Windows Server 2016 File Paths
Uploaded by
fuentes1587Windows Server 2016 File Paths
Uploaded by
fuentes1587Source,Type,Path,"Created Date"
/img_WindowsServer2016-disk001.vmdk/vol_vol2/Boot/bootvhd.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol2/
/img_WindowsServer2016-disk001.vmdk/vol_vol2/Recovery/WindowsRE/Winre.wim,File,"/img_WindowsServer2016-disk001
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Event Viewer/Views/ServerRoles/RemoteDesktop
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows/Start Menu/Programs/Accessories/Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows/SystemData/S-1-5-18/ReadOnly/LockSc
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/Backup/m
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/Backup/m
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/Backup/m
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/Default/M
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/Default/M
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/Default/M
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D505
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D505
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D505
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D505
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DB
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpenginedb.db,File,"/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Support/MpWppTracing-050
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Support/MpWppTracing-051
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Package Cache/{53f1dc9d-ed94-4650-a079-129785ce7905}/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/E
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/E
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/S
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/S
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/H
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/H
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Safe Brow
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Safe Brow
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/SwRepor
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/SwRepor
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Microsoft/Internet Explorer/Recover
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Microsoft/Internet Explorer/Recover
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Microsoft/Windows/Caches/{3DA71D
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Packages/Microsoft.Windows.Cortan
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Packages/Microsoft.Windows.Cortan
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Packages/Microsoft.Windows.Cortan
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Temp/chrome_BITS_4840_66603239
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/TileDataLayer/Database/EDB00001.l
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/TileDataLayer/Database/vedatamode
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Roaming/SoftPerfect Network Scanner/net
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/Downloads/network-scanner-8-0-2.exe,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Extend/$UsnJrnl:$J,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$LogFile,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$LogFile"
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$MFT,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$MFT","202
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RTRBI0
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R340NI
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/FlickLearningWizard.ex
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/InkDiv.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/InkObj.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/InputPersonalization.ex
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/rtscom.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/ShapeCollector.exe,File
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/tabskb.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/tipskins.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/tiptsf.dll,File,"/img_Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/IpsMigrationPlugin.dll,F
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/IpsPlugin.dll,File,"/img_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/micaut.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/mip.exe,File,"/img_Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/mraut.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/mshwLatin.dll,File,"/im
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/VC/msdia100.dll,File,"/img
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/VGX/VGX.dll,File,"/img_Wi
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msado15.dll,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msadomd.dll,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msadox.dll,File,"/img_Windows
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msadrh15.dll,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msadce.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msadco.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msadds.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msdaprst.dll,File,"/img_Wind
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msdarem.dll,File,"/img_Wind
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/msdasql.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/msdatl3.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/oledb32.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/sqloledb.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/chrome.dll,File,"
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/chrome_elf.dll,F
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/default_apps/yo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/icudtl.dat,File,"/i
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrmstp
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/setup.e
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/notification_help
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/resources.pak,Fi
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/WidevineCdm/_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/chrome.exe,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Npcap/CheckStatus.bat,File,"/img_WindowsServer2016-disk
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Npcap/DiagReport.ps1,File,"/img_WindowsServer2016-disk
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Npcap/FixInstall.bat,File,"/img_WindowsServer2016-disk00
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Oracle/VirtualBox Guest Additions/VBoxGuest.inf,File,"/img
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Oracle/VirtualBox Guest Additions/VBoxMouse.inf,File,"/im
