 8791343890432, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL", "id": "region_254", "name": "msointl.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl.dll", "region_type": "memory_mapped_file", "start_va": 8791343890432, "timestamp": "00:00:21.313", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 770048, "start_va": 8791345463296, "type": "region", "version": 1 }, "end_va": 8791346233343, "entry_point": 8791345463296, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL", "id": "region_255", "name": "wwintl.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll", "region_type": "memory_mapped_file", "start_va": 8791345463296, "timestamp": "00:00:21.316", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 82046976, "start_va": 8791346249728, "type": "region", "version": 1 }, "end_va": 8791428296703, "entry_point": 8791346249728, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL", "id": "region_256", "name": "msores.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll", "region_type": "memory_mapped_file", "start_va": 8791346249728, "timestamp": "00:00:21.326", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 9572352, "start_va": 8791428300800, "type": "region", "version": 1 }, "end_va": 8791437873151, "entry_point": 8791428300800, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL", "id": "region_257", "name": "mso99lres.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll", "region_type": "memory_mapped_file", "start_va": 8791428300800, "timestamp": "00:00:21.329", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 3178496, "start_va": 8791437934592, "type": "region", "version": 1 }, "end_va": 8791441113087, "entry_point": 8791437934592, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL", "id": "region_258", "name": "mso40uires.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll", "region_type": "memory_mapped_file", "start_va": 8791437934592, "timestamp": "00:00:21.332", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 19775488, "start_va": 8791441145856, "type": "region", "version": 1 }, "end_va": 8791460921343, "entry_point": 8791441145856, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL", "id": "region_259", "name": "mso.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll", "region_type": "memory_mapped_file", "start_va": 8791441145856, "timestamp": "00:00:21.336", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 8175616, "start_va": 8791460937728, "type": "region", "version": 1 }, "end_va": 8791469113343, "entry_point": 8791460937728, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll", "id": "region_260", "name": "mso99lwin32client.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lwin32client.dll", "region_type": "memory_mapped_file", "start_va": 8791460937728, "timestamp": "00:00:21.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 9351168, "start_va": 8791469129728, "type": "region", "version": 1 }, "end_va": 8791478480895, "entry_point": 8791469129728, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll", "id": "region_261", "name": "mso40uiwin32client.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll", "region_type": "memory_mapped_file", "start_va": 8791469129728, "timestamp": "00:00:21.389", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4685824, "start_va": 8791478501376, "type": "region", "version": 1 }, "end_va": 8791483187199, "entry_point": 8791478501376, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll", "id": "region_262", "name": "mso30win32client.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll", "region_type": "memory_mapped_file", "start_va": 8791478501376, "timestamp": "00:00:21.400", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 3162112, "start_va": 8791483219968, "type": "region", "version": 1 }, "end_va": 8791486382079, "entry_point": 8791483219968, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll", "id": "region_263", "name": "mso20win32client.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll", "region_type": "memory_mapped_file", "start_va": 8791483219968, "timestamp": "00:00:21.412", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 18268160, "start_va": 8791486431232, "type": "region", "version": 1 }, "end_va": 8791504699391, "entry_point": 8791486431232, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL", "id": "region_264", "name": "oart.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\oart.dll", "region_type": "memory_mapped_file", "start_va": 8791486431232, "timestamp": "00:00:21.423", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 37351424, "start_va": 8791504715776, "type": "region", "version": 1 }, "end_va": 8791542067199, "entry_point": 8791504715776, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\WWLIB.DLL", "id": "region_265", "name": "wwlib.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\wwlib.dll", "region_type": "memory_mapped_file", "start_va": 8791504715776, "timestamp": "00:00:21.434", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 626688, "start_va": 8791543709696, "type": "region", "version": 1 }, "end_va": 8791544336383, "entry_point": 8791543709696, "filename": "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll", "id": "region_266", "name": "mscoreei.dll", "norm_filename": "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll", "region_type": "memory_mapped_file", "start_va": 8791543709696, "timestamp": "00:00:21.449", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1564672, "start_va": 8791544365056, "type": "region", "version": 1 }, "end_va": 8791545929727, "entry_point": 8791544365056, "filename": "\\Windows\\System32\\DWrite.dll", "id": "region_267", "name": "dwrite.dll", "norm_filename": "c:\\windows\\system32\\dwrite.dll", "region_type": "memory_mapped_file", "start_va": 8791544365056, "timestamp": "00:00:21.480", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1900544, "start_va": 8791545937920, "type": "region", "version": 1 }, "end_va": 8791547838463, "entry_point": 8791545937920, "filename": "\\Windows\\System32\\d3d10warp.dll", "id": "region_268", "name": "d3d10warp.dll", "norm_filename": "c:\\windows\\system32\\d3d10warp.dll", "region_type": "memory_mapped_file", "start_va": 8791545937920, "timestamp": "00:00:21.488", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 237568, "start_va": 8791548362752, "type": "region", "version": 1 }, "end_va": 8791548600319, "entry_point": 8791548405176, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\ONBttnWD.dll", "id": "region_269", "name": "onbttnwd.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\onbttnwd.dll", "region_type": "memory_mapped_file", "start_va": 8791548362752, "timestamp": "00:00:21.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 241664, "start_va": 8791548624896, "type": "region", "version": 1 }, "end_va": 8791548866559, "entry_point": 8791548624896, "filename": "\\Windows\\System32\\mlang.dll", "id": "region_270", "name": "mlang.dll", "norm_filename": "c:\\windows\\system32\\mlang.dll", "region_type": "memory_mapped_file", "start_va": 8791548624896, "timestamp": "00:00:21.496", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 454656, "start_va": 8791553802240, "type": "region", "version": 1 }, "end_va": 8791554256895, "entry_point": 8791553802240, "filename": "\\Windows\\System32\\mscoree.dll", "id": "region_271", "name": "mscoree.dll", "norm_filename": "c:\\windows\\system32\\mscoree.dll", "region_type": "memory_mapped_file", "start_va": 8791553802240, "timestamp": "00:00:21.505", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 811008, "start_va": 8791554260992, "type": "region", "version": 1 }, "end_va": 8791555071999, "entry_point": 8791554260992, "filename": "\\Windows\\System32\\d3d11.dll", "id": "region_272", "name": "d3d11.dll", "norm_filename": "c:\\windows\\system32\\d3d11.dll", "region_type": "memory_mapped_file", "start_va": 8791554260992, "timestamp": "00:00:21.518", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 8791555768320, "type": "region", "version": 1 }, "end_va": 8791555829759, "entry_point": 8791555768320, "filename": "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll", "id": "region_273", "name": "msointl30.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl30.dll", "region_type": "memory_mapped_file", "start_va": 8791555768320, "timestamp": "00:00:21.525", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 8791555833856, "type": "region", "version": 1 }, "end_va": 8791555993599, "entry_point": 8791555833856, "filename": "\\Windows\\System32\\sppc.dll", "id": "region_274", "name": "sppc.dll", "norm_filename": "c:\\windows\\system32\\sppc.dll", "region_type": "memory_mapped_file", "start_va": 8791555833856, "timestamp": "00:00:21.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 8791590699008, "type": "region", "version": 1 }, "end_va": 8791590748159, "entry_point": 8791590699008, "filename": "\\Windows\\System32\\npmproxy.dll", "id": "region_275", "name": "npmproxy.dll", "norm_filename": "c:\\windows\\system32\\npmproxy.dll", "region_type": "memory_mapped_file", "start_va": 8791590699008, "timestamp": "00:00:21.541", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2039808, "start_va": 8791595548672, "type": "region", "version": 1 }, "end_va": 8791597588479, "entry_point": 8791595548672, "filename": "\\Windows\\System32\\msxml6.dll", "id": "region_276", "name": "msxml6.dll", "norm_filename": "c:\\windows\\system32\\msxml6.dll", "region_type": "memory_mapped_file", "start_va": 8791595548672, "timestamp": "00:00:21.547", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 462848, "start_va": 8791598497792, "type": "region", "version": 1 }, "end_va": 8791598960639, "entry_point": 8791598497792, "filename": "\\Windows\\System32\\winspool.drv", "id": "region_277", "name": "winspool.drv", "norm_filename": "c:\\windows\\system32\\winspool.drv", "region_type": "memory_mapped_file", "start_va": 8791598497792, "timestamp": "00:00:21.567", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12288, "start_va": 8791602888704, "type": "region", "version": 1 }, "end_va": 8791602900991, "entry_point": 8791602888704, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-file-l1-2-0.dll", "id": "region_278", "name": "api-ms-win-core-file-l1-2-0.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-file-l1-2-0.dll", "region_type": "memory_mapped_file", "start_va": 8791602888704, "timestamp": "00:00:21.576", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12288, "start_va": 8791602954240, "type": "region", "version": 1 }, "end_va": 8791602966527, "entry_point": 8791602954240, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-processthreads-l1-1-1.dll", "id": "region_279", "name": "api-ms-win-core-processthreads-l1-1-1.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-processthreads-l1-1-1.dll", "region_type": "memory_mapped_file", "start_va": 8791602954240, "timestamp": "00:00:21.583", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12288, "start_va": 8791603019776, "type": "region", "version": 1 }, "end_va": 8791603032063, "entry_point": 8791603019776, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-synch-l1-2-0.dll", "id": "region_280", "name": "api-ms-win-core-synch-l1-2-0.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-synch-l1-2-0.dll", "region_type": "memory_mapped_file", "start_va": 8791603019776, "timestamp": "00:00:21.590", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12288, "start_va": 8791603085312, "type": "region", "version": 1 }, "end_va": 8791603097599, "entry_point": 8791603085312, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-localization-l1-2-0.dll", "id": "region_281", "name": "api-ms-win-core-localization-l1-2-0.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-localization-l1-2-0.dll", "region_type": "memory_mapped_file", "start_va": 8791603085312, "timestamp": "00:00:21.597", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12288, "start_va": 8791603150848, "type": "region", "version": 1 }, "end_va": 8791603163135, "entry_point": 8791603150848, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-file-l2-1-0.dll", "id": "region_282", "name": "api-ms-win-core-file-l2-1-0.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-file-l2-1-0.dll", "region_type": "memory_mapped_file", "start_va": 8791603150848, "timestamp": "00:00:21.604", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12288, "start_va": 8791603216384, "type": "region", "version": 1 }, "end_va": 8791603228671, "entry_point": 8791603216384, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-timezone-l1-1-0.dll", "id": "region_283", "name": "api-ms-win-core-timezone-l1-1-0.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-timezone-l1-1-0.dll", "region_type": "memory_mapped_file", "start_va": 8791603216384, "timestamp": "00:00:21.611", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\agraba8.exe\" ", "filename": "c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe", "id": "proc_2", "image_name": "agraba8.exe", "monitor_reason": "child_process", "monitored_id": 2, "origin_monitor_id": 1, "ref_parent_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000002-region_00000629-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_277", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_629", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:00:45.918", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000630-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_278", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_630", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:45.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 266239, "entry_point": 262144, "filename": "\\Windows\\System32\\apisetschema.dll", "id": "region_631", "name": "apisetschema.dll", "norm_filename": "c:\\windows\\system32\\apisetschema.dll", "region_type": "memory_mapped_file", "start_va": 262144, "timestamp": "00:00:45.918", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000632-addr_0x0000000000050000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_279", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 589823, "entry_point": 0, "filename": null, "id": "region_632", "name": "private_0x0000000000050000", "norm_filename": null, "region_type": "private_memory", "start_va": 327680, "timestamp": "00:00:45.921", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000633-addr_0x0000000000090000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_280", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 589824, "type": "region", "version": 1 }, "end_va": 1638399, "entry_point": 0, "filename": null, "id": "region_633", "name": "private_0x0000000000090000", "norm_filename": null, "region_type": "private_memory", "start_va": 589824, "timestamp": "00:00:45.921", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000634-addr_0x0000000000400000-size_0x00000000000da000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_281", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 892928, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 5087231, "entry_point": 4194304, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\agraba8.exe", "id": "region_634", "name": "agraba8.exe", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:00:45.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_635", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:00:45.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1572864, "start_va": 2000355328, "type": "region", "version": 1 }, "end_va": 2001928191, "entry_point": 2000355328, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_636", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 2000355328, "timestamp": "00:00:45.923", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2130378752, "type": "region", "version": 1 }, "end_va": 2130522111, "entry_point": 0, "filename": null, "id": "region_637", "name": "pagefile_0x000000007efb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130378752, "timestamp": "00:00:46.002", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000638-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_282", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130554880, "type": "region", "version": 1 }, "end_va": 2130567167, "entry_point": 0, "filename": null, "id": "region_638", "name": "private_0x000000007efdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130554880, "timestamp": "00:00:46.003", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000639-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_283", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2130567168, "type": "region", "version": 1 }, "end_va": 2130571263, "entry_point": 0, "filename": null, "id": "region_639", "name": "private_0x000000007efde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130567168, "timestamp": "00:00:46.003", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000640-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_284", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2130571264, "type": "region", "version": 1 }, "end_va": 2130575359, "entry_point": 0, "filename": null, "id": "region_640", "name": "private_0x000000007efdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130571264, "timestamp": "00:00:46.003", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16777216, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_641", "name": "private_0x000000007efe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130575360, "timestamp": "00:00:46.003", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000642-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_285", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_642", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:46.004", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8793945538560, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 8796092956671, "entry_point": 0, "filename": null, "id": "region_643", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:46.004", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1638400, "type": "region", "version": 1 }, "end_va": 1654783, "entry_point": 0, "filename": null, "id": "region_644", "name": "pagefile_0x0000000000190000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1638400, "timestamp": "00:00:46.029", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000645-addr_0x0000000000290000-size_0x0000000000080000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_286", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 524288, "start_va": 2686976, "type": "region", "version": 1 }, "end_va": 3211263, "entry_point": 0, "filename": null, "id": "region_645", "name": "private_0x0000000000290000", "norm_filename": null, "region_type": "private_memory", "start_va": 2686976, "timestamp": "00:00:46.029", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1940389888, "type": "region", "version": 1 }, "end_va": 1940766719, "entry_point": 1940389888, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_646", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1940389888, "timestamp": "00:00:46.029", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 1940783104, "type": "region", "version": 1 }, "end_va": 1941041151, "entry_point": 1940783104, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_647", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1940783104, "timestamp": "00:00:46.036", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1941241856, "type": "region", "version": 1 }, "end_va": 1941274623, "entry_point": 1941241856, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_648", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1941241856, "timestamp": "00:00:46.045", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000649-addr_0x00000000005d0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_287", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 6094848, "type": "region", "version": 1 }, "end_va": 7143423, "entry_point": 0, "filename": null, "id": "region_649", "name": "private_0x00000000005d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6094848, "timestamp": "00:00:46.065", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1114112, "start_va": 1964834816, "type": "region", "version": 1 }, "end_va": 1965948927, "entry_point": 1964834816, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_650", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1964834816, "timestamp": "00:00:46.065", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 286720, "start_va": 1976172544, "type": "region", "version": 1 }, "end_va": 1976459263, "entry_point": 1976172544, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_651", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1976172544, "timestamp": "00:00:46.230", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000652-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_288", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 0, "filename": null, "id": "region_652", "name": "private_0x0000000076fb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1996161024, "timestamp": "00:00:46.276", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000653-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_289", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 0, "filename": null, "id": "region_653", "name": "private_0x00000000770b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1997209600, "timestamp": "00:00:46.276", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_654", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:00:46.633", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 2125823, "entry_point": 1703936, "filename": "\\Windows\\System32\\locale.nls", "id": "region_655", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1703936, "timestamp": "00:00:46.633", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 1957494784, "type": "region", "version": 1 }, "end_va": 1957564415, "entry_point": 1957494784, "filename": "\\Windows\\SysWOW64\\cryptdll.dll", "id": "region_656", "name": "cryptdll.dll", "norm_filename": "c:\\windows\\syswow64\\cryptdll.dll", "region_type": "memory_mapped_file", "start_va": 1957494784, "timestamp": "00:00:46.634", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 241664, "start_va": 1957625856, "type": "region", "version": 1 }, "end_va": 1957867519, "entry_point": 1957625856, "filename": "\\Windows\\SysWOW64\\clusapi.dll", "id": "region_657", "name": "clusapi.dll", "norm_filename": "c:\\windows\\syswow64\\clusapi.dll", "region_type": "memory_mapped_file", "start_va": 1957625856, "timestamp": "00:00:46.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 81920, "start_va": 1957888000, "type": "region", "version": 1 }, "end_va": 1957969919, "entry_point": 1957888000, "filename": "\\Windows\\SysWOW64\\resutils.dll", "id": "region_658", "name": "resutils.dll", "norm_filename": "c:\\windows\\syswow64\\resutils.dll", "region_type": "memory_mapped_file", "start_va": 1957888000, "timestamp": "00:00:46.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1269760, "start_va": 1958019072, "type": "region", "version": 1 }, "end_va": 1959288831, "entry_point": 1958019072, "filename": "\\Windows\\SysWOW64\\comsvcs.dll", "id": "region_659", "name": "comsvcs.dll", "norm_filename": "c:\\windows\\syswow64\\comsvcs.dll", "region_type": "memory_mapped_file", "start_va": 1958019072, "timestamp": "00:00:46.656", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 352256, "start_va": 1959329792, "type": "region", "version": 1 }, "end_va": 1959682047, "entry_point": 1959329792, "filename": "\\Windows\\SysWOW64\\certcli.dll", "id": "region_660", "name": "certcli.dll", "norm_filename": "c:\\windows\\syswow64\\certcli.dll", "region_type": "memory_mapped_file", "start_va": 1959329792, "timestamp": "00:00:46.675", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 81920, "start_va": 1960706048, "type": "region", "version": 1 }, "end_va": 1960787967, "entry_point": 1960706048, "filename": "\\Windows\\SysWOW64\\atl.dll", "id": "region_661", "name": "atl.dll", "norm_filename": "c:\\windows\\syswow64\\atl.dll", "region_type": "memory_mapped_file", "start_va": 1960706048, "timestamp": "00:00:46.687", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1961885696, "type": "region", "version": 1 }, "end_va": 1961934847, "entry_point": 1961885696, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_662", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1961885696, "timestamp": "00:00:46.700", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1961951232, "type": "region", "version": 1 }, "end_va": 1962344447, "entry_point": 1961951232, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_663", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1961951232, "timestamp": "00:00:46.707", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 1962344448, "type": "region", "version": 1 }, "end_va": 1963769855, "entry_point": 1962344448, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_664", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1962344448, "timestamp": "00:00:46.714", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 1963786240, "type": "region", "version": 1 }, "end_va": 1964429311, "entry_point": 1963786240, "filename": "\\Windows\\SysWOW64\\usp10.dll", "id": "region_665", "name": "usp10.dll", "norm_filename": "c:\\windows\\syswow64\\usp10.dll", "region_type": "memory_mapped_file", "start_va": 1963786240, "timestamp": "00:00:46.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 282624, "start_va": 1964441600, "type": "region", "version": 1 }, "end_va": 1964724223, "entry_point": 1964441600, "filename": "\\Windows\\SysWOW64\\Wldap32.dll", "id": "region_666", "name": "wldap32.dll", "norm_filename": "c:\\windows\\syswow64\\wldap32.dll", "region_type": "memory_mapped_file", "start_va": 1964441600, "timestamp": "00:00:46.932", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1964769280, "type": "region", "version": 1 }, "end_va": 1964810239, "entry_point": 1964769280, "filename": "\\Windows\\SysWOW64\\lpk.dll", "id": "region_667", "name": "lpk.dll", "norm_filename": "c:\\windows\\syswow64\\lpk.dll", "region_type": "memory_mapped_file", "start_va": 1964769280, "timestamp": "00:00:46.941", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 1968111616, "type": "region", "version": 1 }, "end_va": 1968271359, "entry_point": 1968111616, "filename": "\\Windows\\SysWOW64\\cfgmgr32.dll", "id": "region_668", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\syswow64\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 1968111616, "timestamp": "00:00:46.948", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 585728, "start_va": 1968308224, "type": "region", "version": 1 }, "end_va": 1968893951, "entry_point": 1968308224, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_669", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1968308224, "timestamp": "00:00:46.958", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1969029120, "type": "region", "version": 1 }, "end_va": 1969733631, "entry_point": 1969029120, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_670", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1969029120, "timestamp": "00:00:46.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 356352, "start_va": 1970798592, "type": "region", "version": 1 }, "end_va": 1971154943, "entry_point": 1970798592, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_671", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1970798592, "timestamp": "00:00:46.980", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1971191808, "type": "region", "version": 1 }, "end_va": 1972174847, "entry_point": 1971191808, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_672", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1971191808, "timestamp": "00:00:47.044", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1972174848, "type": "region", "version": 1 }, "end_va": 1972223999, "entry_point": 1972174848, "filename": "\\Windows\\SysWOW64\\msasn1.dll", "id": "region_673", "name": "msasn1.dll", "norm_filename": "c:\\windows\\syswow64\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 1972174848, "timestamp": "00:00:47.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12886016, "start_va": 1976500224, "type": "region", "version": 1 }, "end_va": 1989386239, "entry_point": 1976500224, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_674", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1976500224, "timestamp": "00:00:47.089", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 589824, "start_va": 1991376896, "type": "region", "version": 1 }, "end_va": 1991966719, "entry_point": 1991376896, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_675", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1991376896, "timestamp": "00:00:47.817", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1992556544, "type": "region", "version": 1 }, "end_va": 1992658943, "entry_point": 1992556544, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_676", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1992556544, "timestamp": "00:00:47.852", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1167360, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1994444799, "entry_point": 1993277440, "filename": "\\Windows\\SysWOW64\\crypt32.dll", "id": "region_677", "name": "crypt32.dll", "norm_filename": "c:\\windows\\syswow64\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:00:47.860", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1994457088, "type": "region", "version": 1 }, "end_va": 1995505663, "entry_point": 1994457088, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_678", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1994457088, "timestamp": "00:00:47.871", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 655360, "start_va": 1995505664, "type": "region", "version": 1 }, "end_va": 1996161023, "entry_point": 1995505664, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_679", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1995505664, "timestamp": "00:00:47.