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Process Hacker 2/ProcessHacker.exe,File,"/img_WindowsSe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Process Hacker 2/unins000.exe,File,"/img_WindowsServer2
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Process Hacker 2/x86/ProcessHacker.exe,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/SoftPerfect Network Scanner/netscan.exe,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/SoftPerfect Network Scanner/unins000.exe,File,"/img_Wind
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/USBPcap/USBPcap.inf,File,"/img_WindowsServer2016-disk0
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/mpvis.DLL,File,"/img_WindowsServe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/setup_wm.exe,File,"/img_Windows
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/wmlaunch.exe,File,"/img_Windows
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/wmprph.exe,File,"/img_WindowsSe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows NT/TableTextService/TableTextServiceArray.txt,Fi
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Photo Viewer/PhotoAcq.dll,File,"/img_WindowsSe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Photo Viewer/PhotoViewer.dll,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/WindowsPowerShell/Modules/PackageManagement/1.0.0.1
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/WindowsPowerShell/Modules/Pester/3.4.0/Functions/Moc
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PSMo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/AMMonitoringProvider.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpClient.dll,File,"/img_WindowsServer
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpCommu.dll,File,"/img_WindowsServ
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpProvider.dll,File,"/img_WindowsServ
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpRtp.dll,File,"/img_WindowsServer20
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpSvc.dll,File,"/img_WindowsServer20
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/NisSrv.exe,File,"/img_WindowsServer20
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MSASCui.exe,File,"/img_WindowsServe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/shellext.dll,File,"/img_WindowsServer2
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Mail/MSOERES.dll,File,"/img_WindowsServer2016
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/libwireshark.dll,File,"/img_WindowsServer2016-
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/opengl32sw.dll,File,"/img_WindowsServer2016-d
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/libGLESv2.dll,File,"/img_WindowsServer2016-dis
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/Qt5Core.dll,File,"/img_WindowsServer2016-disk
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/Qt5Svg.dll,File,"/img_WindowsServer2016-disk0
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/DAO/dao360.dll,File,
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/InkDiv.dll,File,"/im
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/InkObj.dll,File,"/i
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/micaut.dll,File,"/i
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/mraut.dll,File,"/im
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/mshwLatin.dll,Fil
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/rtscom.dll,File,"/i
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/tiptsf.dll,File,"/im
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/VC/msdia100.dll,File,
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/VGX/VGX.dll,File,"/im
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msado15.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msadomd.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msadox.dll,File,"/img_Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msadrh15.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msadce.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msadco.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msadds.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msdaprst.dll,File,"/img_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msdarem.dll,File,"/img_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/msdaora.dll,File,"/img_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/msdasql.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/msdatl3.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/oledb32.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/sqloledb.dll,File,"/img_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/goopdate.dll,File,"/img_Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/GoogleCrashHandler.exe,Fil
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/GoogleCrashHandler64.exe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/GoogleUpdateComRegister
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/GoogleUpdateCore.exe,File
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psmachine.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psmachine_64.dll,File,"/img
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psuser.dll,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psuser_64.dll,File,"/img_Wi
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/Download/{8A69D345-D564-463C-AF
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Defender/MpClient.dll,File,"/img_WindowsS
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Defender/shellext.dll,File,"/img_WindowsSe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Mail/MSOERES.dll,File,"/img_WindowsServe
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/mpvis.DLL,File,"/img_Window
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/setup_wm.exe,File,"/img_Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/wmlaunch.exe,File,"/img_Win
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/wmprph.exe,File,"/img_Windo
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows NT/TableTextService/TableTextServiceArray
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Photo Viewer/PhotoAcq.dll,File,"/img_Wind
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Photo Viewer/PhotoViewer.dll,File,"/img_W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/WindowsPowerShell/Modules/PackageManagement/1
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/WindowsPowerShell/Modules/Pester/3.4.0/Functions
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/AcLayers.dll,File,"/img_WindowsServer2016-disk001.
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/AcSpecfc.dll,File,"/img_WindowsServer2016-disk001.
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/AcXtrnal.dll,File,"/img_WindowsServer2016-disk001.v
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/apppatch64/AcLayers.dll,File,"/img_WindowsServer2
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/apppatch64/sysmain.sdb,File,"/img_WindowsServer2
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/sysmain.sdb,File,"/img_WindowsServer2016-disk001.