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_680", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:00:47.978", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_681", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:00:47.978", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000682-addr_0x0000000000810000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_290", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 8454144, "type": "region", "version": 1 }, "end_va": 8519679, "entry_point": 0, "filename": null, "id": "region_682", "name": "private_0x0000000000810000", "norm_filename": null, "region_type": "private_memory", "start_va": 8454144, "timestamp": "00:00:48.008", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 10125311, "entry_point": 0, "filename": null, "id": "region_683", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:00:48.009", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 835584, "start_va": 1965948928, "type": "region", "version": 1 }, "end_va": 1966784511, "entry_point": 1965948928, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_684", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1965948928, "timestamp": "00:00:48.009", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1974730752, "type": "region", "version": 1 }, "end_va": 1975123967, "entry_point": 1974730752, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_685", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1974730752, "timestamp": "00:00:48.018", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000686-addr_0x0000000000020000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_291", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 135167, "entry_point": 0, "filename": null, "id": "region_686", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:00:48.045", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000687-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_292", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_687", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:48.045", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 11735039, "entry_point": 0, "filename": null, "id": "region_688", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:00:48.045", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 11796480, "type": "region", "version": 1 }, "end_va": 32767999, "entry_point": 0, "filename": null, "id": "region_689", "name": "pagefile_0x0000000000b40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11796480, "timestamp": "00:00:48.045", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 2945024, "start_va": 32768000, "type": "region", "version": 1 }, "end_va": 35713023, "entry_point": 32768000, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_690", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 32768000, "timestamp": "00:00:48.045", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1957363712, "type": "region", "version": 1 }, "end_va": 1957474303, "entry_point": 1957363712, "filename": "\\Windows\\SysWOW64\\eappgnui.dll", "id": "region_691", "name": "eappgnui.dll", "norm_filename": "c:\\windows\\syswow64\\eappgnui.dll", "region_type": "memory_mapped_file", "start_va": 1957363712, "timestamp": "00:00:48.096", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000692-addr_0x0000000002210000-size_0x0000000000200000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_293", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 2097152, "start_va": 35717120, "type": "region", "version": 1 }, "end_va": 37814271, "entry_point": 0, "filename": null, "id": "region_692", "name": "private_0x0000000002210000", "norm_filename": null, "region_type": "private_memory", "start_va": 35717120, "timestamp": "00:00:48.133", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000725-addr_0x0000000000210000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_318", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 2162688, "type": "region", "version": 1 }, "end_va": 2424831, "entry_point": 0, "filename": null, "id": "region_725", "name": "private_0x0000000000210000", "norm_filename": null, "region_type": "private_memory", "start_va": 2162688, "timestamp": "00:01:18.575", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000726-addr_0x00000000006d0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_319", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 7143424, "type": "region", "version": 1 }, "end_va": 8191999, "entry_point": 0, "filename": null, "id": "region_726", "name": "private_0x00000000006d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7143424, "timestamp": "00:01:18.575", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000727-addr_0x000000007efd8000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_320", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130542592, "type": "region", "version": 1 }, "end_va": 2130554879, "entry_point": 0, "filename": null, "id": "region_727", "name": "private_0x000000007efd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130542592, "timestamp": "00:01:18.576", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000728-addr_0x0000000002330000-size_0x0000000000001000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_321", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 36896768, "type": "region", "version": 1 }, "end_va": 36900863, "entry_point": 0, "filename": null, "id": "region_728", "name": "private_0x0000000002330000", "norm_filename": null, "region_type": "private_memory", "start_va": 36896768, "timestamp": "00:01:18.578", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000729-addr_0x00000000023d0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_322", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 37552128, "type": "region", "version": 1 }, "end_va": 37814271, "entry_point": 0, "filename": null, "id": "region_729", "name": "private_0x00000000023d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 37552128, "timestamp": "00:01:18.578", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000730-addr_0x0000000000250000-size_0x0000000000001000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_323", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2424832, "type": "region", "version": 1 }, "end_va": 2428927, "entry_point": 0, "filename": null, "id": "region_730", "name": "private_0x0000000000250000", "norm_filename": null, "region_type": "private_memory", "start_va": 2424832, "timestamp": "00:01:18.603", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000731-addr_0x0000000000310000-size_0x0000000000082000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_324", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 532480, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3743743, "entry_point": 0, "filename": null, "id": "region_731", "name": "private_0x0000000000310000", "norm_filename": null, "region_type": "private_memory", "start_va": 3211264, "timestamp": "00:01:18.603", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 73728, "start_va": 1957232640, "type": "region", "version": 1 }, "end_va": 1957306367, "entry_point": 1957232640, "filename": "\\Windows\\SysWOW64\\mpr.dll", "id": "region_732", "name": "mpr.dll", "norm_filename": "c:\\windows\\syswow64\\mpr.dll", "region_type": "memory_mapped_file", "start_va": 1957232640, "timestamp": "00:01:18.636", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1003520, "start_va": 1975123968, "type": "region", "version": 1 }, "end_va": 1976127487, "entry_point": 1975123968, "filename": "\\Windows\\SysWOW64\\wininet.dll", "id": "region_733", "name": "wininet.dll", "norm_filename": "c:\\windows\\syswow64\\wininet.dll", "region_type": "memory_mapped_file", "start_va": 1975123968, "timestamp": "00:01:18.654", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1269760, "start_va": 1966800896, "type": "region", "version": 1 }, "end_va": 1968070655, "entry_point": 1966800896, "filename": "\\Windows\\SysWOW64\\urlmon.dll", "id": "region_734", "name": "urlmon.dll", "norm_filename": "c:\\windows\\syswow64\\urlmon.dll", "region_type": "memory_mapped_file", "start_va": 1966800896, "timestamp": "00:01:18.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2076672, "start_va": 1972240384, "type": "region", "version": 1 }, "end_va": 1974317055, "entry_point": 1972240384, "filename": "\\Windows\\SysWOW64\\iertutil.dll", "id": "region_735", "name": "iertutil.dll", "norm_filename": "c:\\windows\\syswow64\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 1972240384, "timestamp": "00:01:18.680", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 1957101568, "type": "region", "version": 1 }, "end_va": 1957171199, "entry_point": 1957101568, "filename": "\\Windows\\SysWOW64\\netapi32.dll", "id": "region_736", "name": "netapi32.dll", "norm_filename": "c:\\windows\\syswow64\\netapi32.dll", "region_type": "memory_mapped_file", "start_va": 1957101568, "timestamp": "00:01:18.707", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 36864, "start_va": 1960640512, "type": "region", "version": 1 }, "end_va": 1960677375, "entry_point": 1960640512, "filename": "\\Windows\\SysWOW64\\netutils.dll", "id": "region_737", "name": "netutils.dll", "norm_filename": "c:\\windows\\syswow64\\netutils.dll", "region_type": "memory_mapped_file", "start_va": 1960640512, "timestamp": "00:01:18.733", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1956970496, "type": "region", "version": 1 }, "end_va": 1957072895, "entry_point": 1956970496, "filename": "\\Windows\\SysWOW64\\srvcli.dll", "id": "region_738", "name": "srvcli.dll", "norm_filename": "c:\\windows\\syswow64\\srvcli.dll", "region_type": "memory_mapped_file", "start_va": 1956970496, "timestamp": "00:01:18.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1956904960, "type": "region", "version": 1 }, "end_va": 1956966399, "entry_point": 1956904960, "filename": "\\Windows\\SysWOW64\\wkscli.dll", "id": "region_739", "name": "wkscli.dll", "norm_filename": "c:\\windows\\syswow64\\wkscli.dll", "region_type": "memory_mapped_file", "start_va": 1956904960, "timestamp": "00:01:18.773", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 36864, "start_va": 1956839424, "type": "region", "version": 1 }, "end_va": 1956876287, "entry_point": 1956839424, "filename": "\\Windows\\SysWOW64\\dsrole.dll", "id": "region_740", "name": "dsrole.dll", "norm_filename": "c:\\windows\\syswow64\\dsrole.dll", "region_type": "memory_mapped_file", "start_va": 1956839424, "timestamp": "00:01:18.796", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000741-addr_0x0000000000570000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_325", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 5701632, "type": "region", "version": 1 }, "end_va": 5767167, "entry_point": 0, "filename": null, "id": "region_741", "name": "private_0x0000000000570000", "norm_filename": null, "region_type": "private_memory", "start_va": 5701632, "timestamp": "00:01:18.809", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000742-addr_0x0000000000260000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_326", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2490368, "type": "region", "version": 1 }, "end_va": 2494463, "entry_point": 0, "filename": null, "id": "region_742", "name": "private_0x0000000000260000", "norm_filename": null, "region_type": "private_memory", "start_va": 2490368, "timestamp": "00:01:18.823", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000743-addr_0x0000000000270000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_327", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 2555904, "type": "region", "version": 1 }, "end_va": 2584575, "entry_point": 0, "filename": null, "id": "region_743", "name": "private_0x0000000000270000", "norm_filename": null, "region_type": "private_memory", "start_va": 2555904, "timestamp": "00:01:18.823", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 1956708352, "type": "region", "version": 1 }, "end_va": 1956798463, "entry_point": 1956708352, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_767", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1956708352, "timestamp": "00:01:28.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 245760, "start_va": 3801088, "type": "region", "version": 1 }, "end_va": 4046847, "entry_point": 3801088, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_768", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 3801088, "timestamp": "00:01:28.888", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 245760, "start_va": 3801088, "type": "region", "version": 1 }, "end_va": 4046847, "entry_point": 3805837, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_769", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 3801088, "timestamp": "00:01:28.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 241664, "start_va": 1956446208, "type": "region", "version": 1 }, "end_va": 1956687871, "entry_point": 1956450957, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_773", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1956446208, "timestamp": "00:01:28.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 135168, "start_va": 1956249600, "type": "region", "version": 1 }, "end_va": 1956384767, "entry_point": 1956249600, "filename": "\\Windows\\SysWOW64\\ntmarta.dll", "id": "region_774", "name": "ntmarta.dll", "norm_filename": "c:\\windows\\syswow64\\ntmarta.dll", "region_type": "memory_mapped_file", "start_va": 1956249600, "timestamp": "00:01:28.926", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000775-addr_0x00000000003a0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_328", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 3801088, "type": "region", "version": 1 }, "end_va": 4063231, "entry_point": 0, "filename": null, "id": "region_775", "name": "private_0x00000000003a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3801088, "timestamp": "00:01:28.943", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000776-addr_0x00000000004e0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_329", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5373951, "entry_point": 0, "filename": null, "id": "region_776", "name": "private_0x00000000004e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5111808, "timestamp": "00:01:28.943", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000777-addr_0x0000000000520000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_330", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 5373952, "type": "region", "version": 1 }, "end_va": 5636095, "entry_point": 0, "filename": null, "id": "region_777", "name": "private_0x0000000000520000", "norm_filename": null, "region_type": "private_memory", "start_va": 5373952, "timestamp": "00:01:28.943", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000778-addr_0x0000000000580000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_331", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 5767168, "type": "region", "version": 1 }, "end_va": 6029311, "entry_point": 0, "filename": null, "id": "region_778", "name": "private_0x0000000000580000", "norm_filename": null, "region_type": "private_memory", "start_va": 5767168, "timestamp": "00:01:28.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 524288, "start_va": 1938554880, "type": "region", "version": 1 }, "end_va": 1939079167, "entry_point": 1938554880, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_779", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1938554880, "timestamp": "00:01:28.943", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000780-addr_0x000000007efad000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_332", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130366464, "type": "region", "version": 1 }, "end_va": 2130378751, "entry_point": 0, "filename": null, "id": "region_780", "name": "private_0x000000007efad000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130366464, "timestamp": "00:01:28.955", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000781-addr_0x000000007efd5000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_333", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130530304, "type": "region", "version": 1 }, "end_va": 2130542591, "entry_point": 0, "filename": null, "id": "region_781", "name": "private_0x000000007efd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130530304, "timestamp": "00:01:28.955", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000782-addr_0x0000000002410000-size_0x0000000000170000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_334", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1507328, "start_va": 37814272, "type": "region", "version": 1 }, "end_va": 39321599, "entry_point": 0, "filename": null, "id": "region_782", "name": "private_0x0000000002410000", "norm_filename": null, "region_type": "private_memory", "start_va": 37814272, "timestamp": "00:01:28.958", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 35717120, "type": "region", "version": 1 }, "end_va": 36630527, "entry_point": 0, "filename": null, "id": "region_783", "name": "pagefile_0x0000000002210000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 35717120, "timestamp": "00:01:28.960", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 2490368, "type": "region", "version": 1 }, "end_va": 2498559, "entry_point": 0, "filename": null, "id": "region_784", "name": "pagefile_0x0000000000260000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2490368, "timestamp": "00:01:28.989", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1695744, "start_va": 1953628160, "type": "region", "version": 1 }, "end_va": 1955323903, "entry_point": 1953628160, "filename": "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll", "id": "region_785", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 1953628160, "timestamp": "00:01:28.991", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 2621440, "type": "region", "version": 1 }, "end_va": 2625535, "entry_point": 2621440, "filename": "\\Windows\\WindowsShell.Manifest", "id": "region_786", "name": "windowsshell.manifest", "norm_filename": "c:\\windows\\windowsshell.manifest", "region_type": "memory_mapped_file", "start_va": 2621440, "timestamp": "00:01:29.018", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 4063232, "type": "region", "version": 1 }, "end_va": 4071423, "entry_point": 0, "filename": null, "id": "region_787", "name": "pagefile_0x00000000003e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4063232, "timestamp": "00:01:29.018", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2621440, "type": "region", "version": 1 }, "end_va": 2625535, "entry_point": 0, "filename": null, "id": "region_788", "name": "pagefile_0x0000000000280000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2621440, "timestamp": "00:01:29.022", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 1956184064, "type": "region", "version": 1 }, "end_va": 1956229119, "entry_point": 1956184064, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_789", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1956184064, "timestamp": "00:01:29.025", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 49152, "start_va": 4128768, "type": "region", "version": 1 }, "end_va": 4177919, "entry_point": 4128768, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "id": "region_790", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat", "region_type": "memory_mapped_file", "start_va": 4128768, "timestamp": "00:01:29.034", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 32768, "start_va": 5636096, "type": "region", "version": 1 }, "end_va": 5668863, "entry_point": 5636096, "filename": "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "id": "region_791", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat", "region_type": "memory_mapped_file", "start_va": 5636096, "timestamp": "00:01:29.035", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6029312, "type": "region", "version": 1 }, "end_va": 6094847, "entry_point": 6029312, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "id": "region_792", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat", "region_type": "memory_mapped_file", "start_va": 6029312, "timestamp": "00:01:29.036", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 1991114752, "type": "region", "version": 1 }, "end_va": 1991331839, "entry_point": 1991114752, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_793", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1991114752, "timestamp": "00:01:29.046", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 2000158720, "type": "region", "version": 1 }, "end_va": 2000183295, "entry_point": 2000158720, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_794", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 2000158720, "timestamp": "00:01:29.077", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000795-addr_0x0000000002580000-size_0x0000000000220000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_335", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 2228224, "start_va": 39321600, "type": "region", "version": 1 }, "end_va": 41549823, "entry_point": 0, "filename": null, "id": "region_795", "name": "private_0x0000000002580000", "norm_filename": null, "region_type": "private_memory", "start_va": 39321600, "timestamp": "00:01:29.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1955856384, "type": "region", "version": 1 }, "end_va": 1956134911, "entry_point": 1955856384, "filename": "\\Windows\\SysWOW64\\dnsapi.dll", "id": "region_796", "name": "dnsapi.dll", "norm_filename": "c:\\windows\\syswow64\\dnsapi.dll", "region_type": "memory_mapped_file", "start_va": 1955856384, "timestamp": "00:01:29.120", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000797-addr_0x0000000002340000-size_0x0000000000060000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_336", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 393216, "start_va": 36962304, "type": "region", "version": 1 }, "end_va": 37355519, "entry_point": 0, "filename": null, "id": "region_797", "name": "private_0x0000000002340000", "norm_filename": null, "region_type": "private_memory", "start_va": 36962304, "timestamp": "00:01:29.143", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 1955725312, "type": "region", "version": 1 }, "end_va": 1955839999, "entry_point": 1955725312, "filename": "\\Windows\\SysWOW64\\IPHLPAPI.DLL", "id": "region_798", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\syswow64\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 1955725312, "timestamp": "00:01:29.157", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1955659776, "type": "region", "version": 1 }, "end_va": 1955688447, "entry_point": 1955659776, "filename": "\\Windows\\SysWOW64\\winnsi.dll", "id": "region_799", "name": "winnsi.dll", "norm_filename": "c:\\windows\\syswow64\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 1955659776, "timestamp": "00:01:29.182", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000800-addr_0x00000000007d0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_337", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 8192000, "type": "region", "version": 1 }, "end_va": 8454143, "entry_point": 0, "filename": null, "id": "region_800", "name": "private_0x00000000007d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 8192000, "timestamp": "00:01:29.273", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000801-addr_0x00000000022f0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_338", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 36634624, "type": "region", "version": 1 }, "end_va": 36896767, "entry_point": 0, "filename": null, "id": "region_801", "name": "private_0x00000000022f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 36634624, "timestamp": "00:01:29.274", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 335872, "start_va": 1953234944, "type": "region", "version": 1 }, "end_va": 1953570815, "entry_point": 1953234944, "filename": "\\Windows\\SysWOW64\\rasapi32.dll", "id": "region_802", "name": "rasapi32.dll", "norm_filename": "c:\\windows\\syswow64\\rasapi32.dll", "region_type": "memory_mapped_file", "start_va": 1953234944, "timestamp": "00:01:29.274", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000803-addr_0x000000007efaa000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_339", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130354176, "type": "region", "version": 1 }, "end_va": 2130366463, "entry_point": 0, "filename": null, "id": "region_803", "name": "private_0x000000007efaa000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130354176, "timestamp": "00:01:29.284", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 86016, "start_va": 1955528704, "type": "region", "version": 1 }, "end_va": 1955614719, "entry_point": 1955528704, "filename": "\\Windows\\SysWOW64\\rasman.dll", "id": "region_804", "name": "rasman.dll", "norm_filename": "c:\\windows\\syswow64\\rasman.dll", "region_type": "memory_mapped_file", "start_va": 1955528704, "timestamp": "00:01:29.297", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 53248, "start_va": 1955463168, "type": "region", "version": 1 }, "end_va": 1955516415, "entry_point": 1955463168, "filename": "\\Windows\\SysWOW64\\rtutils.dll", "id": "region_805", "name": "rtutils.dll", "norm_filename": "c:\\windows\\syswow64\\rtutils.dll", "region_type": "memory_mapped_file", "start_va": 1955463168, "timestamp": "00:01:29.311", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000806-addr_0x0000000002410000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_340", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 37814272, "type": "region", "version": 1 }, "end_va": 38076415, "entry_point": 0, "filename": null, "id": "region_806", "name": "private_0x0000000002410000", "norm_filename": null, "region_type": "private_memory", "start_va": 37814272, "timestamp": "00:01:29.322", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000807-addr_0x0000000002450000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_341", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 38076416, "type": "region", "version": 1 }, "end_va": 38338559, "entry_point": 0, "filename": null, "id": "region_807", "name": "private_0x0000000002450000", "norm_filename": null, "region_type": "private_memory", "start_va": 38076416, "timestamp": "00:01:29.323", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000808-addr_0x0000000002540000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_342", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 39059456, "type": "region", "version": 1 }, "end_va": 39321599, "entry_point": 0, "filename": null, "id": "region_808", "name": "private_0x0000000002540000", "norm_filename": null, "region_type": "private_memory", "start_va": 39059456, "timestamp": "00:01:29.323", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000809-addr_0x0000000002580000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_343", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 39321600, "type": "region", "version": 1 }, "end_va": 40370175, "entry_point": 0, "filename": null, "id": "region_809", "name": "private_0x0000000002580000", "norm_filename": null, "region_type": "private_memory", "start_va": 39321600, "timestamp": "00:01:29.324", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000810-addr_0x0000000002760000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_344", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 41287680, "type": "region", "version": 1 }, "end_va": 41549823, "entry_point": 0, "filename": null, "id": "region_810", "name": "private_0x0000000002760000", "norm_filename": null, "region_type": "private_memory", "start_va": 41287680, "timestamp": "00:01:29.324", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000811-addr_0x000000007efa7000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_345", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130341888, "type": "region", "version": 1 }, "end_va": 2130354175, "entry_point": 0, "filename": null, "id": "region_811", "name": "private_0x000000007efa7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130341888, "timestamp": "00:01:29.325", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000812-addr_0x0000000002340000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_346", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 36962304, "type": "region", "version": 1 }, "end_va": 36966399, "entry_point": 0, "filename": null, "id": "region_812", "name": "private_0x0000000002340000", "norm_filename": null, "region_type": "private_memory", "start_va": 36962304, "timestamp": "00:01:29.328", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000813-addr_0x0000000002360000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_347", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 37093376, "type": "region", "version": 1 }, "end_va": 37355519, "entry_point": 0, "filename": null, "id": "region_813", "name": "private_0x0000000002360000", "norm_filename": null, "region_type": "private_memory", "start_va": 37093376, "timestamp": "00:01:29.328", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 36962304, "type": "region", "version": 1 }, "end_va": 36966399, "entry_point": 0, "filename": null, "id": "region_814", "name": "pagefile_0x0000000002340000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36962304, "timestamp": "00:01:29.329", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1955397632, "type": "region", "version": 1 }, "end_va": 1955422207, "entry_point": 1955397632, "filename": "\\Windows\\SysWOW64\\SensApi.dll", "id": "region_815", "name": "sensapi.dll", "norm_filename": "c:\\windows\\syswow64\\sensapi.dll", "region_type": "memory_mapped_file", "start_va": 1955397632, "timestamp": "00:01:29.339", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 1953169408, "type": "region", "version": 1 }, "end_va": 1953234943, "entry_point": 1953169408, "filename": "\\Windows\\SysWOW64\\nlaapi.dll", "id": "region_816", "name": "nlaapi.dll", "norm_filename": "c:\\windows\\syswow64\\nlaapi.dll", "region_type": "memory_mapped_file", "start_va": 1953169408, "timestamp": "00:01:29.362", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000817-addr_0x0000000002490000-size_0x0000000000050000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_348", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 327680, "start_va": 38338560, "type": "region", "version": 1 }, "end_va": 38666239, "entry_point": 0, "filename": null, "id": "region_817", "name": "private_0x0000000002490000", "norm_filename": null, "region_type": "private_memory", "start_va": 38338560, "timestamp": "00:01:29.373", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000818-addr_0x00000000023a0000-size_0x0000000000030000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_349", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 196608, "start_va": 37355520, "type": "region", "version": 1 }, "end_va": 37552127, "entry_point": 0, "filename": null, "id": "region_818", "name": "private_0x00000000023a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 37355520, "timestamp": "00:01:29.373", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000819-addr_0x00000000027a0000-size_0x00000000001e0000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_350", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1966080, "start_va": 41549824, "type": "region", "version": 1 }, "end_va": 43515903, "entry_point": 0, "filename": null, "id": "region_819", "name": "private_0x00000000027a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 41549824, "timestamp": "00:01:29.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1953103872, "type": "region", "version": 1 }, "end_va": 1953128447, "entry_point": 1953103872, "filename": "\\Windows\\SysWOW64\\rasadhlp.dll", "id": "region_820", "name": "rasadhlp.dll", "norm_filename": "c:\\windows\\syswow64\\rasadhlp.dll", "region_type": "memory_mapped_file", "start_va": 1953103872, "timestamp": "00:01:29.380", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 245760, "start_va": 1952841728, "type": "region", "version": 1 }, "end_va": 1953087487, "entry_point": 1952841728, "filename": "\\Windows\\SysWOW64\\mswsock.dll", "id": "region_821", "name": "mswsock.dll", "norm_filename": "c:\\windows\\syswow64\\mswsock.dll", "region_type": "memory_mapped_file", "start_va": 1952841728, "timestamp": "00:01:29.398", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000822-addr_0x00000000027a0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_351", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 41549824, "type": "region", "version": 1 }, "end_va": 42598399, "entry_point": 0, "filename": null, "id": "region_822", "name": "private_0x00000000027a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 41549824, "timestamp": "00:01:29.416", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20480, "start_va": 1952776192, "type": "region", "version": 1 }, "end_va": 1952796671, "entry_point": 1952776192, "filename": "\\Windows\\SysWOW64\\WSHTCPIP.DLL", "id": "region_823", "name": "wshtcpip.dll", "norm_filename": "c:\\windows\\syswow64\\wshtcpip.dll", "region_type": "memory_mapped_file", "start_va": 1952776192, "timestamp": "00:01:29.424", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 37027840, "type": "region", "version": 1 }, "end_va": 37056511, "entry_point": 0, "filename": null, "id": "region_824", "name": "pagefile_0x0000000002350000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 37027840, "timestamp": "00:01:33.405", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 37355520, "type": "region", "version": 1 }, "end_va": 37363711, "entry_point": 0, "filename": null, "id": "region_825", "name": "pagefile_0x00000000023a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 37355520, "timestamp": "00:01:33.405", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000826-addr_0x00000000023c0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_352", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 37486592, "type": "region", "version": 1 }, "end_va": 37552127, "entry_point": 0, "filename": null, "id": "region_826", "name": "private_0x00000000023c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 37486592, "timestamp": "00:01:33.405", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000827-addr_0x0000000002490000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_353", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 38338560, "type": "region", "version": 1 }, "end_va": 38600703, "entry_point": 0, "filename": null, "id": "region_827", "name": "private_0x0000000002490000", "norm_filename": null, "region_type": "private_memory", "start_va": 38338560, "timestamp": "00:01:33.406", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000828-addr_0x00000000024d0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_354", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 38600704, "type": "region", "version": 1 }, "end_va": 38666239, "entry_point": 0, "filename": null, "id": "region_828", "name": "private_0x00000000024d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 38600704, "timestamp": "00:01:33.406", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000829-addr_0x00000000024e0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_355", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 38666240, "type": "region", "version": 1 }, "end_va": 38928383, "entry_point": 0, "filename": null, "id": "region_829", "name": "private_0x00000000024e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 38666240, "timestamp": "00:01:33.406", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000830-addr_0x00000000028a0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_356", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 42598400, "type": "region", "version": 1 }, "end_va": 43646975, "entry_point": 0, "filename": null, "id": "region_830", "name": "private_0x00000000028a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 42598400, "timestamp": "00:01:33.407", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4141056, "start_va": 43646976, "type": "region", "version": 1 }, "end_va": 47788031, "entry_point": 0, "filename": null, "id": "region_831", "name": "pagefile_0x00000000029a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 43646976, "timestamp": "00:01:33.407", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1952710656, "type": "region", "version": 1 }, "end_va": 1952743423, "entry_point": 1952710656, "filename": "\\Windows\\SysWOW64\\drprov.dll", "id": "region_832", "name": "drprov.dll", "norm_filename": "c:\\windows\\syswow64\\drprov.dll", "region_type": "memory_mapped_file", "start_va": 1952710656, "timestamp": "00:01:33.407", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000002-region_00000833-addr_0x000000007efa4000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_357", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130329600, "type": "region", "version": 1 }, "end_va": 2130341887, "entry_point": 0, "filename": null, "id": "region_833", "name": "private_0x000000007efa4000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130329600, "timestamp": "00:01:33.414", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 167936, "start_va": 1952514048, "type": "region", "version": 1 }, "end_va": 1952681983, "entry_point": 1952514048, "filename": "\\Windows\\SysWOW64\\winsta.dll", "id": "region_834", "name": "winsta.dll", "norm_filename": "c:\\windows\\syswow64\\winsta.dll", "region_type": "memory_mapped_file", "start_va": 1952514048, "timestamp": "00:01:33.423", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 81920, "start_va": 1952382976, "type": "region", "version": 1 }, "end_va": 1952464895, "entry_point": 1952382976, "filename": "\\Windows\\SysWOW64\\ntlanman.dll", "id": "region_835", "name": "ntlanman.dll", "norm_filename": "c:\\windows\\syswow64\\ntlanman.dll", "region_type": "memory_mapped_file", "start_va": 1952382976, "timestamp": "00:01:33.455", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 1952251904, "type": "region", "version": 1 }, "end_va": 1952346111, "entry_point": 1952251904, "filename": "\\Windows\\SysWOW64\\davclnt.dll", "id": "region_836", "name": "davclnt.dll", "norm_filename": "c:\\windows\\syswow64\\davclnt.dll", "region_type": "memory_mapped_file", "start_va": 1952251904, "timestamp": "00:01:33.473", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "taskeng.exe {4E22B586-9520-4D04-A683-CAB40E860F60} S-1-5-18:NT AUTHORITY\\System:Service:", "filename": "c:\\windows\\system32\\taskeng.exe", "id": "proc_3", "image_name": "taskeng.exe", "monitor_reason": "created_scheduled_job", "monitored_id": 3, "origin_monitor_id": 2, "ref_parent_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_2288", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:02:08.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 159743, "entry_point": 0, "filename": null, "id": "region_2289", "name": "pagefile_0x0000000000020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 131072, "timestamp": "00:02:08.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 212991, "entry_point": 0, "filename": null, "id": "region_2290", "name": "pagefile_0x0000000000030000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 196608, "timestamp": "00:02:08.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 266239, "entry_point": 0, "filename": null, "id": "region_2291", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:02:08.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 749567, "entry_point": 327680, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2292", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 327680, "timestamp": "00:02:08.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 786432, "type": "region", "version": 1 }, "end_va": 794623, "entry_point": 0, "filename": null, "id": "region_2293", "name": "pagefile_0x00000000000c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 786432, "timestamp": "00:02:08.497", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 851968, "type": "region", "version": 1 }, "end_va": 856063, "entry_point": 0, "filename": null, "id": "region_2294", "name": "private_0x00000000000d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 851968, "timestamp": "00:02:08.497", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 917504, "type": "region", "version": 1 }, "end_va": 921599, "entry_point": 0, "filename": null, "id": "region_2295", "name": "private_0x00000000000e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 917504, "timestamp": "00:02:08.497", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 983040, "type": "region", "version": 1 }, "end_va": 1507327, "entry_point": 0, "filename": null, "id": "region_2296", "name": "private_0x00000000000f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 983040, "timestamp": "00:02:08.497", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 786432, "start_va": 1507328, "type": "region", "version": 1 }, "end_va": 2293759, "entry_point": 0, "filename": null, "id": "region_2297", "name": "pagefile_0x0000000000170000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1507328, "timestamp": "00:02:08.497", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2297855, "entry_point": 0, "filename": null, "id": "region_2298", "name": "pagefile_0x0000000000230000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2293760, "timestamp": "00:02:08.497", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 2359296, "type": "region", "version": 1 }, "end_va": 2424831, "entry_point": 0, "filename": null, "id": "region_2299", "name": "private_0x0000000000240000", "norm_filename": null, "region_type": "private_memory", "start_va": 2359296, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2555904, "type": "region", "version": 1 }, "end_va": 3604479, "entry_point": 0, "filename": null, "id": "region_2300", "name": "private_0x0000000000270000", "norm_filename": null, "region_type": "private_memory", "start_va": 2555904, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 3604480, "type": "region", "version": 1 }, "end_va": 4653055, "entry_point": 0, "filename": null, "id": "region_2301", "name": "private_0x0000000000370000", "norm_filename": null, "region_type": "private_memory", "start_va": 3604480, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 4653056, "type": "region", "version": 1 }, "end_va": 6258687, "entry_point": 0, "filename": null, "id": "region_2302", "name": "pagefile_0x0000000000470000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4653056, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 6291456, "type": "region", "version": 1 }, "end_va": 7868415, "entry_point": 0, "filename": null, "id": "region_2303", "name": "pagefile_0x0000000000600000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6291456, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4141056, "start_va": 7929856, "type": "region", "version": 1 }, "end_va": 12070911, "entry_point": 0, "filename": null, "id": "region_2304", "name": "pagefile_0x0000000000790000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7929856, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 12124160, "type": "region", "version": 1 }, "end_va": 13172735, "entry_point": 0, "filename": null, "id": "region_2305", "name": "private_0x0000000000b90000", "norm_filename": null, "region_type": "private_memory", "start_va": 12124160, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 13303808, "type": "region", "version": 1 }, "end_va": 13828095, "entry_point": 0, "filename": null, "id": "region_2306", "name": "private_0x0000000000cb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 13303808, "timestamp": "00:02:08.498", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 14024704, "type": "region", "version": 1 }, "end_va": 14548991, "entry_point": 0, "filename": null, "id": "region_2307", "name": "private_0x0000000000d60000", "norm_filename": null, "region_type": "private_memory", "start_va": 14024704, "timestamp": "00:02:08.499", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 15269888, "type": "region", "version": 1 }, "end_va": 15794175, "entry_point": 0, "filename": null, "id": "region_2308", "name": "private_0x0000000000e90000", "norm_filename": null, "region_type": "private_memory", "start_va": 15269888, "timestamp": "00:02:08.499", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 2945024, "start_va": 16711680, "type": "region", "version": 1 }, "end_va": 19656703, "entry_point": 16711680, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_2309", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 16711680, "timestamp": "00:02:08.499", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 19922944, "type": "region", "version": 1 }, "end_va": 20447231, "entry_point": 0, "filename": null, "id": "region_2310", "name": "private_0x0000000001300000", "norm_filename": null, "region_type": "private_memory", "start_va": 19922944, "timestamp": "00:02:08.500", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 22151168, "type": "region", "version": 1 }, "end_va": 22675455, "entry_point": 0, "filename": null, "id": "region_2311", "name": "private_0x0000000001520000", "norm_filename": null, "region_type": "private_memory", "start_va": 22151168, "timestamp": "00:02:08.500", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 22675456, "type": "region", "version": 1 }, "end_va": 23199743, "entry_point": 0, "filename": null, "id": "region_2312", "name": "private_0x00000000015a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 22675456, "timestamp": "00:02:08.500", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 1996268232, "filename": "\\Windows\\System32\\user32.dll", "id": "region_2313", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1996161024, "timestamp": "00:02:08.501", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 1997299360, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_2314", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1997209600, "timestamp": "00:02:08.503", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2315", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:02:08.505", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_2316", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:02:08.506", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_2317", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:02:08.508", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2318", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:02:08.508", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 475136, "start_va": 4291887104, "type": "region", "version": 1 }, "end_va": 4292362239, "entry_point": 4291949644, "filename": "\\Windows\\System32\\taskeng.exe", "id": "region_2319", "name": "taskeng.exe", "norm_filename": "c:\\windows\\system32\\taskeng.exe", "region_type": "memory_mapped_file", "start_va": 4291887104, "timestamp": "00:02:08.508", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 36864, "start_va": 8791608524800, "type": "region", "version": 1 }, "end_va": 8791608561663, "entry_point": 8791608529312, "filename": "\\Windows\\System32\\TSChannel.dll", "id": "region_2320", "name": "tschannel.dll", "norm_filename": "c:\\windows\\system32\\tschannel.dll", "region_type": "memory_mapped_file", "start_va": 8791608524800, "timestamp": "00:02:08.510", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 8791707222016, "type": "region", "version": 1 }, "end_va": 8791707262975, "entry_point": 8791707231756, "filename": "\\Windows\\System32\\ktmw32.dll", "id": "region_2321", "name": "ktmw32.dll", "norm_filename": "c:\\windows\\system32\\ktmw32.dll", "region_type": "memory_mapped_file", "start_va": 8791707222016, "timestamp": "00:02:08.512", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 8791720263680, "type": "region", "version": 1 }, "end_va": 8791720480767, "entry_point": 8791720267876, "filename": "\\Windows\\System32\\xmllite.dll", "id": "region_2322", "name": "xmllite.dll", "norm_filename": "c:\\windows\\system32\\xmllite.dll", "region_type": "memory_mapped_file", "start_va": 8791720263680, "timestamp": "00:02:08.514", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 290816, "start_va": 8791738351616, "type": "region", "version": 1 }, "end_va": 8791738642431, "entry_point": 8791738355812, "filename": "\\Windows\\System32\\rsaenh.dll", "id": "region_2323", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\system32\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 8791738351616, "timestamp": "00:02:08.516", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 8791741497344, "type": "region", "version": 1 }, "end_va": 8791741591551, "entry_point": 8791741510328, "filename": "\\Windows\\System32\\cryptsp.dll", "id": "region_2324", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\system32\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 8791741497344, "timestamp": "00:02:08.518", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 446464, "start_va": 8791743528960, "type": "region", "version": 1 }, "end_va": 8791743975423, "entry_point": 8791743533072, "filename": "\\Windows\\System32\\wevtapi.dll", "id": "region_2325", "name": "wevtapi.dll", "norm_filename": "c:\\windows\\system32\\wevtapi.dll", "region_type": "memory_mapped_file", "start_va": 8791743528960, "timestamp": "00:02:08.520", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 151552, "start_va": 8791747592192, "type": "region", "version": 1 }, "end_va": 8791747743743, "entry_point": 8791747630680, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_2326", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 8791747592192, "timestamp": "00:02:08.521", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 8791747788800, "type": "region", "version": 1 }, "end_va": 8791747850239, "entry_point": 8791747792912, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_2327", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 8791747788800, "timestamp": "00:02:08.523", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 81920, "start_va": 8791748771840, "type": "region", "version": 1 }, "end_va": 8791748853759, "entry_point": 8791748776160, "filename": "\\Windows\\System32\\RpcRtRemote.dll", "id": "region_2328", "name": "rpcrtremote.dll", "norm_filename": "c:\\windows\\system32\\rpcrtremote.dll", "region_type": "memory_mapped_file", "start_va": 8791748771840, "timestamp": "00:02:08.525", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 8791750541312, "type": "region", "version": 1 }, "end_va": 8791750979583, "entry_point": 8791750553824, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_2329", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 8791750541312, "timestamp": "00:02:08.526", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 823296, "start_va": 8791753293824, "type": "region", "version": 1 }, "end_va": 8791754117119, "entry_point": 8791753795700, "filename": "\\Windows\\System32\\usp10.dll", "id": "region_2330", "name": "usp10.dll", "norm_filename": "c:\\windows\\system32\\usp10.dll", "region_type": "memory_mapped_file", "start_va": 8791753293824, "timestamp": "00:02:08.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 880640, "start_va": 8791754145792, "type": "region", "version": 1 }, "end_va": 8791755026431, "entry_point": 8791754158708, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_2331", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 8791754145792, "timestamp": "00:02:08.536", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 897024, "start_va": 8791755063296, "type": "region", "version": 1 }, "end_va": 8791755960319, "entry_point": 8791755196256, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_2332", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 8791755063296, "timestamp": "00:02:08.538", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 188416, "start_va": 8791759978496, "type": "region", "version": 1 }, "end_va": 8791760166911, "entry_point": 8791759982608, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_2333", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 8791759978496, "timestamp": "00:02:08.539", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2109440, "start_va": 8791762665472, "type": "region", "version": 1 }, "end_va": 8791764774911, "entry_point": 8791762809648, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_2334", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 8791762665472, "timestamp": "00:02:08.541", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 626688, "start_va": 8791766728704, "type": "region", "version": 1 }, "end_va": 8791767355391, "entry_point": 8791766735888, "filename": "\\Windows\\System32\\clbcatq.dll", "id": "region_2335", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\system32\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 8791766728704, "timestamp": "00:02:08.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 8791767384064, "type": "region", "version": 1 }, "end_va": 8791767511039, "entry_point": 8791767408872, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_2336", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 8791767384064, "timestamp": "00:02:08.544", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1085440, "start_va": 8791767515136, "type": "region", "version": 1 }, "end_va": 8791768600575, "entry_point": 8791767519332, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_2337", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 8791767515136, "timestamp": "00:02:08.546", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1232896, "start_va": 8791768629248, "type": "region", "version": 1 }, "end_va": 8791769862143, "entry_point": 8791768952144, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_2338", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 8791768629248, "timestamp": "00:02:08.548", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 651264, "start_va": 8791769874432, "type": "region", "version": 1 }, "end_va": 8791770525695, "entry_point": 8791769884064, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_2339", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 8791769874432, "timestamp": "00:02:08.549", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 421888, "start_va": 8791770595328, "type": "region", "version": 1 }, "end_va": 8791771017215, "entry_point": 8791770640444, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_2340", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 8791770595328, "timestamp": "00:02:08.551", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 57344, "start_va": 8791771054080, "type": "region", "version": 1 }, "end_va": 8791771111423, "entry_point": 8791771058304, "filename": "\\Windows\\System32\\lpk.dll", "id": "region_2341", "name": "lpk.dll", "norm_filename": "c:\\windows\\system32\\lpk.dll", "region_type": "memory_mapped_file", "start_va": 8791771054080, "timestamp": "00:02:08.552", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 462848, "start_va": 8791771643904, "type": "region", "version": 1 }, "end_va": 8791772106751, "entry_point": 8791771717152, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_2342", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 8791771643904, "timestamp": "00:02:08.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 8791786455040, "type": "region", "version": 1 }, "end_va": 8791786459135, "entry_point": 8791786455040, "filename": "\\Windows\\System32\\apisetschema.dll", "id": "region_2343", "name": "apisetschema.dll", "norm_filename": "c:\\windows\\system32\\apisetschema.dll", "region_type": "memory_mapped_file", "start_va": 8791786455040, "timestamp": "00:02:08.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092686336, "type": "region", "version": 1 }, "end_va": 8796092694527, "entry_point": 0, "filename": null, "id": "region_2344", "name": "private_0x000007fffffae000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092686336, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 8796092694528, "type": "region", "version": 1 }, "end_va": 8796092837887, "entry_point": 0, "filename": null, "id": "region_2345", "name": "pagefile_0x000007fffffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8796092694528, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092841984, "type": "region", "version": 1 }, "end_va": 8796092850175, "entry_point": 0, "filename": null, "id": "region_2346", "name": "private_0x000007fffffd4000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092841984, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 8796092850176, "type": "region", "version": 1 }, "end_va": 8796092854271, "entry_point": 0, "filename": null, "id": "region_2347", "name": "private_0x000007fffffd6000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092850176, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092858368, "type": "region", "version": 1 }, "end_va": 8796092866559, "entry_point": 0, "filename": null, "id": "region_2348", "name": "private_0x000007fffffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092858368, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092866560, "type": "region", "version": 1 }, "end_va": 8796092874751, "entry_point": 0, "filename": null, "id": "region_2349", "name": "private_0x000007fffffda000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092866560, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092874752, "type": "region", "version": 1 }, "end_va": 8796092882943, "entry_point": 0, "filename": null, "id": "region_2350", "name": "private_0x000007fffffdc000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092874752, "timestamp": "00:02:08.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092882944, "type": "region", "version": 1 }, "end_va": 8796092891135, "entry_point": 0, "filename": null, "id": "region_2351", "name": "private_0x000007fffffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092882944, "timestamp": "00:02:08.562", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "taskeng.exe {A63D8ADE-049B-493D-9EF8-CBCBD23E6074} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:Highest[1]", "filename": "c:\\windows\\system32\\taskeng.exe", "id": "proc_4", "image_name": "taskeng.exe", "monitor_reason": "created_scheduled_job", "monitored_id": 4, "origin_monitor_id": 2, "ref_parent_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_863", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:01:52.793", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 159743, "entry_point": 0, "filename": null, "id": "region_864", "name": "pagefile_0x0000000000020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 131072, "timestamp": "00:01:52.793", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 212991, "entry_point": 0, "filename": null, "id": "region_865", "name": "pagefile_0x0000000000030000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 196608, "timestamp": "00:01:52.793", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 266239, "entry_point": 0, "filename": null, "id": "region_866", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:01:52.793", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 749567, "entry_point": 327680, "filename": "\\Windows\\System32\\locale.nls", "id": "region_867", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 327680, "timestamp": "00:01:52.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 786432, "type": "region", "version": 1 }, "end_va": 794623, "entry_point": 0, "filename": null, "id": "region_868", "name": "pagefile_0x00000000000c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 786432, "timestamp": "00:01:52.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 851968, "type": "region", "version": 1 }, "end_va": 856063, "entry_point": 0, "filename": null, "id": "region_869", "name": "private_0x00000000000d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 851968, "timestamp": "00:01:52.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 917504, "type": "region", "version": 1 }, "end_va": 921599, "entry_point": 0, "filename": null, "id": "region_870", "name": "private_0x00000000000e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 917504, "timestamp": "00:01:52.