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/GAC_MSIL/Microsoft.PowerShell.Commands.Diagnosti
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/GAC_MSIL/Microsoft.PowerShell.Commands.Diagnosti
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/GAC_MSIL/System.Management.Automation/1.0.0.0_
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft.Baa2ca56b#/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft.P1706cafe#/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft.Pae3498d9#/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft.R251a4777#/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/MIGUIControls/cbed01
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/C
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/Downloads/2.2.0 20200918 Zerologon encrypted.zip
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome
/img_WindowsServer2016-disk001.vmdk/vol_vol2/Boot/bootvhd.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol2/
/img_WindowsServer2016-disk001.vmdk/vol_vol2/Recovery/WindowsRE/Winre.wim,File,"/img_WindowsServer2016-disk001
/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Event Viewer/Views/ServerRoles/RemoteDesktop
er2016-disk001.vmdk/vol_vol2/Boot/bootvhd.dll","2021-05-06 17:14:50 CEST"
mg_WindowsServer2016-disk001.vmdk/vol_vol2/Recovery/WindowsRE/Winre.wim","2021-05-06 16:16:28 CEST"
ws/ServerRoles/RemoteDesktop.Events.xml,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Event Viewe
enu/Programs/Accessories/Windows Media Player.lnk,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/W
Data/S-1-5-18/ReadOnly/LockScreen_Z/LockScreen___1024_0768_notdimmed.jpg,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol
er/Definition Updates/Backup/mpasbase.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows D
er/Definition Updates/Backup/mpavbase.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows
er/Definition Updates/Backup/mpengine.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows De
er/Definition Updates/Default/MpAsBase.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows
er/Definition Updates/Default/MpAvBase.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows
er/Definition Updates/Default/MpEngine.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows De
er/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C4CF3}/mpasbase.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
er/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C4CF3}/mpasdlta.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol
er/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C4CF3}/mpavbase.vdm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
er/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C4CF3}/mpengine.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin.A0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Pro
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin.67,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Prog
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin.79,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Prog
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin.7C,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Prog
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin.7E,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Prog
er/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.bin.80,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Prog
er/Scans/mpenginedb.db,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpe
er/Support/MpWppTracing-05072021-095951-00000003-ffffffff.bin,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/
er/Support/MpWppTracing-05102021-112029-00000003-ffffffff.bin,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/
d94-4650-a079-129785ce7905}/VC_redist.x64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Package Cache/{
le/Chrome/User Data/Default/Cache/data_1,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Loca
le/Chrome/User Data/Default/Cache/data_3,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Loca
le/Chrome/User Data/Default/Cache/f_000011,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Lo
le/Chrome/User Data/Default/Code Cache/js/a82444b92fb85fb7_0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Admin
le/Chrome/User Data/Default/Code Cache/js/30f3b5e1e27f5ce4_0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Admin
le/Chrome/User Data/Default/Code Cache/js/a2f8c54c35cc7cc8_0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Admini
le/Chrome/User Data/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_0/_metadata/computed_hashes.json,File,"/img
le/Chrome/User Data/Default/Extensions/pkedcjkdefgpdelpbcmbmeomcjbeemfm/9021.222.0.0_0/mirroring_hangouts.js,File,"/img_Win
le/Chrome/User Data/Default/Sessions/Tabs_13264856418938881,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Admin
le/Chrome/User Data/Default/Sessions/Tabs_13264857228958276,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Admin
le/Chrome/User Data/Default/History,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Goog
le/Chrome/User Data/Default/History Provider Cache,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppD
le/Chrome/User Data/Safe Browsing/UrlMalBin.store,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppD
le/Chrome/User Data/Safe Browsing/UrlSoceng.store,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppD
le/Chrome/User Data/SwReporter/90.261.200/em003_64.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrado
le/Chrome/User Data/SwReporter/90.261.200/software_reporter_tool.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users
osoft/Internet Explorer/Recovery/High/Last Active/RecoveryStore.{EBE1278E-AF0A-11EB-A0B5-0800279357BC}.dat,File,"/img_WindowsSe
osoft/Internet Explorer/Recovery/High/Last Active/{EBE1278F-AF0A-11EB-A0B5-0800279357BC}.dat,File,"/img_WindowsServer2016-disk0
osoft/Windows/Caches/{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db,File,"/img_WindowsServer2016-disk
ages/Microsoft.Windows.Cortana_cw5n1h2txyewy/LocalState/ConstraintIndex/Input_{a069a524-78e3-42b5-b82c-863565c1790e}/appssy
ages/Microsoft.Windows.Cortana_cw5n1h2txyewy/LocalState/DeviceSearchCache/AppCache132647843412588436.txt,File,"/img_Windo
ages/Microsoft.Windows.Cortana_cw5n1h2txyewy/LocalState/DeviceSearchCache/AppCache132647843469173413.txt,File,"/img_Windo
p/chrome_BITS_4840_666032396/BIT84E0.tmp,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Lo
ataLayer/Database/EDB00001.log,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/TileDataL
ataLayer/Database/vedatamodel.edb,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/TileDa
oftPerfect Network Scanner/netscan.xml,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Roaming
-scanner-8-0-2.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/Downloads/network-scanner-8-0-2.exe"
erver2016-disk001.vmdk/vol_vol3/$Extend/$UsnJrnl:$J","2021-05-06 16:15:21 CEST"
isk001.vmdk/vol_vol3/$LogFile","2021-05-06 17:02:40 CEST"
001.vmdk/vol_vol3/$MFT","2021-05-06 17:02:40 CEST"
3348-2122892913-500/$RTRBI0W.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20836
3348-2122892913-500/$R340NIJ/modules/sqlite3.c,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-18468
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Application.ev
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/HardwareEve
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Internet Explo
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Key Managem
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Clie
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Win
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Security.evtx,
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Setup.evtx,Fil
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/System.evtx,F
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Windows Pow
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/logfile/$LogFile,File,"/img_Wi
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/mft/$MFT,File,"/img_Window
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/prefetch,File,"/img_Windows
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/registry/COMPONENTS,File,"/
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/registry/SOFTWARE,File,"/img
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/registry/SYSTEM,File,"/img_W
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/usnjrnl/$UsnJrnl_$J.bin,File,"/
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/chrome/Administrador/cache
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/chrome/Administrador/cache
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/chrome/Administrador/histor
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/forecopy_handy.log,File,"/img
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/PersistenceMechanisms/autorunsc.csv,Fil
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/PersistenceMechanisms/autorunsc.txt,File
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/PersistenceMechanisms/Startup_wmic.txt
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/BasicInfo/Full_file_listing.txt,File,"/img_W
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/BasicInfo/Hashes_md5_System32_AllFiles
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/BasicInfo/Hashes_sha256_System32_AllFi
3348-2122892913-500/$R5A4NMW/Checklists/Compromised Windows System Live Data Gathering Checklist.docx,File,"/img_WindowsSe
3348-2122892913-500/$R5A4NMW/README-Windows.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21
3348-2122892913-500/$R5A4NMW/Tools/ExtractUsnJrnl/ExtractUsnJrnl64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$
3348-2122892913-500/$R5A4NMW/Tools/FGET/FGET.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-
3348-2122892913-500/$R5A4NMW/Tools/forecopy/forecopy_handy.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recyc
3348-2122892913-500/$R5A4NMW/Tools/FTKImager-commandline/adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_v
3348-2122892913-500/$R5A4NMW/Tools/lastactivityview/LastActivityView.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$
3348-2122892913-500/$R5A4NMW/Tools/lastactivityview/readme.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/CHANGELOG,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nmap-service-probes,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Rec
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nmap-update.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nselib/data/wp-plugins.lst,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nselib/rdp.lua,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nselib/tn3270.lua,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/scripts/rdp-vuln-ms12-020.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/scripts/smb-system-info.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/vcredist2008_x86.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Re
3348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/vcredist_x86.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
3348-2122892913-500/$R5A4NMW/Tools/pestudio889/xml/strings.xml,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
3348-2122892913-500/$R5A4NMW/Tools/PrcView/foo.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21
3348-2122892913-500/$R5A4NMW/Tools/PrcView/PrcMon.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-
3348-2122892913-500/$R5A4NMW/Tools/PrcView/PrcView.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
3348-2122892913-500/$R5A4NMW/Tools/RawCopy/RawCopy64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bi
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Autoruns.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Autoruns64.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Rec
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Autoruns64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Re