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 983040, "type": "region", "version": 1 }, "end_va": 1507327, "entry_point": 0, "filename": null, "id": "region_871", "name": "private_0x00000000000f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 983040, "timestamp": "00:01:52.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1507328, "type": "region", "version": 1 }, "end_va": 1511423, "entry_point": 0, "filename": null, "id": "region_872", "name": "pagefile_0x0000000000170000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1507328, "timestamp": "00:01:52.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1638400, "type": "region", "version": 1 }, "end_va": 2162687, "entry_point": 0, "filename": null, "id": "region_873", "name": "private_0x0000000000190000", "norm_filename": null, "region_type": "private_memory", "start_va": 1638400, "timestamp": "00:01:52.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2162688, "type": "region", "version": 1 }, "end_va": 3211263, "entry_point": 0, "filename": null, "id": "region_874", "name": "private_0x0000000000210000", "norm_filename": null, "region_type": "private_memory", "start_va": 2162688, "timestamp": "00:01:52.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 4456447, "entry_point": 0, "filename": null, "id": "region_875", "name": "private_0x0000000000340000", "norm_filename": null, "region_type": "private_memory", "start_va": 3407872, "timestamp": "00:01:52.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 6062079, "entry_point": 0, "filename": null, "id": "region_876", "name": "pagefile_0x0000000000440000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4456448, "timestamp": "00:01:52.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 6422527, "entry_point": 0, "filename": null, "id": "region_877", "name": "private_0x0000000000610000", "norm_filename": null, "region_type": "private_memory", "start_va": 6356992, "timestamp": "00:01:52.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 6422528, "type": "region", "version": 1 }, "end_va": 7999487, "entry_point": 0, "filename": null, "id": "region_878", "name": "pagefile_0x0000000000620000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6422528, "timestamp": "00:01:52.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 8060928, "type": "region", "version": 1 }, "end_va": 29032447, "entry_point": 0, "filename": null, "id": "region_879", "name": "pagefile_0x00000000007b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8060928, "timestamp": "00:01:52.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4141056, "start_va": 29032448, "type": "region", "version": 1 }, "end_va": 33173503, "entry_point": 0, "filename": null, "id": "region_880", "name": "pagefile_0x0000000001bb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 29032448, "timestamp": "00:01:52.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 33751040, "type": "region", "version": 1 }, "end_va": 34275327, "entry_point": 0, "filename": null, "id": "region_881", "name": "private_0x0000000002030000", "norm_filename": null, "region_type": "private_memory", "start_va": 33751040, "timestamp": "00:01:52.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 34930688, "type": "region", "version": 1 }, "end_va": 35454975, "entry_point": 0, "filename": null, "id": "region_882", "name": "private_0x0000000002150000", "norm_filename": null, "region_type": "private_memory", "start_va": 34930688, "timestamp": "00:01:52.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 35454976, "type": "region", "version": 1 }, "end_va": 35979263, "entry_point": 0, "filename": null, "id": "region_883", "name": "private_0x00000000021d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 35454976, "timestamp": "00:01:52.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 35979264, "type": "region", "version": 1 }, "end_va": 37027839, "entry_point": 0, "filename": null, "id": "region_884", "name": "private_0x0000000002250000", "norm_filename": null, "region_type": "private_memory", "start_va": 35979264, "timestamp": "00:01:52.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 37355520, "type": "region", "version": 1 }, "end_va": 37879807, "entry_point": 0, "filename": null, "id": "region_885", "name": "private_0x00000000023a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 37355520, "timestamp": "00:01:52.799", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 2945024, "start_va": 38928384, "type": "region", "version": 1 }, "end_va": 41873407, "entry_point": 38928384, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_886", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 38928384, "timestamp": "00:01:52.799", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 42008576, "type": "region", "version": 1 }, "end_va": 42532863, "entry_point": 0, "filename": null, "id": "region_887", "name": "private_0x0000000002810000", "norm_filename": null, "region_type": "private_memory", "start_va": 42008576, "timestamp": "00:01:52.799", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 42532864, "type": "region", "version": 1 }, "end_va": 43446271, "entry_point": 0, "filename": null, "id": "region_888", "name": "pagefile_0x0000000002890000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 42532864, "timestamp": "00:01:52.800", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 44302336, "type": "region", "version": 1 }, "end_va": 44826623, "entry_point": 0, "filename": null, "id": "region_889", "name": "private_0x0000000002a40000", "norm_filename": null, "region_type": "private_memory", "start_va": 44302336, "timestamp": "00:01:52.800", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 1996268232, "filename": "\\Windows\\System32\\user32.dll", "id": "region_890", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1996161024, "timestamp": "00:01:52.800", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 1997299360, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_891", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1997209600, "timestamp": "00:01:52.801", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_892", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:01:52.801", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_893", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:01:52.801", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_894", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:01:52.802", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_895", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:52.802", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 475136, "start_va": 4291887104, "type": "region", "version": 1 }, "end_va": 4292362239, "entry_point": 4291887104, "filename": "\\Windows\\System32\\taskeng.exe", "id": "region_896", "name": "taskeng.exe", "norm_filename": "c:\\windows\\system32\\taskeng.exe", "region_type": "memory_mapped_file", "start_va": 4291887104, "timestamp": "00:01:52.802", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 36864, "start_va": 8791608524800, "type": "region", "version": 1 }, "end_va": 8791608561663, "entry_point": 8791608524800, "filename": "\\Windows\\System32\\TSChannel.dll", "id": "region_897", "name": "tschannel.dll", "norm_filename": "c:\\windows\\system32\\tschannel.dll", "region_type": "memory_mapped_file", "start_va": 8791608524800, "timestamp": "00:01:52.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 8791707222016, "type": "region", "version": 1 }, "end_va": 8791707262975, "entry_point": 8791707222016, "filename": "\\Windows\\System32\\ktmw32.dll", "id": "region_898", "name": "ktmw32.dll", "norm_filename": "c:\\windows\\system32\\ktmw32.dll", "region_type": "memory_mapped_file", "start_va": 8791707222016, "timestamp": "00:01:52.817", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 8791720263680, "type": "region", "version": 1 }, "end_va": 8791720480767, "entry_point": 8791720267876, "filename": "\\Windows\\System32\\xmllite.dll", "id": "region_899", "name": "xmllite.dll", "norm_filename": "c:\\windows\\system32\\xmllite.dll", "region_type": "memory_mapped_file", "start_va": 8791720263680, "timestamp": "00:01:52.825", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 98304, "start_va": 8791720525824, "type": "region", "version": 1 }, "end_va": 8791720624127, "entry_point": 8791720530224, "filename": "\\Windows\\System32\\dwmapi.dll", "id": "region_900", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\system32\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 8791720525824, "timestamp": "00:01:52.825", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 352256, "start_va": 8791724916736, "type": "region", "version": 1 }, "end_va": 8791725268991, "entry_point": 8791724964800, "filename": "\\Windows\\System32\\uxtheme.dll", "id": "region_901", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\system32\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 8791724916736, "timestamp": "00:01:52.825", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 290816, "start_va": 8791738351616, "type": "region", "version": 1 }, "end_va": 8791738642431, "entry_point": 8791738355812, "filename": "\\Windows\\System32\\rsaenh.dll", "id": "region_902", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\system32\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 8791738351616, "timestamp": "00:01:52.826", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 8791741497344, "type": "region", "version": 1 }, "end_va": 8791741591551, "entry_point": 8791741510328, "filename": "\\Windows\\System32\\cryptsp.dll", "id": "region_903", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\system32\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 8791741497344, "timestamp": "00:01:52.826", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 446464, "start_va": 8791743528960, "type": "region", "version": 1 }, "end_va": 8791743975423, "entry_point": 8791743528960, "filename": "\\Windows\\System32\\wevtapi.dll", "id": "region_904", "name": "wevtapi.dll", "norm_filename": "c:\\windows\\system32\\wevtapi.dll", "region_type": "memory_mapped_file", "start_va": 8791743528960, "timestamp": "00:01:52.827", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 151552, "start_va": 8791747592192, "type": "region", "version": 1 }, "end_va": 8791747743743, "entry_point": 8791747630680, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_905", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 8791747592192, "timestamp": "00:01:52.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 8791747788800, "type": "region", "version": 1 }, "end_va": 8791747850239, "entry_point": 8791747792912, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_906", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 8791747788800, "timestamp": "00:01:52.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 81920, "start_va": 8791748771840, "type": "region", "version": 1 }, "end_va": 8791748853759, "entry_point": 8791748776160, "filename": "\\Windows\\System32\\RpcRtRemote.dll", "id": "region_907", "name": "rpcrtremote.dll", "norm_filename": "c:\\windows\\system32\\rpcrtremote.dll", "region_type": "memory_mapped_file", "start_va": 8791748771840, "timestamp": "00:01:52.845", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 8791750541312, "type": "region", "version": 1 }, "end_va": 8791750979583, "entry_point": 8791750553824, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_908", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 8791750541312, "timestamp": "00:01:52.845", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 823296, "start_va": 8791753293824, "type": "region", "version": 1 }, "end_va": 8791754117119, "entry_point": 8791753795700, "filename": "\\Windows\\System32\\usp10.dll", "id": "region_909", "name": "usp10.dll", "norm_filename": "c:\\windows\\system32\\usp10.dll", "region_type": "memory_mapped_file", "start_va": 8791753293824, "timestamp": "00:01:52.845", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 880640, "start_va": 8791754145792, "type": "region", "version": 1 }, "end_va": 8791755026431, "entry_point": 8791754158708, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_910", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 8791754145792, "timestamp": "00:01:52.846", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 897024, "start_va": 8791755063296, "type": "region", "version": 1 }, "end_va": 8791755960319, "entry_point": 8791755196256, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_911", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 8791755063296, "timestamp": "00:01:52.846", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 188416, "start_va": 8791759978496, "type": "region", "version": 1 }, "end_va": 8791760166911, "entry_point": 8791759982608, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_912", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 8791759978496, "timestamp": "00:01:52.847", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2109440, "start_va": 8791762665472, "type": "region", "version": 1 }, "end_va": 8791764774911, "entry_point": 8791762809648, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_913", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 8791762665472, "timestamp": "00:01:52.847", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 626688, "start_va": 8791766728704, "type": "region", "version": 1 }, "end_va": 8791767355391, "entry_point": 8791766735888, "filename": "\\Windows\\System32\\clbcatq.dll", "id": "region_914", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\system32\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 8791766728704, "timestamp": "00:01:52.848", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 8791767384064, "type": "region", "version": 1 }, "end_va": 8791767511039, "entry_point": 8791767408872, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_915", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 8791767384064, "timestamp": "00:01:52.848", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1085440, "start_va": 8791767515136, "type": "region", "version": 1 }, "end_va": 8791768600575, "entry_point": 8791767519332, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_916", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 8791767515136, "timestamp": "00:01:52.849", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1232896, "start_va": 8791768629248, "type": "region", "version": 1 }, "end_va": 8791769862143, "entry_point": 8791768952144, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_917", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 8791768629248, "timestamp": "00:01:52.849", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 651264, "start_va": 8791769874432, "type": "region", "version": 1 }, "end_va": 8791770525695, "entry_point": 8791769884064, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_918", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 8791769874432, "timestamp": "00:01:52.850", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 421888, "start_va": 8791770595328, "type": "region", "version": 1 }, "end_va": 8791771017215, "entry_point": 8791770640444, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_919", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 8791770595328, "timestamp": "00:01:52.850", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 57344, "start_va": 8791771054080, "type": "region", "version": 1 }, "end_va": 8791771111423, "entry_point": 8791771058304, "filename": "\\Windows\\System32\\lpk.dll", "id": "region_920", "name": "lpk.dll", "norm_filename": "c:\\windows\\system32\\lpk.dll", "region_type": "memory_mapped_file", "start_va": 8791771054080, "timestamp": "00:01:52.851", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 462848, "start_va": 8791771643904, "type": "region", "version": 1 }, "end_va": 8791772106751, "entry_point": 8791771717152, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_921", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 8791771643904, "timestamp": "00:01:52.851", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 8791786455040, "type": "region", "version": 1 }, "end_va": 8791786459135, "entry_point": 8791786455040, "filename": "\\Windows\\System32\\apisetschema.dll", "id": "region_922", "name": "apisetschema.dll", "norm_filename": "c:\\windows\\system32\\apisetschema.dll", "region_type": "memory_mapped_file", "start_va": 8791786455040, "timestamp": "00:01:52.852", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 8796092694528, "type": "region", "version": 1 }, "end_va": 8796092837887, "entry_point": 0, "filename": null, "id": "region_923", "name": "pagefile_0x000007fffffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8796092694528, "timestamp": "00:01:52.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092837888, "type": "region", "version": 1 }, "end_va": 8796092846079, "entry_point": 0, "filename": null, "id": "region_924", "name": "private_0x000007fffffd3000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092837888, "timestamp": "00:01:52.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092846080, "type": "region", "version": 1 }, "end_va": 8796092854271, "entry_point": 0, "filename": null, "id": "region_925", "name": "private_0x000007fffffd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092846080, "timestamp": "00:01:52.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092854272, "type": "region", "version": 1 }, "end_va": 8796092862463, "entry_point": 0, "filename": null, "id": "region_926", "name": "private_0x000007fffffd7000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092854272, "timestamp": "00:01:52.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092862464, "type": "region", "version": 1 }, "end_va": 8796092870655, "entry_point": 0, "filename": null, "id": "region_927", "name": "private_0x000007fffffd9000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092862464, "timestamp": "00:01:52.855", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092870656, "type": "region", "version": 1 }, "end_va": 8796092878847, "entry_point": 0, "filename": null, "id": "region_928", "name": "private_0x000007fffffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092870656, "timestamp": "00:01:52.855", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8796092878848, "type": "region", "version": 1 }, "end_va": 8796092887039, "entry_point": 0, "filename": null, "id": "region_929", "name": "private_0x000007fffffdd000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092878848, "timestamp": "00:01:52.855", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 8796092887040, "type": "region", "version": 1 }, "end_va": 8796092891135, "entry_point": 0, "filename": null, "id": "region_930", "name": "private_0x000007fffffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 8796092887040, "timestamp": "00:01:52.855", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome", "filename": "c:\\program files (x86)\\internet explorer\\iexplore.exe", "id": "proc_5", "image_name": "iexplore.exe", "monitor_reason": "child_process", "monitored_id": 5, "origin_monitor_id": 2, "ref_parent_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000005-region_00000948-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_374", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_948", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:01:53.153", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000949-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_375", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_949", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:53.153", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 266239, "entry_point": 262144, "filename": "\\Windows\\System32\\apisetschema.dll", "id": "region_950", "name": "apisetschema.dll", "norm_filename": "c:\\windows\\system32\\apisetschema.dll", "region_type": "memory_mapped_file", "start_va": 262144, "timestamp": "00:01:53.153", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_951", "name": "pagefile_0x0000000000050000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 327680, "timestamp": "00:01:53.155", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000952-addr_0x0000000000190000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_376", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 1638400, "type": "region", "version": 1 }, "end_va": 1900543, "entry_point": 0, "filename": null, "id": "region_952", "name": "private_0x0000000000190000", "norm_filename": null, "region_type": "private_memory", "start_va": 1638400, "timestamp": "00:01:53.156", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000953-addr_0x0000000000240000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_377", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 2359296, "type": "region", "version": 1 }, "end_va": 3407871, "entry_point": 0, "filename": null, "id": "region_953", "name": "private_0x0000000000240000", "norm_filename": null, "region_type": "private_memory", "start_va": 2359296, "timestamp": "00:01:53.156", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 20185088, "type": "region", "version": 1 }, "end_va": 20865023, "entry_point": 20185088, "filename": "\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "id": "region_954", "name": "iexplore.exe", "norm_filename": "c:\\program files (x86)\\internet explorer\\iexplore.exe", "region_type": "memory_mapped_file", "start_va": 20185088, "timestamp": "00:01:53.156", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_955", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:01:53.162", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1572864, "start_va": 2000355328, "type": "region", "version": 1 }, "end_va": 2001928191, "entry_point": 2000355328, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_956", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 2000355328, "timestamp": "00:01:53.162", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2130378752, "type": "region", "version": 1 }, "end_va": 2130522111, "entry_point": 0, "filename": null, "id": "region_957", "name": "pagefile_0x000000007efb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130378752, "timestamp": "00:01:53.163", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000958-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_378", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130554880, "type": "region", "version": 1 }, "end_va": 2130567167, "entry_point": 0, "filename": null, "id": "region_958", "name": "private_0x000000007efdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130554880, "timestamp": "00:01:53.163", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000959-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_379", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2130567168, "type": "region", "version": 1 }, "end_va": 2130571263, "entry_point": 0, "filename": null, "id": "region_959", "name": "private_0x000000007efde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130567168, "timestamp": "00:01:53.163", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000960-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_380", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2130571264, "type": "region", "version": 1 }, "end_va": 2130575359, "entry_point": 0, "filename": null, "id": "region_960", "name": "private_0x000000007efdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130571264, "timestamp": "00:01:53.163", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16777216, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_961", "name": "private_0x000000007efe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130575360, "timestamp": "00:01:53.164", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000962-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_381", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_962", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:53.164", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8793945538560, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 8796092956671, "entry_point": 0, "filename": null, "id": "region_963", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:01:53.164", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000964-addr_0x00000000004a0000-size_0x0000000000080000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_382", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 524288, "start_va": 4849664, "type": "region", "version": 1 }, "end_va": 5373951, "entry_point": 0, "filename": null, "id": "region_964", "name": "private_0x00000000004a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4849664, "timestamp": "00:01:53.173", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1940389888, "type": "region", "version": 1 }, "end_va": 1940766719, "entry_point": 1940649880, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_965", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1940389888, "timestamp": "00:01:53.173", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 1940783104, "type": "region", "version": 1 }, "end_va": 1941041151, "entry_point": 1940971128, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_966", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1940783104, "timestamp": "00:01:53.174", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1941241856, "type": "region", "version": 1 }, "end_va": 1941274623, "entry_point": 1941250296, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_967", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1941241856, "timestamp": "00:01:53.174", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000968-addr_0x0000000000680000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_383", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 6815744, "type": "region", "version": 1 }, "end_va": 7864319, "entry_point": 0, "filename": null, "id": "region_968", "name": "private_0x0000000000680000", "norm_filename": null, "region_type": "private_memory", "start_va": 6815744, "timestamp": "00:01:53.183", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1114112, "start_va": 1964834816, "type": "region", "version": 1 }, "end_va": 1965948927, "entry_point": 1964913363, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_969", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1964834816, "timestamp": "00:01:53.183", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 286720, "start_va": 1976172544, "type": "region", "version": 1 }, "end_va": 1976459263, "entry_point": 1976202360, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_970", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1976172544, "timestamp": "00:01:53.184", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000971-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_384", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 0, "filename": null, "id": "region_971", "name": "private_0x0000000076fb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1996161024, "timestamp": "00:01:53.184", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000972-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_385", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 0, "filename": null, "id": "region_972", "name": "private_0x00000000770b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1997209600, "timestamp": "00:01:53.185", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_973", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:01:53.201", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 815103, "entry_point": 393216, "filename": "\\Windows\\System32\\locale.nls", "id": "region_974", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 393216, "timestamp": "00:01:53.201", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1961885696, "type": "region", "version": 1 }, "end_va": 1961934847, "entry_point": 1961890017, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_975", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1961885696, "timestamp": "00:01:53.202", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1961951232, "type": "region", "version": 1 }, "end_va": 1962344447, "entry_point": 1962058675, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_976", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1961951232, "timestamp": "00:01:53.202", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 1962344448, "type": "region", "version": 1 }, "end_va": 1963769855, "entry_point": 1962654269, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_977", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1962344448, "timestamp": "00:01:53.203", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 1963786240, "type": "region", "version": 1 }, "end_va": 1964429311, "entry_point": 1963999191, "filename": "\\Windows\\SysWOW64\\usp10.dll", "id": "region_978", "name": "usp10.dll", "norm_filename": "c:\\windows\\syswow64\\usp10.dll", "region_type": "memory_mapped_file", "start_va": 1963786240, "timestamp": "00:01:53.204", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1964769280, "type": "region", "version": 1 }, "end_va": 1964810239, "entry_point": 1964783264, "filename": "\\Windows\\SysWOW64\\lpk.dll", "id": "region_979", "name": "lpk.dll", "norm_filename": "c:\\windows\\syswow64\\lpk.dll", "region_type": "memory_mapped_file", "start_va": 1964769280, "timestamp": "00:01:53.204", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1269760, "start_va": 1966800896, "type": "region", "version": 1 }, "end_va": 1968070655, "entry_point": 1966807861, "filename": "\\Windows\\SysWOW64\\urlmon.dll", "id": "region_980", "name": "urlmon.dll", "norm_filename": "c:\\windows\\syswow64\\urlmon.dll", "region_type": "memory_mapped_file", "start_va": 1966800896, "timestamp": "00:01:53.205", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 585728, "start_va": 1968308224, "type": "region", "version": 1 }, "end_va": 1968893951, "entry_point": 1968324529, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_981", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1968308224, "timestamp": "00:01:53.205", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1969029120, "type": "region", "version": 1 }, "end_va": 1969733631, "entry_point": 1969071218, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_982", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1969029120, "timestamp": "00:01:53.206", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 356352, "start_va": 1970798592, "type": "region", "version": 1 }, "end_va": 1971154943, "entry_point": 1970903974, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_983", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1970798592, "timestamp": "00:01:53.206", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1971191808, "type": "region", "version": 1 }, "end_va": 1972174847, "entry_point": 1971258729, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_984", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1971191808, "timestamp": "00:01:53.207", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1972174848, "type": "region", "version": 1 }, "end_va": 1972223999, "entry_point": 1972183950, "filename": "\\Windows\\SysWOW64\\msasn1.dll", "id": "region_985", "name": "msasn1.dll", "norm_filename": "c:\\windows\\syswow64\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 1972174848, "timestamp": "00:01:53.207", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2076672, "start_va": 1972240384, "type": "region", "version": 1 }, "end_va": 1974317055, "entry_point": 1972249305, "filename": "\\Windows\\SysWOW64\\iertutil.dll", "id": "region_986", "name": "iertutil.dll", "norm_filename": "c:\\windows\\syswow64\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 1972240384, "timestamp": "00:01:53.208", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1003520, "start_va": 1975123968, "type": "region", "version": 1 }, "end_va": 1976127487, "entry_point": 1975130213, "filename": "\\Windows\\SysWOW64\\wininet.dll", "id": "region_987", "name": "wininet.dll", "norm_filename": "c:\\windows\\syswow64\\wininet.dll", "region_type": "memory_mapped_file", "start_va": 1975123968, "timestamp": "00:01:53.208", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12886016, "start_va": 1976500224, "type": "region", "version": 1 }, "end_va": 1989386239, "entry_point": 1977030145, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_988", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1976500224, "timestamp": "00:01:53.