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/autorunsc.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/autorunsc64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Re
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/pslist.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/pslist64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycl
3348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Pstools.chm,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycl
3348-2122892913-500/$R5A4NMW/Tools/TrueCrypt/TrueCrypt Setup.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
3348-2122892913-500/$R5A4NMW/Tools/winaudit/WinAudit.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/ca-bundle.crt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/CHANGELOG,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nmap-os-db,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nmap-update.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nmap.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nselib/rdp.lua,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/scripts/http-affiliate-id.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/scripts/rdp-vuln-ms12-020.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/scripts/smb-system-info.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/vcredist2008_x86.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Re
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/vcredist_x64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
3348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/vcredist_x86.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
ared/ink/FlickLearningWizard.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/
ared/ink/InkDiv.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/InkDiv.dll","
ared/ink/InkObj.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/InkObj.dll",
ared/ink/InputPersonalization.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/
ared/ink/rtscom.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/rtscom.dll"
ared/ink/ShapeCollector.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/S
ared/ink/tabskb.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/tabskb.dll"
ared/ink/tipskins.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/tipskins.dl
ared/ink/tiptsf.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/tiptsf.dll","2
ared/ink/IpsMigrationPlugin.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink
ared/ink/IpsPlugin.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/IpsPlugin
ared/ink/micaut.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/micaut.dll"
ared/ink/mip.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/mip.exe","20
ared/ink/mraut.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/mraut.dll","
ared/ink/mshwLatin.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/ink/mshwL
ared/VC/msdia100.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/VC/msdia10
ared/VGX/VGX.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/microsoft shared/VGX/VGX.dll","2
msado15.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msado15.dll","2021-05-06
msadomd.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msadomd.dll","2021-05-0
msadox.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msadox.dll","2021-05-06 17
msadrh15.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/ado/msadrh15.dll","2021-05-0
dc/msadce.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msadce.dll","2021-05-
dc/msadco.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msadco.dll","2021-05-
dc/msadds.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msadds.dll","2021-05-
dc/msdaprst.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msdaprst.dll","2021-
dc/msdarem.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/msadc/msdarem.dll","2021
DB/msdasql.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/msdasql.dll","2021-0
DB/msdatl3.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/msdatl3.dll","2021-0
DB/oledb32.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/oledb32.dll","2021-0
DB/sqloledb.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Common Files/System/Ole DB/sqloledb.dll","2021-0
/90.0.4430.93/chrome.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.9
/90.0.4430.93/chrome_elf.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.44
/90.0.4430.93/default_apps/youtube.crx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Applicati
/90.0.4430.93/icudtl.dat,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.9
/90.0.4430.93/Installer/chrmstp.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/
/90.0.4430.93/Installer/setup.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.
/90.0.4430.93/notification_helper.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application
/90.0.4430.93/resources.pak,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.44
/90.0.4430.93/WidevineCdm/_platform_specific/win_x64/widevinecdm.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Progr
/chrome.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/chrome.exe","2021-05-0
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Npcap/CheckStatus.bat","2021-05-06 17:30:39 CEST"
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Npcap/DiagReport.ps1","2021-05-06 17:30:31 CEST"
mg_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Npcap/FixInstall.bat","2021-05-06 17:30:31 CEST"
ditions/VBoxGuest.inf,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Oracle/VirtualBox Guest Additions/VBoxGues
ditions/VBoxMouse.inf,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Oracle/VirtualBox Guest Additions/VBoxMo
cker.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Process Hacker 2/ProcessHacker.exe","2021-05-07 12:18:
exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Process Hacker 2/unins000.exe","2021-05-07 12:18:40 CEST"
ssHacker.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Process Hacker 2/x86/ProcessHacker.exe","2021-05-