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 589824, "start_va": 1991376896, "type": "region", "version": 1 }, "end_va": 1991966719, "entry_point": 1991467843, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_989", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1991376896, "timestamp": "00:01:53.210", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1992556544, "type": "region", "version": 1 }, "end_va": 1992658943, "entry_point": 1992575349, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_990", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1992556544, "timestamp": "00:01:53.210", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1167360, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1994444799, "entry_point": 1993282954, "filename": "\\Windows\\SysWOW64\\crypt32.dll", "id": "region_991", "name": "crypt32.dll", "norm_filename": "c:\\windows\\syswow64\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:01:53.211", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1994457088, "type": "region", "version": 1 }, "end_va": 1995505663, "entry_point": 1994569453, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_992", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1994457088, "timestamp": "00:01:53.211", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 655360, "start_va": 1995505664, "type": "region", "version": 1 }, "end_va": 1996161023, "entry_point": 1995590117, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_993", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1995505664, "timestamp": "00:01:53.212", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_994", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:01:53.212", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_995", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:01:53.213", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 7864320, "type": "region", "version": 1 }, "end_va": 9469951, "entry_point": 0, "filename": null, "id": "region_996", "name": "pagefile_0x0000000000780000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7864320, "timestamp": "00:01:53.217", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000997-addr_0x0000000000920000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_386", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 9568256, "type": "region", "version": 1 }, "end_va": 9633791, "entry_point": 0, "filename": null, "id": "region_997", "name": "private_0x0000000000920000", "norm_filename": null, "region_type": "private_memory", "start_va": 9568256, "timestamp": "00:01:53.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 835584, "start_va": 1965948928, "type": "region", "version": 1 }, "end_va": 1966784511, "entry_point": 1965954699, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_998", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1965948928, "timestamp": "00:01:53.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1974730752, "type": "region", "version": 1 }, "end_va": 1975123967, "entry_point": 1974801807, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_999", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1974730752, "timestamp": "00:01:53.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 159743, "entry_point": 0, "filename": null, "id": "region_1000", "name": "pagefile_0x0000000000020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 131072, "timestamp": "00:01:53.371", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_1001", "name": "pagefile_0x0000000000030000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 196608, "timestamp": "00:01:53.371", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 851968, "type": "region", "version": 1 }, "end_va": 860159, "entry_point": 851968, "filename": "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui", "id": "region_1002", "name": "iexplore.exe.mui", "norm_filename": "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui", "region_type": "memory_mapped_file", "start_va": 851968, "timestamp": "00:01:53.371", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001003-addr_0x00000000000e0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_387", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 917504, "type": "region", "version": 1 }, "end_va": 921599, "entry_point": 0, "filename": null, "id": "region_1003", "name": "private_0x00000000000e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 917504, "timestamp": "00:01:53.399", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001004-addr_0x00000000000f0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_388", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 983040, "type": "region", "version": 1 }, "end_va": 987135, "entry_point": 0, "filename": null, "id": "region_1004", "name": "private_0x00000000000f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 983040, "timestamp": "00:01:53.400", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 9633792, "type": "region", "version": 1 }, "end_va": 11210751, "entry_point": 0, "filename": null, "id": "region_1005", "name": "pagefile_0x0000000000930000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9633792, "timestamp": "00:01:53.400", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 2945024, "start_va": 11272192, "type": "region", "version": 1 }, "end_va": 14217215, "entry_point": 11272192, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1006", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 11272192, "timestamp": "00:01:53.401", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 20905984, "type": "region", "version": 1 }, "end_va": 41877503, "entry_point": 0, "filename": null, "id": "region_1007", "name": "pagefile_0x00000000013f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 20905984, "timestamp": "00:01:53.404", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 11010048, "start_va": 1914568704, "type": "region", "version": 1 }, "end_va": 1925578751, "entry_point": 1914568704, "filename": "\\Windows\\SysWOW64\\ieframe.dll", "id": "region_1008", "name": "ieframe.dll", "norm_filename": "c:\\windows\\syswow64\\ieframe.dll", "region_type": "memory_mapped_file", "start_va": 1914568704, "timestamp": "00:01:53.405", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 245760, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946730495, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\oleacc.dll", "id": "region_1009", "name": "oleacc.dll", "norm_filename": "c:\\windows\\syswow64\\oleacc.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:01:53.451", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20480, "start_va": 1970143232, "type": "region", "version": 1 }, "end_va": 1970163711, "entry_point": 1970143232, "filename": "\\Windows\\SysWOW64\\psapi.dll", "id": "region_1010", "name": "psapi.dll", "norm_filename": "c:\\windows\\syswow64\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 1970143232, "timestamp": "00:01:53.468", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1048576, "type": "region", "version": 1 }, "end_va": 1052671, "entry_point": 1048576, "filename": "\\Windows\\SysWOW64\\oleaccrc.dll", "id": "region_1011", "name": "oleaccrc.dll", "norm_filename": "c:\\windows\\syswow64\\oleaccrc.dll", "region_type": "memory_mapped_file", "start_va": 1048576, "timestamp": "00:01:53.481", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1114112, "type": "region", "version": 1 }, "end_va": 1122303, "entry_point": 0, "filename": null, "id": "region_1012", "name": "pagefile_0x0000000000110000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1114112, "timestamp": "00:01:53.487", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1695744, "start_va": 1953628160, "type": "region", "version": 1 }, "end_va": 1955323903, "entry_point": 1953818293, "filename": "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll", "id": "region_1013", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 1953628160, "timestamp": "00:01:53.487", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1179648, "type": "region", "version": 1 }, "end_va": 1187839, "entry_point": 0, "filename": null, "id": "region_1014", "name": "pagefile_0x0000000000120000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1179648, "timestamp": "00:01:53.503", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1245184, "type": "region", "version": 1 }, "end_va": 1253375, "entry_point": 0, "filename": null, "id": "region_1015", "name": "pagefile_0x0000000000130000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1245184, "timestamp": "00:01:53.503", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1310720, "type": "region", "version": 1 }, "end_va": 1314815, "entry_point": 0, "filename": null, "id": "region_1016", "name": "pagefile_0x0000000000140000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1310720, "timestamp": "00:01:53.503", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 1956184064, "type": "region", "version": 1 }, "end_va": 1956229119, "entry_point": 1956190610, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_1017", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1956184064, "timestamp": "00:01:53.503", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 49152, "start_va": 1376256, "type": "region", "version": 1 }, "end_va": 1425407, "entry_point": 1376256, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "id": "region_1018", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat", "region_type": "memory_mapped_file", "start_va": 1376256, "timestamp": "00:01:53.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 32768, "start_va": 1441792, "type": "region", "version": 1 }, "end_va": 1474559, "entry_point": 1441792, "filename": "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "id": "region_1019", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat", "region_type": "memory_mapped_file", "start_va": 1441792, "timestamp": "00:01:53.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 1507328, "type": "region", "version": 1 }, "end_va": 1572863, "entry_point": 1507328, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "id": "region_1020", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat", "region_type": "memory_mapped_file", "start_va": 1507328, "timestamp": "00:01:53.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 1991114752, "type": "region", "version": 1 }, "end_va": 1991331839, "entry_point": 1991119965, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_1021", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1991114752, "timestamp": "00:01:53.523", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 2000158720, "type": "region", "version": 1 }, "end_va": 2000183295, "entry_point": 2000164738, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_1022", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 2000158720, "timestamp": "00:01:53.523", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1955856384, "type": "region", "version": 1 }, "end_va": 1956134911, "entry_point": 1955947513, "filename": "\\Windows\\SysWOW64\\dnsapi.dll", "id": "region_1023", "name": "dnsapi.dll", "norm_filename": "c:\\windows\\syswow64\\dnsapi.dll", "region_type": "memory_mapped_file", "start_va": 1955856384, "timestamp": "00:01:53.527", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001024-addr_0x0000000000f20000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_389", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 15859712, "type": "region", "version": 1 }, "end_va": 16121855, "entry_point": 0, "filename": null, "id": "region_1024", "name": "private_0x0000000000f20000", "norm_filename": null, "region_type": "private_memory", "start_va": 15859712, "timestamp": "00:01:53.529", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1955659776, "type": "region", "version": 1 }, "end_va": 1955688447, "entry_point": 1955664525, "filename": "\\Windows\\SysWOW64\\winnsi.dll", "id": "region_1025", "name": "winnsi.dll", "norm_filename": "c:\\windows\\syswow64\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 1955659776, "timestamp": "00:01:53.529", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 1955725312, "type": "region", "version": 1 }, "end_va": 1955839999, "entry_point": 1955767345, "filename": "\\Windows\\SysWOW64\\IPHLPAPI.DLL", "id": "region_1026", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\syswow64\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 1955725312, "timestamp": "00:01:53.530", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1572864, "type": "region", "version": 1 }, "end_va": 1576959, "entry_point": 0, "filename": null, "id": "region_1027", "name": "pagefile_0x0000000000180000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1572864, "timestamp": "00:01:53.534", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001028-addr_0x0000000000340000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_390", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 4456447, "entry_point": 0, "filename": null, "id": "region_1028", "name": "private_0x0000000000340000", "norm_filename": null, "region_type": "private_memory", "start_va": 3407872, "timestamp": "00:01:53.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001029-addr_0x00000000005f0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_391", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 6225920, "type": "region", "version": 1 }, "end_va": 6488063, "entry_point": 0, "filename": null, "id": "region_1029", "name": "private_0x00000000005f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6225920, "timestamp": "00:01:53.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001030-addr_0x0000000000fc0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_392", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 16515072, "type": "region", "version": 1 }, "end_va": 17563647, "entry_point": 0, "filename": null, "id": "region_1030", "name": "private_0x0000000000fc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 16515072, "timestamp": "00:01:53.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 536576, "start_va": 1992687616, "type": "region", "version": 1 }, "end_va": 1993224191, "entry_point": 1992696786, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_1031", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1992687616, "timestamp": "00:01:53.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001032-addr_0x000000007efd8000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_393", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130542592, "type": "region", "version": 1 }, "end_va": 2130554879, "entry_point": 0, "filename": null, "id": "region_1032", "name": "private_0x000000007efd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130542592, "timestamp": "00:01:53.536", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 1904639, "entry_point": 0, "filename": null, "id": "region_1033", "name": "pagefile_0x00000000001d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1900544, "timestamp": "00:01:53.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 368640, "start_va": 1946091520, "type": "region", "version": 1 }, "end_va": 1946460159, "entry_point": 1946091520, "filename": "\\Windows\\SysWOW64\\netprofm.dll", "id": "region_1034", "name": "netprofm.dll", "norm_filename": "c:\\windows\\syswow64\\netprofm.dll", "region_type": "memory_mapped_file", "start_va": 1946091520, "timestamp": "00:01:53.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 1953169408, "type": "region", "version": 1 }, "end_va": 1953234943, "entry_point": 1953183937, "filename": "\\Windows\\SysWOW64\\nlaapi.dll", "id": "region_1035", "name": "nlaapi.dll", "norm_filename": "c:\\windows\\syswow64\\nlaapi.dll", "region_type": "memory_mapped_file", "start_va": 1953169408, "timestamp": "00:01:53.584", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001036-addr_0x0000000000210000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_394", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2162688, "type": "region", "version": 1 }, "end_va": 2228223, "entry_point": 0, "filename": null, "id": "region_1036", "name": "private_0x0000000000210000", "norm_filename": null, "region_type": "private_memory", "start_va": 2162688, "timestamp": "00:01:53.604", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001037-addr_0x0000000000460000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_395", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 4587520, "type": "region", "version": 1 }, "end_va": 4849663, "entry_point": 0, "filename": null, "id": "region_1037", "name": "private_0x0000000000460000", "norm_filename": null, "region_type": "private_memory", "start_va": 4587520, "timestamp": "00:01:53.604", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001038-addr_0x0000000000eb0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_396", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 15400960, "type": "region", "version": 1 }, "end_va": 15663103, "entry_point": 0, "filename": null, "id": "region_1038", "name": "private_0x0000000000eb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 15400960, "timestamp": "00:01:53.604", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001039-addr_0x00000000010e0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_397", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 17694720, "type": "region", "version": 1 }, "end_va": 18743295, "entry_point": 0, "filename": null, "id": "region_1039", "name": "private_0x00000000010e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 17694720, "timestamp": "00:01:53.605", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001040-addr_0x0000000002850000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_398", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 42270720, "type": "region", "version": 1 }, "end_va": 43319295, "entry_point": 0, "filename": null, "id": "region_1040", "name": "private_0x0000000002850000", "norm_filename": null, "region_type": "private_memory", "start_va": 42270720, "timestamp": "00:01:53.605", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 1956708352, "type": "region", "version": 1 }, "end_va": 1956798463, "entry_point": 1956720067, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_1041", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1956708352, "timestamp": "00:01:53.605", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001042-addr_0x000000007efad000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_399", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130366464, "type": "region", "version": 1 }, "end_va": 2130378751, "entry_point": 0, "filename": null, "id": "region_1042", "name": "private_0x000000007efad000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130366464, "timestamp": "00:01:53.606", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001043-addr_0x000000007efd5000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_400", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130530304, "type": "region", "version": 1 }, "end_va": 2130542591, "entry_point": 0, "filename": null, "id": "region_1043", "name": "private_0x000000007efd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130530304, "timestamp": "00:01:53.606", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 241664, "start_va": 1956446208, "type": "region", "version": 1 }, "end_va": 1956687871, "entry_point": 1956450957, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_1044", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1956446208, "timestamp": "00:01:53.613", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 57344, "start_va": 1951727616, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951727616, "filename": "\\Windows\\SysWOW64\\RpcRtRemote.dll", "id": "region_1045", "name": "rpcrtremote.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrtremote.dll", "region_type": "memory_mapped_file", "start_va": 1951727616, "timestamp": "00:01:53.623", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001046-addr_0x0000000000630000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_401", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 6488064, "type": "region", "version": 1 }, "end_va": 6750207, "entry_point": 0, "filename": null, "id": "region_1046", "name": "private_0x0000000000630000", "norm_filename": null, "region_type": "private_memory", "start_va": 6488064, "timestamp": "00:01:53.649", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001047-addr_0x0000000000e30000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_402", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 14876672, "type": "region", "version": 1 }, "end_va": 15138815, "entry_point": 0, "filename": null, "id": "region_1047", "name": "private_0x0000000000e30000", "norm_filename": null, "region_type": "private_memory", "start_va": 14876672, "timestamp": "00:01:53.649", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001048-addr_0x0000000002a50000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_403", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 44367872, "type": "region", "version": 1 }, "end_va": 45416447, "entry_point": 0, "filename": null, "id": "region_1048", "name": "private_0x0000000002a50000", "norm_filename": null, "region_type": "private_memory", "start_va": 44367872, "timestamp": "00:01:53.650", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001049-addr_0x0000000002c50000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_404", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 46465024, "type": "region", "version": 1 }, "end_va": 47513599, "entry_point": 0, "filename": null, "id": "region_1049", "name": "private_0x0000000002c50000", "norm_filename": null, "region_type": "private_memory", "start_va": 46465024, "timestamp": "00:01:53.650", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1951662080, "type": "region", "version": 1 }, "end_va": 1951694847, "entry_point": 1951662080, "filename": "\\Windows\\SysWOW64\\npmproxy.dll", "id": "region_1050", "name": "npmproxy.dll", "norm_filename": "c:\\windows\\syswow64\\npmproxy.dll", "region_type": "memory_mapped_file", "start_va": 1951662080, "timestamp": "00:01:53.650", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001051-addr_0x000000007efa7000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_405", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130341888, "type": "region", "version": 1 }, "end_va": 2130354175, "entry_point": 0, "filename": null, "id": "region_1051", "name": "private_0x000000007efa7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130341888, "timestamp": "00:01:53.658", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001052-addr_0x000000007efaa000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_406", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130354176, "type": "region", "version": 1 }, "end_va": 2130366463, "entry_point": 0, "filename": null, "id": "region_1052", "name": "private_0x000000007efaa000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130354176, "timestamp": "00:01:53.658", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 135168, "start_va": 1956249600, "type": "region", "version": 1 }, "end_va": 1956384767, "entry_point": 1956254814, "filename": "\\Windows\\SysWOW64\\ntmarta.dll", "id": "region_1186", "name": "ntmarta.dll", "norm_filename": "c:\\windows\\syswow64\\ntmarta.dll", "region_type": "memory_mapped_file", "start_va": 1956249600, "timestamp": "00:01:53.848", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 282624, "start_va": 1964441600, "type": "region", "version": 1 }, "end_va": 1964724223, "entry_point": 1964446177, "filename": "\\Windows\\SysWOW64\\Wldap32.dll", "id": "region_1187", "name": "wldap32.dll", "norm_filename": "c:\\windows\\syswow64\\wldap32.dll", "region_type": "memory_mapped_file", "start_va": 1964441600, "timestamp": "00:01:53.849", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 36864, "start_va": 1951662080, "type": "region", "version": 1 }, "end_va": 1951698943, "entry_point": 1951662080, "filename": "\\Windows\\SysWOW64\\version.dll", "id": "region_1188", "name": "version.dll", "norm_filename": "c:\\windows\\syswow64\\version.dll", "region_type": "memory_mapped_file", "start_va": 1951662080, "timestamp": "00:01:53.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3420160, "start_va": 47513600, "type": "region", "version": 1 }, "end_va": 50933759, "entry_point": 0, "filename": null, "id": "region_1189", "name": "pagefile_0x0000000002d50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 47513600, "timestamp": "00:01:53.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 245760, "start_va": 1952841728, "type": "region", "version": 1 }, "end_va": 1953087487, "entry_point": 1952846941, "filename": "\\Windows\\SysWOW64\\mswsock.dll", "id": "region_1190", "name": "mswsock.dll", "norm_filename": "c:\\windows\\syswow64\\mswsock.dll", "region_type": "memory_mapped_file", "start_va": 1952841728, "timestamp": "00:01:53.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1970274304, "type": "region", "version": 1 }, "end_va": 1970778111, "entry_point": 1970274304, "filename": "\\Windows\\SysWOW64\\comdlg32.dll", "id": "region_1192", "name": "comdlg32.dll", "norm_filename": "c:\\windows\\syswow64\\comdlg32.dll", "region_type": "memory_mapped_file", "start_va": 1970274304, "timestamp": "00:01:53.894", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001193-addr_0x000000005fff0000-size_0x0000000000010000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_407", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 1610547200, "type": "region", "version": 1 }, "end_va": 1610612735, "entry_point": 0, "filename": null, "id": "region_1193", "name": "private_0x000000005fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1610547200, "timestamp": "00:01:53.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20480, "start_va": 1952776192, "type": "region", "version": 1 }, "end_va": 1952796671, "entry_point": 1952781791, "filename": "\\Windows\\SysWOW64\\WSHTCPIP.DLL", "id": "region_1194", "name": "wshtcpip.dll", "norm_filename": "c:\\windows\\syswow64\\wshtcpip.dll", "region_type": "memory_mapped_file", "start_va": 1952776192, "timestamp": "00:01:53.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1951596544, "type": "region", "version": 1 }, "end_va": 1951621119, "entry_point": 1951596544, "filename": "\\Windows\\SysWOW64\\wship6.dll", "id": "region_1195", "name": "wship6.dll", "norm_filename": "c:\\windows\\syswow64\\wship6.dll", "region_type": "memory_mapped_file", "start_va": 1951596544, "timestamp": "00:01:53.973", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 524288, "start_va": 1938554880, "type": "region", "version": 1 }, "end_va": 1939079167, "entry_point": 1938634697, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_1196", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1938554880, "timestamp": "00:01:53.982", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 18743296, "type": "region", "version": 1 }, "end_va": 19656703, "entry_point": 0, "filename": null, "id": "region_1197", "name": "pagefile_0x00000000011e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 18743296, "timestamp": "00:01:54.103", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001198-addr_0x0000000003280000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_408", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 52953088, "type": "region", "version": 1 }, "end_va": 53215231, "entry_point": 0, "filename": null, "id": "region_1198", "name": "private_0x0000000003280000", "norm_filename": null, "region_type": "private_memory", "start_va": 52953088, "timestamp": "00:01:54.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 1946222592, "type": "region", "version": 1 }, "end_va": 1946431487, "entry_point": 1946222592, "filename": "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll", "id": "region_1199", "name": "sqmapi.dll", "norm_filename": "c:\\program files (x86)\\internet explorer\\sqmapi.dll", "region_type": "memory_mapped_file", "start_va": 1946222592, "timestamp": "00:01:54.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1953103872, "type": "region", "version": 1 }, "end_va": 1953128447, "entry_point": 1953109170, "filename": "\\Windows\\SysWOW64\\rasadhlp.dll", "id": "region_1200", "name": "rasadhlp.dll", "norm_filename": "c:\\windows\\syswow64\\rasadhlp.dll", "region_type": "memory_mapped_file", "start_va": 1953103872, "timestamp": "00:01:54.116", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 1945960448, "type": "region", "version": 1 }, "end_va": 1946189823, "entry_point": 1945960448, "filename": "\\Windows\\SysWOW64\\FWPUCLNT.DLL", "id": "region_1201", "name": "fwpuclnt.dll", "norm_filename": "c:\\windows\\syswow64\\fwpuclnt.dll", "region_type": "memory_mapped_file", "start_va": 1945960448, "timestamp": "00:01:54.155", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1966080, "type": "region", "version": 1 }, "end_va": 1970175, "entry_point": 0, "filename": null, "id": "region_1202", "name": "pagefile_0x00000000001e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1966080, "timestamp": "00:01:54.244", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001203-addr_0x00000000001f0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_409", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2031616, "type": "region", "version": 1 }, "end_va": 2035711, "entry_point": 0, "filename": null, "id": "region_1203", "name": "private_0x00000000001f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2031616, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001204-addr_0x0000000000200000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_410", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2097152, "type": "region", "version": 1 }, "end_va": 2101247, "entry_point": 0, "filename": null, "id": "region_1204", "name": "private_0x0000000000200000", "norm_filename": null, "region_type": "private_memory", "start_va": 2097152, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 2162688, "type": "region", "version": 1 }, "end_va": 2170879, "entry_point": 0, "filename": null, "id": "region_1205", "name": "pagefile_0x0000000000210000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2162688, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 2228224, "type": "region", "version": 1 }, "end_va": 2236415, "entry_point": 0, "filename": null, "id": "region_1206", "name": "pagefile_0x0000000000220000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2228224, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2301951, "entry_point": 0, "filename": null, "id": "region_1207", "name": "pagefile_0x0000000000230000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2293760, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 4460543, "entry_point": 0, "filename": null, "id": "region_1208", "name": "pagefile_0x0000000000440000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4456448, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 450560, "start_va": 5373952, "type": "region", "version": 1 }, "end_va": 5824511, "entry_point": 0, "filename": null, "id": "region_1209", "name": "pagefile_0x0000000000520000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5373952, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 491520, "start_va": 14221312, "type": "region", "version": 1 }, "end_va": 14712831, "entry_point": 0, "filename": null, "id": "region_1210", "name": "pagefile_0x0000000000d90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 14221312, "timestamp": "00:01:54.245", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001211-addr_0x0000000000f60000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_411", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 16121856, "type": "region", "version": 1 }, "end_va": 16383999, "entry_point": 0, "filename": null, "id": "region_1211", "name": "private_0x0000000000f60000", "norm_filename": null, "region_type": "private_memory", "start_va": 16121856, "timestamp": "00:01:54.246", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001212-addr_0x0000000002b70000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_412", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 45547520, "type": "region", "version": 1 }, "end_va": 45809663, "entry_point": 0, "filename": null, "id": "region_1212", "name": "private_0x0000000002b70000", "norm_filename": null, "region_type": "private_memory", "start_va": 45547520, "timestamp": "00:01:54.246", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001213-addr_0x00000000030d0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_413", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 51183616, "type": "region", "version": 1 }, "end_va": 52232191, "entry_point": 0, "filename": null, "id": "region_1213", "name": "private_0x00000000030d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 51183616, "timestamp": "00:01:54.246", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001214-addr_0x0000000003470000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_414", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 54984704, "type": "region", "version": 1 }, "end_va": 55246847, "entry_point": 0, "filename": null, "id": "region_1214", "name": "private_0x0000000003470000", "norm_filename": null, "region_type": "private_memory", "start_va": 54984704, "timestamp": "00:01:54.247", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001215-addr_0x0000000003560000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_415", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 55967744, "type": "region", "version": 1 }, "end_va": 57016319, "entry_point": 0, "filename": null, "id": "region_1215", "name": "private_0x0000000003560000", "norm_filename": null, "region_type": "private_memory", "start_va": 55967744, "timestamp": "00:01:54.247", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1933836288, "type": "region", "version": 1 }, "end_va": 1933914111, "entry_point": 1933843775, "filename": "\\Windows\\SysWOW64\\dwmapi.dll", "id": "region_1216", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\syswow64\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 1933836288, "timestamp": "00:01:54.247", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001217-addr_0x000000007efa1000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_416", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130317312, "type": "region", "version": 1 }, "end_va": 2130329599, "entry_point": 0, "filename": null, "id": "region_1217", "name": "private_0x000000007efa1000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130317312, "timestamp": "00:01:54.248", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001218-addr_0x000000007efa4000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_417", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130329600, "type": "region", "version": 1 }, "end_va": 2130341887, "entry_point": 0, "filename": null, "id": "region_1218", "name": "private_0x000000007efa4000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130329600, "timestamp": "00:01:54.248", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4521984, "type": "region", "version": 1 }, "end_va": 4526079, "entry_point": 0, "filename": null, "id": "region_1219", "name": "pagefile_0x0000000000450000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4521984, "timestamp": "00:01:54.385", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001220-addr_0x0000000002a10000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_418", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 44105728, "type": "region", "version": 1 }, "end_va": 44367871, "entry_point": 0, "filename": null, "id": "region_1220", "name": "private_0x0000000002a10000", "norm_filename": null, "region_type": "private_memory", "start_va": 44105728, "timestamp": "00:01:54.385", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001221-addr_0x0000000003320000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_419", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 53608448, "type": "region", "version": 1 }, "end_va": 54657023, "entry_point": 0, "filename": null, "id": "region_1221", "name": "private_0x0000000003320000", "norm_filename": null, "region_type": "private_memory", "start_va": 53608448, "timestamp": "00:01:54.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 335872, "start_va": 1953234944, "type": "region", "version": 1 }, "end_va": 1953570815, "entry_point": 1953240254, "filename": "\\Windows\\SysWOW64\\rasapi32.dll", "id": "region_1222", "name": "rasapi32.dll", "norm_filename": "c:\\windows\\syswow64\\rasapi32.dll", "region_type": "memory_mapped_file", "start_va": 1953234944, "timestamp": "00:01:54.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 86016, "start_va": 1955528704, "type": "region", "version": 1 }, "end_va": 1955614719, "entry_point": 1955533534, "filename": "\\Windows\\SysWOW64\\rasman.dll", "id": "region_1223", "name": "rasman.dll", "norm_filename": "c:\\windows\\syswow64\\rasman.dll", "region_type": "memory_mapped_file", "start_va": 1955528704, "timestamp": "00:01:54.386", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001224-addr_0x000000007ef9e000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_420", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130305024, "type": "region", "version": 1 }, "end_va": 2130317311, "entry_point": 0, "filename": null, "id": "region_1224", "name": "private_0x000000007ef9e000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130305024, "timestamp": "00:01:54.387", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 53248, "start_va": 1955463168, "type": "region", "version": 1 }, "end_va": 1955516415, "entry_point": 1955468070, "filename": "\\Windows\\SysWOW64\\rtutils.dll", "id": "region_1225", "name": "rtutils.dll", "norm_filename": "c:\\windows\\syswow64\\rtutils.dll", "region_type": "memory_mapped_file", "start_va": 1955463168, "timestamp": "00:01:54.388", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 5832704, "type": "region", "version": 1 }, "end_va": 5836799, "entry_point": 0, "filename": null, "id": "region_1226", "name": "pagefile_0x0000000000590000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5832704, "timestamp": "00:01:54.395", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1955397632, "type": "region", "version": 1 }, "end_va": 1955422207, "entry_point": 1955402330, "filename": "\\Windows\\SysWOW64\\SensApi.dll", "id": "region_1227", "name": "sensapi.dll", "norm_filename": "c:\\windows\\syswow64\\sensapi.dll", "region_type": "memory_mapped_file", "start_va": 1955397632, "timestamp": "00:01:54.395", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001228-addr_0x0000000002960000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_421", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 43384832, "type": "region", "version": 1 }, "end_va": 43646975, "entry_point": 0, "filename": null, "id": "region_1228", "name": "private_0x0000000002960000", "norm_filename": null, "region_type": "private_memory", "start_va": 43384832, "timestamp": "00:01:54.400", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001229-addr_0x0000000003780000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_422", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 58195968, "type": "region", "version": 1 }, "end_va": 59244543, "entry_point": 0, "filename": null, "id": "region_1229", "name": "private_0x0000000003780000", "norm_filename": null, "region_type": "private_memory", "start_va": 58195968, "timestamp": "00:01:54.401", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00001231-addr_0x000000007ef9b000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_423", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130292736, "type": "region", "version": 1 }, "end_va": 2130305023, "entry_point": 0, "filename": null, "id": "region_1231", "name": "private_0x000000007ef9b000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130292736, "timestamp": "00:01:54.401", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 5898240, "type": "region", "version": 1 }, "end_va": 5902335, "entry_point": 0, "filename": null, "id": "region_1232", "name": "pagefile_0x00000000005a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5898240, "timestamp": "00:01:54.415", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "cmd.exe /C del /Q /F \"C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\agraba8.exe\"", "filename": "c:\\windows\\syswow64\\cmd.exe", "id": "proc_8", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 8, "origin_monitor_id": 2, "ref_parent_process": { "ref_id": "proc_2", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_1605", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:01:56.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_1606", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:56.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 266239, "entry_point": 262144, "filename": "\\Windows\\System32\\apisetschema.dll", "id": "region_1607", "name": "apisetschema.dll", "norm_filename": "c:\\windows\\system32\\apisetschema.dll", "region_type": "memory_mapped_file", "start_va": 262144, "timestamp": "00:01:56.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_1608", "name": "pagefile_0x0000000000050000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 327680, "timestamp": "00:01:56.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 397311, "entry_point": 0, "filename": null, "id": "region_1609", "name": "pagefile_0x0000000000060000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 393216, "timestamp": "00:01:56.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 1638400, "type": "region", "version": 1 }, "end_va": 1900543, "entry_point": 0, "filename": null, "id": "region_1610", "name": "private_0x0000000000190000", "norm_filename": null, "region_type": "private_memory", "start_va": 1638400, "timestamp": "00:01:56.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2359296, "type": "region", "version": 1 }, "end_va": 3407871, "entry_point": 0, "filename": null, "id": "region_1611", "name": "private_0x0000000000240000", "norm_filename": null, "region_type": "private_memory", "start_va": 2359296, "timestamp": "00:01:56.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 311296, "start_va": 1252392960, "type": "region", "version": 1 }, "end_va": 1252704255, "entry_point": 1252392960, "filename": "\\Windows\\SysWOW64\\cmd.exe", "id": "region_1612", "name": "cmd.exe", "norm_filename": "c:\\windows\\syswow64\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 1252392960, "timestamp": "00:01:56.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1613", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:01:56.096", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1572864, "start_va": 2000355328, "type": "region", "version": 1 }, "end_va": 2001928191, "entry_point": 2000355328, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1614", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 2000355328, "timestamp": "00:01:56.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2130378752, "type": "region", "version": 1 }, "end_va": 2130522111, "entry_point": 0, "filename": null, "id": "region_1615", "name": "pagefile_0x000000007efb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130378752, "timestamp": "00:01:56.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130554880, "type": "region", "version": 1 }, "end_va": 2130567167, "entry_point": 0, "filename": null, "id": "region_1616", "name": "private_0x000000007efdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130554880, "timestamp": "00:01:56.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2130567168, "type": "region", "version": 1 }, "end_va": 2130571263, "entry_point": 0, "filename": null, "id": "region_1617", "name": "private_0x000000007efde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130567168, "timestamp": "00:01:56.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2130571264, "type": "region", "version": 1 }, "end_va": 2130575359, "entry_point": 0, "filename": null, "id": "region_1618", "name": "private_0x000000007efdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130571264, "timestamp": "00:01:56.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16777216, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_1619", "name": "private_0x000000007efe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130575360, "timestamp": "00:01:56.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1620", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:56.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8793945538560, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 8796092956671, "entry_point": 0, "filename": null, "id": "region_1621", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:01:56.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 4390912, "type": "region", "version": 1 }, "end_va": 4915199, "entry_point": 0, "filename": null, "id": "region_1629", "name": "private_0x0000000000430000", "norm_filename": null, "region_type": "private_memory", "start_va": 4390912, "timestamp": "00:01:56.182", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1940389888, "type": "region", "version": 1 }, "end_va": 1940766719, "entry_point": 1940649880, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_1630", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1940389888, "timestamp": "00:01:56.182", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 1940783104, "type": "region", "version": 1 }, "end_va": 1941041151, "entry_point": 1940971128, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_1631", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1940783104, "timestamp": "00:01:56.183", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1941241856, "type": "region", "version": 1 }, "end_va": 1941274623, "entry_point": 1941250296, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_1632", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1941241856, "timestamp": "00:01:56.183", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_1642", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:01:56.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_1643", "name": "pagefile_0x0000000000020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 131072, "timestamp": "00:01:56.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 458752, "type": "region", "version": 1 }, "end_va": 880639, "entry_point": 458752, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1644", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 458752, "timestamp": "00:01:56.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 5898240, "type": "region", "version": 1 }, "end_va": 6946815, "entry_point": 0, "filename": null, "id": "region_1645", "name": "private_0x00000000005a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5898240, "timestamp": "00:01:56.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 8454144, "type": "region", "version": 1 }, "end_va": 8519679, "entry_point": 0, "filename": null, "id": "region_1646", "name": "private_0x0000000000810000", "norm_filename": null, "region_type": "private_memory", "start_va": 8454144, "timestamp": "00:01:56.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1956904960, "type": "region", "version": 1 }, "end_va": 1956933631, "entry_point": 1956904960, "filename": "\\Windows\\SysWOW64\\winbrand.dll", "id": "region_1647", "name": "winbrand.dll", "norm_filename": "c:\\windows\\syswow64\\winbrand.dll", "region_type": "memory_mapped_file", "start_va": 1956904960, "timestamp": "00:01:56.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1961885696, "type": "region", "version": 1 }, "end_va": 1961934847, "entry_point": 1961890017, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_1648", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1961885696, "timestamp": "00:01:56.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1961951232, "type": "region", "version": 1 }, "end_va": 1962344447, "entry_point": 1962058675, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_1649", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1961951232, "timestamp": "00:01:56.536", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 1963786240, "type": "region", "version": 1 }, "end_va": 1964429311, "entry_point": 1963999191, "filename": "\\Windows\\SysWOW64\\usp10.dll", "id": "region_1650", "name": "usp10.dll", "norm_filename": "c:\\windows\\syswow64\\usp10.dll", "region_type": "memory_mapped_file", "start_va": 1963786240, "timestamp": "00:01:56.538", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1964769280, "type": "region", "version": 1 }, "end_va": 1964810239, "entry_point": 1964783264, "filename": "\\Windows\\SysWOW64\\lpk.dll", "id": "region_1651", "name": "lpk.dll", "norm_filename": "c:\\windows\\syswow64\\lpk.dll", "region_type": "memory_mapped_file", "start_va": 1964769280, "timestamp": "00:01:56.538", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1114112, "start_va": 1964834816, "type": "region", "version": 1 }, "end_va": 1965948927, "entry_point": 1964913363, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_1652", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1964834816, "timestamp": "00:01:56.539", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1969029120, "type": "region", "version": 1 }, "end_va": 1969733631, "entry_point": 1969071218, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_1653", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1969029120, "timestamp": "00:01:56.539", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1971191808, "type": "region", "version": 1 }, "end_va": 1972174847, "entry_point": 1971258729, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_1654", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1971191808, "timestamp": "00:01:56.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 286720, "start_va": 1976172544, "type": "region", "version": 1 }, "end_va": 1976459263, "entry_point": 1976202360, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_1655", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1976172544, "timestamp": "00:01:56.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 589824, "start_va": 1991376896, "type": "region", "version": 1 }, "end_va": 1991966719, "entry_point": 1991467843, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_1656", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1991376896, "timestamp": "00:01:56.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1992556544, "type": "region", "version": 1 }, "end_va": 1992658943, "entry_point": 1992575349, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_1657", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1992556544, "timestamp": "00:01:56.541", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1994457088, "type": "region", "version": 1 }, "end_va": 1995505663, "entry_point": 1994569453, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_1658", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1994457088, "timestamp": "00:01:56.541", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 655360, "start_va": 1995505664, "type": "region", "version": 1 }, "end_va": 1996161023, "entry_point": 1995590117, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_1659", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1995505664, "timestamp": "00:01:56.542", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 0, "filename": null, "id": "region_1660", "name": "private_0x0000000076fb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1996161024, "timestamp": "00:01:56.542", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 0, "filename": null, "id": "region_1661", "name": "private_0x00000000770b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1997209600, "timestamp": "00:01:56.542", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_1662", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:01:56.542", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_1663", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:01:56.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 10125311, "entry_point": 0, "filename": null, "id": "region_1664", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:01:56.580", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 835584, "start_va": 1965948928, "type": "region", "version": 1 }, "end_va": 1966784511, "entry_point": 1965954699, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_1665", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1965948928, "timestamp": "00:01:56.580", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1974730752, "type": "region", "version": 1 }, "end_va": 1975123967, "entry_point": 1974801807, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_1666", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1974730752, "timestamp": "00:01:56.581", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 225279, "entry_point": 0, "filename": null, "id": "region_1667", "name": "pagefile_0x0000000000030000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 196608, "timestamp": "00:01:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 917504, "type": "region", "version": 1 }, "end_va": 925695, "entry_point": 0, "filename": null, "id": "region_1668", "name": "pagefile_0x00000000000e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 917504, "timestamp": "00:01:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 983040, "type": "region", "version": 1 }, "end_va": 987135, "entry_point": 0, "filename": null, "id": "region_1669", "name": "private_0x00000000000f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 983040, "timestamp": "00:01:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1048576, "type": "region", "version": 1 }, "end_va": 1052671, "entry_point": 0, "filename": null, "id": "region_1670", "name": "private_0x0000000000100000", "norm_filename": null, "region_type": "private_memory", "start_va": 1048576, "timestamp": "00:01:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 11735039, "entry_point": 0, "filename": null, "id": "region_1671", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:01:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 11796480, "type": "region", "version": 1 }, "end_va": 32767999, "entry_point": 0, "filename": null, "id": "region_1672", "name": "pagefile_0x0000000000b40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11796480, "timestamp": "00:01:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3420160, "start_va": 32768000, "type": "region", "version": 1 }, "end_va": 36188159, "entry_point": 0, "filename": null, "id": "region_1673", "name": "pagefile_0x0000000001f40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 32768000, "timestamp": "00:01:56.598", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2272 CREDAT:14337", "filename": "c:\\program files (x86)\\internet explorer\\iexplore.exe", "id": "proc_9", "image_name": "iexplore.exe", "monitor_reason": "child_process", "monitored_id": 9, "origin_monitor_id": 5, "ref_parent_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000009-region_00001461-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_502", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_1461", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:01:55.693", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001462-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_503", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_1462", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:55.694", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 266239, "entry_point": 262144, "filename": "\\Windows\\System32\\apisetschema.dll", "id": "region_1463", "name": "apisetschema.dll", "norm_filename": "c:\\windows\\system32\\apisetschema.dll", "region_type": "memory_mapped_file", "start_va": 262144, "timestamp": "00:01:55.694", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 327680, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_1464", "name": "pagefile_0x0000000000050000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 327680, "timestamp": "00:01:55.696", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001465-addr_0x00000000001f0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_504", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 2031616, "type": "region", "version": 1 }, "end_va": 2293759, "entry_point": 0, "filename": null, "id": "region_1465", "name": "private_0x00000000001f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2031616, "timestamp": "00:01:55.696", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001466-addr_0x0000000000340000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_505", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 4456447, "entry_point": 0, "filename": null, "id": "region_1466", "name": "private_0x0000000000340000", "norm_filename": null, "region_type": "private_memory", "start_va": 3407872, "timestamp": "00:01:55.697", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 20185088, "type": "region", "version": 1 }, "end_va": 20865023, "entry_point": 20192410, "filename": "\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "id": "region_1467", "name": "iexplore.exe", "norm_filename": "c:\\program files (x86)\\internet explorer\\iexplore.exe", "region_type": "memory_mapped_file", "start_va": 20185088, "timestamp": "00:01:55.697", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1998389248, "type": "region", "version": 1 }, "end_va": 2000130047, "entry_point": 1998389248, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1468", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998389248, "timestamp": "00:01:55.697", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1572864, "start_va": 2000355328, "type": "region", "version": 1 }, "end_va": 2001928191, "entry_point": 2000355328, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1469", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 2000355328, "timestamp": "00:01:55.698", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2130378752, "type": "region", "version": 1 }, "end_va": 2130522111, "entry_point": 0, "filename": null, "id": "region_1470", "name": "pagefile_0x000000007efb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130378752, "timestamp": "00:01:55.698", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001471-addr_0x000000007efdb000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_506", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2130554880, "type": "region", "version": 1 }, "end_va": 2130567167, "entry_point": 0, "filename": null, "id": "region_1471", "name": "private_0x000000007efdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130554880, "timestamp": "00:01:55.698", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001472-addr_0x000000007efde000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_507", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2130567168, "type": "region", "version": 1 }, "end_va": 2130571263, "entry_point": 0, "filename": null, "id": "region_1472", "name": "private_0x000000007efde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130567168, "timestamp": "00:01:55.699", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001473-addr_0x000000007efdf000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_508", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2130571264, "type": "region", "version": 1 }, "end_va": 2130575359, "entry_point": 0, "filename": null, "id": "region_1473", "name": "private_0x000000007efdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130571264, "timestamp": "00:01:55.699", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16777216, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_1474", "name": "private_0x000000007efe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130575360, "timestamp": "00:01:55.699", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001475-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_509", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1475", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:55.699", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8793945538560, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 8796092956671, "entry_point": 0, "filename": null, "id": "region_1476", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:01:55.699", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001477-addr_0x0000000000590000-size_0x0000000000080000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_510", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 524288, "start_va": 5832704, "type": "region", "version": 1 }, "end_va": 6356991, "entry_point": 0, "filename": null, "id": "region_1477", "name": "private_0x0000000000590000", "norm_filename": null, "region_type": "private_memory", "start_va": 5832704, "timestamp": "00:01:55.704", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1940389888, "type": "region", "version": 1 }, "end_va": 1940766719, "entry_point": 1940649880, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_1478", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1940389888, "timestamp": "00:01:55.704", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 1940783104, "type": "region", "version": 1 }, "end_va": 1941041151, "entry_point": 1940971128, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_1479", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1940783104, "timestamp": "00:01:55.