r/netscan.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/SoftPerfect Network Scanner/netscan.exe","2021-05
r/unins000.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/SoftPerfect Network Scanner/unins000.exe","2021
img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/USBPcap/USBPcap.inf","2021-05-06 17:31:07 CEST"
is.DLL,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/mpvis.DLL","2021-05-06 17:07:47 CE
p_wm.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/setup_wm.exe","2021-05-06 17
aunch.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/wmlaunch.exe","2021-05-06 17
prph.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Media Player/wmprph.exe","2021-05-06 17:07:
ce/TableTextServiceArray.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows NT/TableTextService/Table
toAcq.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Photo Viewer/PhotoAcq.dll","2021-05-06 17:12
toViewer.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Photo Viewer/PhotoViewer.dll","2021-05-06
es/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MsuProvider.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
es/Pester/3.4.0/Functions/Mock.Tests.ps1,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/WindowsPowerShell/M
es/PowerShellGet/1.0.0.1/PSModule.psm1,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/WindowsPowerShell/M
itoringProvider.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/AMMonitoringProvider.dll"
nt.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpClient.dll","2021-05-06 16:15:52 CEST
mu.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpCommu.dll","2021-05-06 17:02:51 C
ider.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpProvider.dll","2021-05-06 17:02:50
dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpRtp.dll","2021-05-06 16:15:53 CEST"
dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MpSvc.dll","2021-05-06 16:15:52 CEST"
xe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/NisSrv.exe","2021-05-06 17:02:50 CEST"
ui.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/MSASCui.exe","2021-05-06 17:07:47 CES
.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Defender/shellext.dll","2021-05-06 17:07:47 CEST"
,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Windows Mail/MSOERES.dll","2021-05-06 17:12:02 CEST"
ile,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/libwireshark.dll","2021-05-06 17:29:45 CEST"
ile,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/opengl32sw.dll","2021-05-06 17:31:16 CEST"
,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/libGLESv2.dll","2021-05-06 17:31:14 CEST"
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/Qt5Core.dll","2021-05-06 17:31:13 CEST"
mg_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Wireshark/Qt5Svg.dll","2021-05-06 17:31:14 CEST"
oft Shared/DAO/dao360.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/D
oft Shared/ink/InkDiv.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/
oft Shared/ink/InkObj.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink
oft Shared/ink/micaut.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink
oft Shared/ink/mraut.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/
oft Shared/ink/mshwLatin.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared
oft Shared/ink/rtscom.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink
oft Shared/ink/tiptsf.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/ink/ti
oft Shared/VC/msdia100.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/
oft Shared/VGX/VGX.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/Microsoft Shared/VGX
/ado/msado15.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msado15.dll","
/ado/msadomd.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msadomd.dll"
/ado/msadox.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msadox.dll","20
/ado/msadrh15.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/ado/msadrh15.dll"
/msadc/msadce.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msadce.dll
/msadc/msadco.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msadco.dll
/msadc/msadds.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msadds.dll
/msadc/msdaprst.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msdaprst
/msadc/msdarem.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/msadc/msdarem
/Ole DB/msdaora.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/msdaora.
/Ole DB/msdasql.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/msdasql.d
/Ole DB/msdatl3.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/msdatl3.d
/Ole DB/oledb32.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/oledb32.d
/Ole DB/sqloledb.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Common Files/System/Ole DB/sqloledb.
.82/goopdate.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/goopdate.dll","20
.82/GoogleCrashHandler.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/Goog
.82/GoogleCrashHandler64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/Go
.82/GoogleUpdateComRegisterShell64.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1
.82/GoogleUpdateCore.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/Google
.82/psmachine.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psmachine.dll",
.82/psmachine_64.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psmachine_
.82/psuser.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psuser.dll","2021-05
.82/psuser_64.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/1.3.36.82/psuser_64.dll","
oad/{8A69D345-D564-463C-AFF1-A69D9E530F96}/90.0.4430.93/90.0.4430.93_chrome_installer.exe,File,"/img_WindowsServer2016-disk
pClient.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Defender/MpClient.dll","2021-05-06 17:
ellext.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Defender/shellext.dll","2021-05-06 17:07:
ES.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Mail/MSOERES.dll","2021-05-06 17:12:02 CE