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1941241856, "type": "region", "version": 1 }, "end_va": 1941274623, "entry_point": 1941250296, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_1480", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1941241856, "timestamp": "00:01:55.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_1486", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:01:55.787", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 421888, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 815103, "entry_point": 393216, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1487", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 393216, "timestamp": "00:01:55.787", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001488-addr_0x0000000000760000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_515", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 7733248, "type": "region", "version": 1 }, "end_va": 8781823, "entry_point": 0, "filename": null, "id": "region_1488", "name": "private_0x0000000000760000", "norm_filename": null, "region_type": "private_memory", "start_va": 7733248, "timestamp": "00:01:55.787", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001489-addr_0x0000000000a00000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_516", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 10485760, "type": "region", "version": 1 }, "end_va": 10551295, "entry_point": 0, "filename": null, "id": "region_1489", "name": "private_0x0000000000a00000", "norm_filename": null, "region_type": "private_memory", "start_va": 10485760, "timestamp": "00:01:55.788", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1961885696, "type": "region", "version": 1 }, "end_va": 1961934847, "entry_point": 1961890017, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_1490", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1961885696, "timestamp": "00:01:55.788", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1961951232, "type": "region", "version": 1 }, "end_va": 1962344447, "entry_point": 1962058675, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_1491", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1961951232, "timestamp": "00:01:55.788", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 1962344448, "type": "region", "version": 1 }, "end_va": 1963769855, "entry_point": 1962654269, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_1492", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1962344448, "timestamp": "00:01:55.789", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 1963786240, "type": "region", "version": 1 }, "end_va": 1964429311, "entry_point": 1963999191, "filename": "\\Windows\\SysWOW64\\usp10.dll", "id": "region_1493", "name": "usp10.dll", "norm_filename": "c:\\windows\\syswow64\\usp10.dll", "region_type": "memory_mapped_file", "start_va": 1963786240, "timestamp": "00:01:55.789", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1964769280, "type": "region", "version": 1 }, "end_va": 1964810239, "entry_point": 1964783264, "filename": "\\Windows\\SysWOW64\\lpk.dll", "id": "region_1494", "name": "lpk.dll", "norm_filename": "c:\\windows\\syswow64\\lpk.dll", "region_type": "memory_mapped_file", "start_va": 1964769280, "timestamp": "00:01:55.790", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1114112, "start_va": 1964834816, "type": "region", "version": 1 }, "end_va": 1965948927, "entry_point": 1964913363, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_1495", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1964834816, "timestamp": "00:01:55.790", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1269760, "start_va": 1966800896, "type": "region", "version": 1 }, "end_va": 1968070655, "entry_point": 1966807861, "filename": "\\Windows\\SysWOW64\\urlmon.dll", "id": "region_1496", "name": "urlmon.dll", "norm_filename": "c:\\windows\\syswow64\\urlmon.dll", "region_type": "memory_mapped_file", "start_va": 1966800896, "timestamp": "00:01:55.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 585728, "start_va": 1968308224, "type": "region", "version": 1 }, "end_va": 1968893951, "entry_point": 1968324529, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_1497", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1968308224, "timestamp": "00:01:55.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1969029120, "type": "region", "version": 1 }, "end_va": 1969733631, "entry_point": 1969071218, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_1498", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1969029120, "timestamp": "00:01:55.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 356352, "start_va": 1970798592, "type": "region", "version": 1 }, "end_va": 1971154943, "entry_point": 1970903974, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_1499", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1970798592, "timestamp": "00:01:55.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1971191808, "type": "region", "version": 1 }, "end_va": 1972174847, "entry_point": 1971258729, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_1500", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1971191808, "timestamp": "00:01:55.793", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1972174848, "type": "region", "version": 1 }, "end_va": 1972223999, "entry_point": 1972183950, "filename": "\\Windows\\SysWOW64\\msasn1.dll", "id": "region_1501", "name": "msasn1.dll", "norm_filename": "c:\\windows\\syswow64\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 1972174848, "timestamp": "00:01:55.793", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2076672, "start_va": 1972240384, "type": "region", "version": 1 }, "end_va": 1974317055, "entry_point": 1972249305, "filename": "\\Windows\\SysWOW64\\iertutil.dll", "id": "region_1502", "name": "iertutil.dll", "norm_filename": "c:\\windows\\syswow64\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 1972240384, "timestamp": "00:01:55.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1003520, "start_va": 1975123968, "type": "region", "version": 1 }, "end_va": 1976127487, "entry_point": 1975130213, "filename": "\\Windows\\SysWOW64\\wininet.dll", "id": "region_1503", "name": "wininet.dll", "norm_filename": "c:\\windows\\syswow64\\wininet.dll", "region_type": "memory_mapped_file", "start_va": 1975123968, "timestamp": "00:01:55.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 286720, "start_va": 1976172544, "type": "region", "version": 1 }, "end_va": 1976459263, "entry_point": 1976202360, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_1504", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1976172544, "timestamp": "00:01:55.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 12886016, "start_va": 1976500224, "type": "region", "version": 1 }, "end_va": 1989386239, "entry_point": 1977030145, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_1505", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1976500224, "timestamp": "00:01:55.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 589824, "start_va": 1991376896, "type": "region", "version": 1 }, "end_va": 1991966719, "entry_point": 1991467843, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_1506", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1991376896, "timestamp": "00:01:55.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1992556544, "type": "region", "version": 1 }, "end_va": 1992658943, "entry_point": 1992575349, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_1507", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1992556544, "timestamp": "00:01:55.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1167360, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1994444799, "entry_point": 1993282954, "filename": "\\Windows\\SysWOW64\\crypt32.dll", "id": "region_1508", "name": "crypt32.dll", "norm_filename": "c:\\windows\\syswow64\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:01:55.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1994457088, "type": "region", "version": 1 }, "end_va": 1995505663, "entry_point": 1994569453, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_1509", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1994457088, "timestamp": "00:01:55.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 655360, "start_va": 1995505664, "type": "region", "version": 1 }, "end_va": 1996161023, "entry_point": 1995590117, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_1510", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1995505664, "timestamp": "00:01:55.797", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001511-addr_0x0000000076fb0000-size_0x00000000000fa000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_517", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1024000, "start_va": 1996161024, "type": "region", "version": 1 }, "end_va": 1997185023, "entry_point": 0, "filename": null, "id": "region_1511", "name": "private_0x0000000076fb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1996161024, "timestamp": "00:01:55.798", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001512-addr_0x00000000770b0000-size_0x000000000011f000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_518", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1175552, "start_va": 1997209600, "type": "region", "version": 1 }, "end_va": 1998385151, "entry_point": 0, "filename": null, "id": "region_1512", "name": "private_0x00000000770b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1997209600, "timestamp": "00:01:55.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2130575360, "type": "region", "version": 1 }, "end_va": 2131623935, "entry_point": 0, "filename": null, "id": "region_1513", "name": "pagefile_0x000000007efe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2130575360, "timestamp": "00:01:55.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 15728640, "start_va": 2131623936, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_1514", "name": "private_0x000000007f0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2131623936, "timestamp": "00:01:55.799", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 8781824, "type": "region", "version": 1 }, "end_va": 10387455, "entry_point": 0, "filename": null, "id": "region_1515", "name": "pagefile_0x0000000000860000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8781824, "timestamp": "00:01:55.803", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 835584, "start_va": 1965948928, "type": "region", "version": 1 }, "end_va": 1966784511, "entry_point": 1965954699, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_1516", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1965948928, "timestamp": "00:01:55.803", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 393216, "start_va": 1974730752, "type": "region", "version": 1 }, "end_va": 1975123967, "entry_point": 1974801807, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_1517", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1974730752, "timestamp": "00:01:55.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 28672, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 159743, "entry_point": 0, "filename": null, "id": "region_1518", "name": "pagefile_0x0000000000020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 131072, "timestamp": "00:01:55.816", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_1519", "name": "pagefile_0x0000000000030000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 196608, "timestamp": "00:01:55.816", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 851968, "type": "region", "version": 1 }, "end_va": 860159, "entry_point": 851968, "filename": "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui", "id": "region_1520", "name": "iexplore.exe.mui", "norm_filename": "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui", "region_type": "memory_mapped_file", "start_va": 851968, "timestamp": "00:01:55.816", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001521-addr_0x00000000000e0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_519", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 917504, "type": "region", "version": 1 }, "end_va": 921599, "entry_point": 0, "filename": null, "id": "region_1521", "name": "private_0x00000000000e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 917504, "timestamp": "00:01:55.817", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001522-addr_0x00000000000f0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_520", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 983040, "type": "region", "version": 1 }, "end_va": 987135, "entry_point": 0, "filename": null, "id": "region_1522", "name": "private_0x00000000000f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 983040, "timestamp": "00:01:55.818", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 10551296, "type": "region", "version": 1 }, "end_va": 12128255, "entry_point": 0, "filename": null, "id": "region_1523", "name": "pagefile_0x0000000000a10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10551296, "timestamp": "00:01:55.818", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 2945024, "start_va": 12189696, "type": "region", "version": 1 }, "end_va": 15134719, "entry_point": 12189696, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1524", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 12189696, "timestamp": "00:01:55.818", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 20905984, "type": "region", "version": 1 }, "end_va": 41877503, "entry_point": 0, "filename": null, "id": "region_1525", "name": "pagefile_0x00000000013f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 20905984, "timestamp": "00:01:55.819", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 11010048, "start_va": 1914568704, "type": "region", "version": 1 }, "end_va": 1925578751, "entry_point": 1914596245, "filename": "\\Windows\\SysWOW64\\ieframe.dll", "id": "region_1526", "name": "ieframe.dll", "norm_filename": "c:\\windows\\syswow64\\ieframe.dll", "region_type": "memory_mapped_file", "start_va": 1914568704, "timestamp": "00:01:55.819", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 245760, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946730495, "entry_point": 1946497161, "filename": "\\Windows\\SysWOW64\\oleacc.dll", "id": "region_1527", "name": "oleacc.dll", "norm_filename": "c:\\windows\\syswow64\\oleacc.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:01:55.819", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20480, "start_va": 1970143232, "type": "region", "version": 1 }, "end_va": 1970163711, "entry_point": 1970148408, "filename": "\\Windows\\SysWOW64\\psapi.dll", "id": "region_1528", "name": "psapi.dll", "norm_filename": "c:\\windows\\syswow64\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 1970143232, "timestamp": "00:01:55.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1048576, "type": "region", "version": 1 }, "end_va": 1052671, "entry_point": 1048576, "filename": "\\Windows\\SysWOW64\\oleaccrc.dll", "id": "region_1529", "name": "oleaccrc.dll", "norm_filename": "c:\\windows\\syswow64\\oleaccrc.dll", "region_type": "memory_mapped_file", "start_va": 1048576, "timestamp": "00:01:55.825", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1114112, "type": "region", "version": 1 }, "end_va": 1122303, "entry_point": 0, "filename": null, "id": "region_1530", "name": "pagefile_0x0000000000110000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1114112, "timestamp": "00:01:55.825", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1179648, "type": "region", "version": 1 }, "end_va": 1183743, "entry_point": 0, "filename": null, "id": "region_1531", "name": "pagefile_0x0000000000120000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1179648, "timestamp": "00:01:55.825", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1245184, "type": "region", "version": 1 }, "end_va": 1253375, "entry_point": 0, "filename": null, "id": "region_1532", "name": "pagefile_0x0000000000130000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1245184, "timestamp": "00:01:55.825", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001533-addr_0x0000000000140000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_521", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 1310720, "type": "region", "version": 1 }, "end_va": 1314815, "entry_point": 0, "filename": null, "id": "region_1533", "name": "private_0x0000000000140000", "norm_filename": null, "region_type": "private_memory", "start_va": 1310720, "timestamp": "00:01:55.826", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1695744, "start_va": 1953628160, "type": "region", "version": 1 }, "end_va": 1955323903, "entry_point": 1953818293, "filename": "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll", "id": "region_1534", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 1953628160, "timestamp": "00:01:55.826", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1970274304, "type": "region", "version": 1 }, "end_va": 1970778111, "entry_point": 1970281198, "filename": "\\Windows\\SysWOW64\\comdlg32.dll", "id": "region_1535", "name": "comdlg32.dll", "norm_filename": "c:\\windows\\syswow64\\comdlg32.dll", "region_type": "memory_mapped_file", "start_va": 1970274304, "timestamp": "00:01:55.826", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001536-addr_0x000000005fff0000-size_0x0000000000010000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_522", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 1610547200, "type": "region", "version": 1 }, "end_va": 1610612735, "entry_point": 0, "filename": null, "id": "region_1536", "name": "private_0x000000005fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1610547200, "timestamp": "00:01:55.840", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 1958805504, "type": "region", "version": 1 }, "end_va": 1959022591, "entry_point": 1958805504, "filename": "\\Program Files (x86)\\Internet Explorer\\IEShims.dll", "id": "region_1537", "name": "ieshims.dll", "norm_filename": "c:\\program files (x86)\\internet explorer\\ieshims.dll", "region_type": "memory_mapped_file", "start_va": 1958805504, "timestamp": "00:01:55.840", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1376256, "type": "region", "version": 1 }, "end_va": 1380351, "entry_point": 0, "filename": null, "id": "region_1538", "name": "pagefile_0x0000000000150000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1376256, "timestamp": "00:01:55.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1441792, "type": "region", "version": 1 }, "end_va": 1449983, "entry_point": 0, "filename": null, "id": "region_1539", "name": "pagefile_0x0000000000160000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1441792, "timestamp": "00:01:55.854", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000009-region_00001540-addr_0x00000000002c0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_523", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 2883584, "type": "region", "version": 1 }, "end_va": 3145727, "entry_point": 0, "filename": null, "id": "region_1540", "name": "private_0x00000000002c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2883584, "timestamp": "00:01:55.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 524288, "start_va": 1938554880, "type": "region", "version": 1 }, "end_va": 1939079167, "entry_point": 1938634697, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_1541", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1938554880, "timestamp": "00:01:55.854", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1507328, "type": "region", "version": 1 }, "end_va": 1511423, "entry_point": 0, "filename": null, "id": "region_1542", "name": "private_0x0000000000170000", "norm_filename": null, "region_type": "private_memory", "start_va": 1507328, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 450560, "start_va": 1572864, "type": "region", "version": 1 }, "end_va": 2023423, "entry_point": 0, "filename": null, "id": "region_1543", "name": "pagefile_0x0000000000180000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1572864, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 491520, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2785279, "entry_point": 0, "filename": null, "id": "region_1544", "name": "pagefile_0x0000000000230000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2293760, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 2818048, "type": "region", "version": 1 }, "end_va": 2826239, "entry_point": 0, "filename": null, "id": "region_1545", "name": "pagefile_0x00000000002b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2818048, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 3145728, "type": "region", "version": 1 }, "end_va": 3153919, "entry_point": 0, "filename": null, "id": "region_1546", "name": "pagefile_0x0000000000300000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3145728, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3219455, "entry_point": 0, "filename": null, "id": "region_1547", "name": "pagefile_0x0000000000310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3211264, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 5369855, "entry_point": 0, "filename": null, "id": "region_1548", "name": "pagefile_0x0000000000440000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4456448, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7077888, "type": "region", "version": 1 }, "end_va": 7340031, "entry_point": 0, "filename": null, "id": "region_1549", "name": "private_0x00000000006c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7077888, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 15138816, "type": "region", "version": 1 }, "end_va": 16187391, "entry_point": 0, "filename": null, "id": "region_1550", "name": "private_0x0000000000e70000", "norm_filename": null, "region_type": "private_memory", "start_va": 15138816, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 16646144, "type": "region", "version": 1 }, "end_va": 16908287, "entry_point": 0, "filename": null, "id": "region_1551", "name": "private_0x0000000000fe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 16646144, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 18874368, "type": "region", "version": 1 }, "end_va": 19922943, "entry_point": 0, "filename": null, "id": "region_1552", "name": "private_0x0000000001200000", "norm_filename": null, "region_type": "private_memory", "start_va": 18874368, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 57344, "start_va": 1951727616, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951732277, "filename": "\\Windows\\SysWOW64\\RpcRtRemote.dll", "id": "region_1553", "name": "rpcrtremote.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrtremote.dll", "region_type": "memory_mapped_file", "start_va": 1951727616, "timestamp": "00:01:55.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130530304, "type": "region", "version": 1 }, "end_va": 2130542591, "entry_point": 0, "filename": null, "id": "region_1554", "name": "private_0x000000007efd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130530304, "timestamp": "00:01:55.865", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130542592, "type": "region", "version": 1 }, "end_va": 2130554879, "entry_point": 0, "filename": null, "id": "region_1555", "name": "private_0x000000007efd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130542592, "timestamp": "00:01:55.865", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 6619135, "entry_point": 0, "filename": null, "id": "region_1556", "name": "private_0x0000000000610000", "norm_filename": null, "region_type": "private_memory", "start_va": 6356992, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6619136, "type": "region", "version": 1 }, "end_va": 6881279, "entry_point": 0, "filename": null, "id": "region_1557", "name": "private_0x0000000000650000", "norm_filename": null, "region_type": "private_memory", "start_va": 6619136, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 16908288, "type": "region", "version": 1 }, "end_va": 17956863, "entry_point": 0, "filename": null, "id": "region_1558", "name": "private_0x0000000001020000", "norm_filename": null, "region_type": "private_memory", "start_va": 16908288, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 41943040, "type": "region", "version": 1 }, "end_va": 42205183, "entry_point": 0, "filename": null, "id": "region_1559", "name": "private_0x0000000002800000", "norm_filename": null, "region_type": "private_memory", "start_va": 41943040, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 43057152, "type": "region", "version": 1 }, "end_va": 44105727, "entry_point": 0, "filename": null, "id": "region_1560", "name": "private_0x0000000002910000", "norm_filename": null, "region_type": "private_memory", "start_va": 43057152, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 45154304, "type": "region", "version": 1 }, "end_va": 47251455, "entry_point": 0, "filename": null, "id": "region_1561", "name": "private_0x0000000002b10000", "norm_filename": null, "region_type": "private_memory", "start_va": 45154304, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1933836288, "type": "region", "version": 1 }, "end_va": 1933914111, "entry_point": 1933843775, "filename": "\\Windows\\SysWOW64\\dwmapi.dll", "id": "region_1562", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\syswow64\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 1933836288, "timestamp": "00:01:55.885", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130341888, "type": "region", "version": 1 }, "end_va": 2130354175, "entry_point": 0, "filename": null, "id": "region_1563", "name": "private_0x000000007efa7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130341888, "timestamp": "00:01:55.886", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130354176, "type": "region", "version": 1 }, "end_va": 2130366463, "entry_point": 0, "filename": null, "id": "region_1564", "name": "private_0x000000007efaa000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130354176, "timestamp": "00:01:55.886", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130366464, "type": "region", "version": 1 }, "end_va": 2130378751, "entry_point": 0, "filename": null, "id": "region_1565", "name": "private_0x000000007efad000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130366464, "timestamp": "00:01:55.886", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 1958543360, "type": "region", "version": 1 }, "end_va": 1958752255, "entry_point": 1958548578, "filename": "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll", "id": "region_1566", "name": "sqmapi.dll", "norm_filename": "c:\\program files (x86)\\internet explorer\\sqmapi.dll", "region_type": "memory_mapped_file", "start_va": 1958543360, "timestamp": "00:01:55.889", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 3276800, "type": "region", "version": 1 }, "end_va": 3280895, "entry_point": 0, "filename": null, "id": "region_1567", "name": "pagefile_0x0000000000320000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3276800, "timestamp": "00:01:55.895", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 44105728, "type": "region", "version": 1 }, "end_va": 45154303, "entry_point": 0, "filename": null, "id": "region_1568", "name": "private_0x0000000002a10000", "norm_filename": null, "region_type": "private_memory", "start_va": 44105728, "timestamp": "00:01:55.895", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 536576, "start_va": 1992687616, "type": "region", "version": 1 }, "end_va": 1993224191, "entry_point": 1992696786, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_1569", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1992687616, "timestamp": "00:01:55.895", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 3342336, "type": "region", "version": 1 }, "end_va": 3346431, "entry_point": 0, "filename": null, "id": "region_1570", "name": "pagefile_0x0000000000330000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3342336, "timestamp": "00:01:55.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1003520, "start_va": 1949237248, "type": "region", "version": 1 }, "end_va": 1950240767, "entry_point": 1949306270, "filename": "\\Windows\\SysWOW64\\propsys.dll", "id": "region_1571", "name": "propsys.dll", "norm_filename": "c:\\windows\\syswow64\\propsys.dll", "region_type": "memory_mapped_file", "start_va": 1949237248, "timestamp": "00:01:55.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 135168, "start_va": 1956249600, "type": "region", "version": 1 }, "end_va": 1956384767, "entry_point": 1956254814, "filename": "\\Windows\\SysWOW64\\ntmarta.dll", "id": "region_1572", "name": "ntmarta.dll", "norm_filename": "c:\\windows\\syswow64\\ntmarta.dll", "region_type": "memory_mapped_file", "start_va": 1956249600, "timestamp": "00:01:55.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 282624, "start_va": 1964441600, "type": "region", "version": 1 }, "end_va": 1964724223, "entry_point": 1964446177, "filename": "\\Windows\\SysWOW64\\Wldap32.dll", "id": "region_1573", "name": "wldap32.dll", "norm_filename": "c:\\windows\\syswow64\\wldap32.dll", "region_type": "memory_mapped_file", "start_va": 1964441600, "timestamp": "00:01:55.901", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 126976, "start_va": 5439488, "type": "region", "version": 1 }, "end_va": 5566463, "entry_point": 5439488, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000011.db", "id": "region_1574", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db", "region_type": "memory_mapped_file", "start_va": 5439488, "timestamp": "00:01:55.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5570560, "type": "region", "version": 1 }, "end_va": 5574655, "entry_point": 0, "filename": null, "id": "region_1575", "name": "pagefile_0x0000000000550000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5570560, "timestamp": "00:01:55.944", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 241664, "start_va": 1956446208, "type": "region", "version": 1 }, "end_va": 1956687871, "entry_point": 1956450957, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_1576", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1956446208, "timestamp": "00:01:55.944", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 1956708352, "type": "region", "version": 1 }, "end_va": 1956798463, "entry_point": 1956720067, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_1577", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1956708352, "timestamp": "00:01:55.944", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 16384000, "type": "region", "version": 1 }, "end_va": 16646143, "entry_point": 0, "filename": null, "id": "region_1578", "name": "private_0x0000000000fa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 16384000, "timestamp": "00:01:55.949", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 48168960, "type": "region", "version": 1 }, "end_va": 49217535, "entry_point": 0, "filename": null, "id": "region_1579", "name": "private_0x0000000002df0000", "norm_filename": null, "region_type": "private_memory", "start_va": 48168960, "timestamp": "00:01:55.949", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 1968111616, "type": "region", "version": 1 }, "end_va": 1968271359, "entry_point": 1968134329, "filename": "\\Windows\\SysWOW64\\cfgmgr32.dll", "id": "region_1580", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\syswow64\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 1968111616, "timestamp": "00:01:55.949", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 73728, "start_va": 1968898048, "type": "region", "version": 1 }, "end_va": 1968971775, "entry_point": 1968903233, "filename": "\\Windows\\SysWOW64\\devobj.dll", "id": "region_1581", "name": "devobj.dll", "norm_filename": "c:\\windows\\syswow64\\devobj.dll", "region_type": "memory_mapped_file", "start_va": 1968898048, "timestamp": "00:01:55.949", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1691648, "start_va": 1989410816, "type": "region", "version": 1 }, "end_va": 1991102463, "entry_point": 1989416935, "filename": "\\Windows\\SysWOW64\\setupapi.dll", "id": "region_1582", "name": "setupapi.dll", "norm_filename": "c:\\windows\\syswow64\\setupapi.dll", "region_type": "memory_mapped_file", "start_va": 1989410816, "timestamp": "00:01:55.950", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130329600, "type": "region", "version": 1 }, "end_va": 2130341887, "entry_point": 0, "filename": null, "id": "region_1583", "name": "private_0x000000007efa4000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130329600, "timestamp": "00:01:55.950", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4141056, "start_va": 49217536, "type": "region", "version": 1 }, "end_va": 53358591, "entry_point": 0, "filename": null, "id": "region_1584", "name": "pagefile_0x0000000002ef0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 49217536, "timestamp": "00:01:55.963", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 1956184064, "type": "region", "version": 1 }, "end_va": 1956229119, "entry_point": 1956190610, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_1585", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1956184064, "timestamp": "00:01:55.963", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5373952, "type": "region", "version": 1 }, "end_va": 5378047, "entry_point": 0, "filename": null, "id": "region_1586", "name": "pagefile_0x0000000000520000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5373952, "timestamp": "00:01:56.026", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 8192, "start_va": 5636096, "type": "region", "version": 1 }, "end_va": 5644287, "entry_point": 0, "filename": null, "id": "region_1587", "name": "private_0x0000000000560000", "norm_filename": null, "region_type": "private_memory", "start_va": 5636096, "timestamp": "00:01:56.026", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 5701632, "type": "region", "version": 1 }, "end_va": 5709823, "entry_point": 0, "filename": null, "id": "region_1588", "name": "pagefile_0x0000000000570000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5701632, "timestamp": "00:01:56.026", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 49152, "start_va": 5767168, "type": "region", "version": 1 }, "end_va": 5816319, "entry_point": 5767168, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "id": "region_1589", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat", "region_type": "memory_mapped_file", "start_va": 5767168, "timestamp": "00:01:56.026", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 32768, "start_va": 6881280, "type": "region", "version": 1 }, "end_va": 6914047, "entry_point": 6881280, "filename": "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "id": "region_1590", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat", "region_type": "memory_mapped_file", "start_va": 6881280, "timestamp": "00:01:56.027", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6946816, "type": "region", "version": 1 }, "end_va": 7012351, "entry_point": 6946816, "filename": "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "id": "region_1591", "name": "index.dat", "norm_filename": "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat", "region_type": "memory_mapped_file", "start_va": 6946816, "timestamp": "00:01:56.027", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 18546688, "type": "region", "version": 1 }, "end_va": 18808831, "entry_point": 0, "filename": null, "id": "region_1592", "name": "private_0x00000000011b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 18546688, "timestamp": "00:01:56.028", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 47775744, "type": "region", "version": 1 }, "end_va": 48037887, "entry_point": 0, "filename": null, "id": "region_1593", "name": "private_0x0000000002d90000", "norm_filename": null, "region_type": "private_memory", "start_va": 47775744, "timestamp": "00:01:56.028", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 54984704, "type": "region", "version": 1 }, "end_va": 56033279, "entry_point": 0, "filename": null, "id": "region_1594", "name": "private_0x0000000003470000", "norm_filename": null, "region_type": "private_memory", "start_va": 54984704, "timestamp": "00:01:56.028", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 56229888, "type": "region", "version": 1 }, "end_va": 57278463, "entry_point": 0, "filename": null, "id": "region_1595", "name": "private_0x00000000035a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 56229888, "timestamp": "00:01:56.028", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1945239552, "type": "region", "version": 1 }, "end_va": 1945415679, "entry_point": 1945359358, "filename": "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll", "id": "region_1596", "name": "ieproxy.dll", "norm_filename": "c:\\program files (x86)\\internet explorer\\ieproxy.dll", "region_type": "memory_mapped_file", "start_va": 1945239552, "timestamp": "00:01:56.028", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 1991114752, "type": "region", "version": 1 }, "end_va": 1991331839, "entry_point": 1991119965, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_1597", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1991114752, "timestamp": "00:01:56.028", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 2000158720, "type": "region", "version": 1 }, "end_va": 2000183295, "entry_point": 2000164738, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_1598", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 2000158720, "timestamp": "00:01:56.029", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130305024, "type": "region", "version": 1 }, "end_va": 2130317311, "entry_point": 0, "filename": null, "id": "region_1599", "name": "private_0x000000007ef9e000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130305024, "timestamp": "00:01:56.029", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2130317312, "type": "region", "version": 1 }, "end_va": 2130329599, "entry_point": 0, "filename": null, "id": "region_1600", "name": "private_0x000000007efa1000", "norm_filename": null, "region_type": "private_memory", "start_va": 2130317312, "timestamp": "00:01:56.029", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 58654720, "type": "region", "version": 1 }, "end_va": 58916863, "entry_point": 0, "filename": null, "id": "region_1601", "name": "private_0x00000000037f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 58654720, "timestamp": "00:01:56.036", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1955659776, "type": "region", "version": 1 }, "end_va": 1955688447, "entry_point": 1955664525, "filename": "\\Windows\\SysWOW64\\winnsi.dll", "id": "region_1602", "name": "winnsi.dll", "norm_filename": "c:\\windows\\syswow64\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 1955659776, "timestamp": "00:01:56.036", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 1955725312, "type": "region", "version": 1 }, "end_va": 1955839999, "entry_point": 1955767345, "filename": "\\Windows\\SysWOW64\\IPHLPAPI.DLL", "id": "region_1603", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\syswow64\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 1955725312, "timestamp": "00:01:56.036", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1955856384, "type": "region", "version": 1 }, "end_va": 1956134911, "entry_point": 1955947513, "filename": "\\Windows\\SysWOW64\\dnsapi.dll", "id": "region_1604", "name": "dnsapi.dll", "norm_filename": "c:\\windows\\syswow64\\dnsapi.dll", "region_type": "memory_mapped_file", "start_va": 1955856384, "timestamp": "00:01:56.037", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 7012352, "type": "region", "version": 1 }, "end_va": 7016447, "entry_point": 0, "filename": null, "id": "region_1622", "name": "pagefile_0x00000000006b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7012352, "timestamp": "00:01:56.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 7536640, "type": "region", "version": 1 }, "end_va": 7544831, "entry_point": 0, "filename": null, "id": "region_1623", "name": "private_0x0000000000730000", "norm_filename": null, "region_type": "private_memory", "start_va": 7536640, "timestamp": "00:01:56.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 42598400, "type": "region", "version": 1 }, "end_va": 42860543, "entry_point": 0, "filename": null, "id": "region_1624", "name": "private_0x00000000028a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 42598400, "timestamp": "00:01:56.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 188416, "start_va": 1960640512, "type": "region", "version": 1 }, "end_va": 1960828927, "entry_point": 1960640512, "filename": "\\Windows\\SysWOW64\\mlang.dll", "id": "region_1625", "name": "mlang.dll", "norm_filename": "c:\\windows\\syswow64\\mlang.dll", "region_type": "memory_mapped_file", "start_va": 1960640512, "timestamp": "00:01:56.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 7340032, "type": "region", "version": 1 }, "end_va": 7471103, "entry_point": 0, "filename": null, "id": "region_1626", "name": "private_0x0000000000700000", "norm_filename": null, "region_type": "private_memory", "start_va": 7340032, "timestamp": "00:01:56.168", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 9633792, "start_va": 58916864, "type": "region", "version": 1 }, "end_va": 68550655, "entry_point": 58916864, "filename": "\\Windows\\Fonts\\StaticCache.dat", "id": "region_1627", "name": "staticcache.dat", "norm_filename": "c:\\windows\\fonts\\staticcache.dat", "region_type": "memory_mapped_file", "start_va": 58916864, "timestamp": "00:01:56.168", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 311296, "start_va": 1958477824, "type": "region", "version": 1 }, "end_va": 1958789119, "entry_point": 1958489108, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_1628", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1958477824, "timestamp": "00:01:56.169", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 7471104, "type": "region", "version": 1 }, "end_va": 7475199, "entry_point": 0, "filename": null, "id": "region_1633", "name": "pagefile_0x0000000000720000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7471104, "timestamp": "00:01:56.249", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 581632, "start_va": 1957036032, "type": "region", "version": 1 }, "end_va": 1957617663, "entry_point": 1957036032, "filename": "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll", "id": "region_1634", "name": "msvcp90.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll", "region_type": "memory_mapped_file", "start_va": 1957036032, "timestamp": "00:01:56.249", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 667648, "start_va": 1957625856, "type": "region", "version": 1 }, "end_va": 1958293503, "entry_point": 1957625856, "filename": "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll", "id": "region_1635", "name": "msvcr90.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll", "region_type": "memory_mapped_file", "start_va": 1957625856, "timestamp": "00:01:56.306", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 1958346752, "type": "region", "version": 1 }, "end_va": 1958416383, "entry_point": 1958346752, "filename": "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll", "id": "region_1636", "name": "acroiehelpershim.dll", "norm_filename": "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll", "region_type": "memory_mapped_file", "start_va": 1958346752, "timestamp": "00:01:56.321", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 } ], "remarks": { "critical": [], "non_critical": [ { "comment": "The maximum number of dumps was reached during the analysis. Some memory dumps may be missing in the reports. You can increase the limit in the configuration.", "id": 2048, "type": "remark", "version": 1 }, { "comment": "The dump total size limit was reached during the analysis. Some memory dump may be missing in the reports. You can increase the limit in the configuration.", "id": 512, "type": "remark", "version": 1 }, { "comment": "The overall sleep time of all monitored processes was truncated from 31 seconds to 10 seconds to reveal dormant functionality.", "id": 262144, "type": "remark", "version": 1 } ], "type": "remarks", "version": 1 }, "sample_details": { "filename": "098073.doc", "id": 17444, "md5_hash": "e458cf8ec7484ba8e24650b197d3e234", "sample_type": "word_document", "sha1_hash": "4bd7a1b511c1f33f635ce05045ad66c4cb3840a5", "sha256_hash": "58d2c72e0806714172ed49659b1c967a78de387e5b330850968fb4e823474794", "size": 49622, "type": "sample_details", "version": 1 }, "screenshots": [ { "screenshot_archive_path": "screenshots/screenshot_0.png", "size": 67702, "thumbnail_archive_path": "screenshots/thumbnail_0.png", "timestamp": "00:00:00.000", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_26606.png", "size": 91615, "thumbnail_archive_path": "screenshots/thumbnail_26606.png", "timestamp": "00:00:26.606", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_27605.png", "size": 156485, "thumbnail_archive_path": "screenshots/thumbnail_27605.png", "timestamp": "00:00:27.605", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_29617.png", "size": 153486, "thumbnail_archive_path": "screenshots/thumbnail_29617.png", "timestamp": "00:00:29.617", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_32638.png", "size": 36427, "thumbnail_archive_path": "screenshots/thumbnail_32638.png", "timestamp": "00:00:32.638", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_47983.png", "size": 181838, "thumbnail_archive_path": "screenshots/thumbnail_47983.png", "timestamp": "00:00:47.983", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_48983.png", "size": 58933, "thumbnail_archive_path": "screenshots/thumbnail_48983.png", "timestamp": "00:00:48.983", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_49988.png", "size": 58975, "thumbnail_archive_path": "screenshots/thumbnail_49988.png", "timestamp": "00:00:49.988", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_50988.png", "size": 53604, "thumbnail_archive_path": "screenshots/thumbnail_50988.png", "timestamp": "00:00:50.988", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_51996.png", "size": 58847, "thumbnail_archive_path": "screenshots/thumbnail_51996.png", "timestamp": "00:00:51.996", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_115607.png", "size": 61220, "thumbnail_archive_path": "screenshots/thumbnail_115607.png", "timestamp": "00:01:55.607", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_116607.png", "size": 51188, "thumbnail_archive_path": "screenshots/thumbnail_116607.png", "timestamp": "00:01:56.607", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_117724.png", "size": 211431, "thumbnail_archive_path": "screenshots/thumbnail_117724.png", "timestamp": "00:01:57.724", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_120382.png", "size": 229459, "thumbnail_archive_path": "screenshots/thumbnail_120382.png", "timestamp": "00:02:00.382", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_121896.png", "size": 230286, "thumbnail_archive_path": "screenshots/thumbnail_121896.png", "timestamp": "00:02:01.896", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_123584.png", "size": 210389, "thumbnail_archive_path": "screenshots/thumbnail_123584.png", "timestamp": "00:02:03.584", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_125623.png", "size": 61486, "thumbnail_archive_path": "screenshots/thumbnail_125623.png", "timestamp": "00:02:05.623", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_127450.png", "size": 61822, "thumbnail_archive_path": "screenshots/thumbnail_127450.png", "timestamp": "00:02:07.450", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_129739.png", "size": 226505, "thumbnail_archive_path": "screenshots/thumbnail_129739.png", "timestamp": "00:02:09.739", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_130853.png", "size": 237425, "thumbnail_archive_path": "screenshots/thumbnail_130853.png", "timestamp": "00:02:10.853", "type": "screenshot", "version": 1 } ], "type": "summary", "version": 1, "vm_and_analyzer_details": { "adobe_acrobat_reader_version": "not_installed", "analyzer_build_date": "2017-08-15 17:43", "analyzer_version": "2.2.0", "chrome_version": "59.0.3071.115", "firefox_version": "25.0", "flash_version": "10.3.183.90", "internet_explorer_version": "8.0.7601.17514", "java_version": "7.0.710", "microsoft_excel_version": "16.0.4266.1003", "microsoft_office_version": "16.0.4266.1003", "microsoft_power_point_version": "16.0.4266.1003", "microsoft_project_version": "16.0.4266.1003", "microsoft_publisher_version": "16.0.4266.1003", "microsoft_visio_version": "16.0.4266.1003", "microsoft_word_version": "16.0.4266.1003", "silverlight_version": "not_installed", "type": "vm_and_analyzer_details", "version": 1, "vm_architecture": "x86_64-bit", "vm_kernel_version": "6.1.7601.17514_(3844dbb9-2017-4967-be7a-a4a2c20430fa)", "vm_name": null, "vm_os": "windows_7" }, "vti": { "type": "vti", "version": 1, "vti_built_in_rules_version": "2.6", "vti_rule_matches": [ { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_document_create_process", "operation_desc": "Create process", "ref_gfncalls": [ { "ref_id": "gfn_2868", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_document_create_process", "technique_desc": "Create process \"C:\\Users\\aETAdzjz\\Desktop\\lukitus.htm\".", "technique_path": "built_in._process._document_create_process.vmray_document_create_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_document_create_process", "operation_desc": "Create process", "ref_gfncalls": [ { "ref_id": "gfn_2869", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_document_create_process", "technique_desc": "Create process \"C:\\Users\\aETAdzjz\\Desktop\\lukitus.bmp\".", "technique_path": "built_in._process._document_create_process.vmray_document_create_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_document_create_process", "operation_desc": "Create process", "ref_gfncalls": [ { "ref_id": "gfn_2872", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_document_create_process", "technique_desc": "Create process \"cmd.exe /C del /Q /F \"C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\agraba8.exe\"\".", "technique_path": "built_in._process._document_create_process.vmray_document_create_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_create_many_files", "operation_desc": "Create many files", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_many_files", "technique_desc": "Create above average number of files.", "technique_path": "built_in._file_system._create_many_files.vmray_create_many_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_encrypt_user_files", "operation_desc": "Encrypt content of user files", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_encrypt_user_files", "technique_desc": "Encrypt the content of multiple user files. This is an indicator for ransomware.", "technique_path": "built_in._file_system._encrypt_user_files.vmray_encrypt_user_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "get", "get", "get" ], "type": "url_artifact", "url": "http://calster.be/87wifhFsdf", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_download_data", "operation_desc": "Download data", "ref_gfncalls": [ { "ref_id": "gfn_317", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_download_data_http_request", "technique_desc": "Url \"http://calster.be/87wifhFsdf\".", "technique_path": "built_in._network._download_data.vmray_download_data_http_request", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "post", "post", "post" ], "type": "url_artifact", "url": "212.109.220.109/imageload.cgi", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_download_data", "operation_desc": "Download data", "ref_gfncalls": [ { "ref_id": "gfn_628", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_download_data_http_request", "technique_desc": "Url \"212.109.220.109/imageload.cgi\".", "technique_path": "built_in._network._download_data.vmray_download_data_http_request", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "get", "get", "get" ], "type": "url_artifact", "url": "http://calster.be/87wifhFsdf", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_establish_http_connection", "operation_desc": "Connect to HTTP server", "ref_gfncalls": [ { "ref_id": "gfn_317", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "establish_http_connection", "technique_desc": "Remote address \"http://calster.be/87wifhFsdf\".", "technique_path": "built_in._network._establish_http_connection.establish_http_connection", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "post", "post", "post" ], "type": "url_artifact", "url": "212.109.220.109/imageload.cgi", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_establish_http_connection", "operation_desc": "Connect to HTTP server", "ref_gfncalls": [ { "ref_id": "gfn_628", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "establish_http_connection", "technique_desc": "Remote address \"212.109.220.109/imageload.cgi\".", "technique_path": "built_in._network._establish_http_connection.establish_http_connection", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_static", "category_desc": "PE", "operation": "_drop_pe_file", "operation_desc": "Drop PE file", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_drop_pe_file", "technique_desc": "Drop file \"c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe\".", "technique_path": "built_in._static._drop_pe_file.vmray_drop_pe_file", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_static", "category_desc": "PE", "operation": "_execute_dropped_pe_file", "operation_desc": "Execute dropped PE file", "ref_gfncalls": [], "rule_score": 3, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_execute_dropped_pe_file", "technique_desc": "Execute dropped file \"c:\\users\\aetadzjz\\appdata\\local\\temp\\agraba8.exe\".", "technique_path": "built_in._static._execute_dropped_pe_file.vmray_execute_dropped_pe_file", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_vba_macro", "category_desc": "VBA Macro", "operation": "_execute_macro_on_ws_event", "operation_desc": "Execute macro on specific worksheet event", "ref_gfncalls": [], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_execute_macro_on_ws_event", "technique_desc": "Execute macro on \"Open Document\" event.", "technique_path": "built_in._vba_macro._execute_macro_on_ws_event.vmray_execute_macro_on_ws_event", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_vba_macro", "category_desc": "VBA Macro", "operation": "_create_suspicious_com_object", "operation_desc": "Create suspicious COM object", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_suspicious_com_object", "technique_desc": "CreateObject(VertikName)", "technique_path": "built_in._vba_macro._create_suspicious_com_object.vmray_create_suspicious_com_object", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_vba_macro", "category_desc": "VBA Macro", "operation": "_create_suspicious_com_object", "operation_desc": "Create suspicious COM object", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_suspicious_com_object", "technique_desc": "CreateObject(AlertNE)", "technique_path": "built_in._vba_macro._create_suspicious_com_object.vmray_create_suspicious_com_object", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_vba_macro", "category_desc": "VBA Macro", "operation": "_create_suspicious_com_object", "operation_desc": "Create suspicious COM object", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_suspicious_com_object", "technique_desc": "CreateObject(AlertN(1))", "technique_path": "built_in._vba_macro._create_suspicious_com_object.vmray_create_suspicious_com_object", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_vba_macro", "category_desc": "VBA Macro", "operation": "_create_suspicious_com_object", "operation_desc": "Create suspicious COM object", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_suspicious_com_object", "technique_desc": "CreateObject(AlertN(3))", "technique_path": "built_in._vba_macro._create_suspicious_com_object.vmray_create_suspicious_com_object", "type": "vti_rule_match", "version": 1 } ], "vti_rule_type": "Documents", "vti_score": 100 }, "yara": { "apply_yara": true, "apply_yara_on_created_files": true, "apply_yara_on_modified_files": true, "apply_yara_on_pcap_file": true, "apply_yara_on_process_dumps": true, "apply_yara_on_sample_files": true, "match_count": 0, "matches": [], "ruleset_count": 7, "type": "yara", "version": 1 } }