r/mpvis.DLL,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/mpvis.DLL","2021-05-06
r/setup_wm.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/setup_wm.exe","202
r/wmlaunch.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/wmlaunch.exe","202
r/wmprph.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Media Player/wmprph.exe","2021-0
tService/TableTextServiceArray.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows NT/TableTextSe
r/PhotoAcq.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Photo Viewer/PhotoAcq.dll","2021-
r/PhotoViewer.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Windows Photo Viewer/PhotoViewer.dll","
Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MsuProvider.dll,File,"/img_WindowsServer2016-disk001.vmdk/vo
Modules/Pester/3.4.0/Functions/Mock.Tests.ps1,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/WindowsPow
Modules/PowerShellGet/1.0.0.1/PSModule.psm1,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/WindowsPo
g_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/AcLayers.dll","2021-05-06 17:10:50 CEST"
g_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/AcSpecfc.dll","2021-05-06 17:12:02 CEST"
_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/AcXtrnal.dll","2021-05-06 17:10:50 CEST"
.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/apppatch64/AcLayers.dll","2021-05-06 17:10:50 CEST"
sdb,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/apppatch64/sysmain.sdb","2021-05-06 17:10:50 CEST"
g_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/AppPatch/sysmain.sdb","2021-05-06 17:10:50 CEST"
PowerShell.Commands.Diagnostics/1.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.Commands.Diagnostics.dll,File,"/img_WindowsSer
PowerShell.Commands.Diagnostics.Resources/1.0.0.0_es_31bf3856ad364e35/Microsoft.PowerShell.Commands.Diagnostics.resources.dll,
nagement.Automation/1.0.0.0__31bf3856ad364e35/System.Management.Automation.dll,File,"/img_WindowsServer2016-disk001.vmdk
319_32/Microsoft.Baa2ca56b#/25d1a58ad398684c5b9f8590d778c729/Microsoft.Build.Tasks.v4.0.ni.dll,File,"/img_WindowsServer2016-d
319_32/Microsoft.P1706cafe#/2d34a6f7d4f6c87db716364364cbe53d/Microsoft.PowerShell.Commands.Diagnostics.ni.dll,File,"/img_Win
319_32/Microsoft.Pae3498d9#/e7182cd347c7b82372b80da07a435e4a/Microsoft.PowerShell.Commands.Management.ni.dll,File,"/img_W
319_32/Microsoft.R251a4777#/ca6a0bbfdea1b54b878fd7503822e857/Microsoft.RightsManagementServices.ServerManager.Deploymen
319_32/MIGUIControls/cbed01df96b8486a809135335afb66cb/MIGUIControls.ni.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_v
le/Chrome/User Data/Default/Cache/data_3/data_3__c3030384/data_3__c3030384/0,File,"/img_WindowsServer2016-disk001.vmdk/vo
le/Chrome/User Data/Default/Cache/data_3/data_3__c30300ec/data_3__c30300ec/0,File,"/img_WindowsServer2016-disk001.vmdk/vol
le/Chrome/User Data/Default/Cache/data_3/data_3__c10300a0/data_3__c10300a0/0,File,"/img_WindowsServer2016-disk001.vmdk/vo
le/Chrome/User Data/Default/Cache/data_3/data_3__c30300c8/data_3__c30300c8/0,File,"/img_WindowsServer2016-disk001.vmdk/vol
le/Chrome/User Data/Default/Cache/data_3/data_3__c3030378/data_3__c3030378/0,File,"/img_WindowsServer2016-disk001.vmdk/vo
le/Chrome/User Data/Default/Cache/f_000004/f_000004/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000006/f_000006/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00000a/f_00000a/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00000d/f_00000d/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrado
le/Chrome/User Data/Default/Cache/f_000014/f_000014/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000015/f_000015/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000018/f_000018/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000034/f_000034/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00003a/f_00003a/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00003b/gentilkiwi-mimikatz-09fb1f6/modules/sqlite3.c,File,"/img_WindowsServer2016-disk001.v
le/Chrome/User Data/Default/Cache/f_00003c/f_00003c/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00005f/f_00005f/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/
le/Chrome/User Data/Default/Cache/f_000062/f_000062/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000063/f_000063/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00007e/f_00007e/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000080/f_000080/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_000081/f_000081/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00008e/f_00008e/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador
le/Chrome/User Data/Default/Cache/f_00008f/f_00008f/0,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/
200918 Zerologon encrypted.zip/gentilkiwi-mimikatz-09fb1f6/modules/sqlite3.c,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/U
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Checklists/Compromised Windows System Live Data Gathering Checklist
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/README-Windows.txt,File,"/img_WindowsServer2016-disk001.vmdk/vo
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/ExtractUsnJrnl/ExtractUsnJrnl64.exe,File,"/img_WindowsServer20
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FGET/FGET.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/forecopy/forecopy_handy.exe,File,"/img_WindowsServer2016-dis
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTKImager-commandline/adshattrdefs.dll,File,"/img_WindowsServ
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/lastactivityview/LastActivityView.exe,File,"/img_WindowsServer20
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/lastactivityview/readme.txt,File,"/img_WindowsServer2016-disk00
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/ca-bundle.crt,File,"/img_WindowsServer2016-disk001
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/CHANGELOG,File,"/img_WindowsServer2016-disk001.
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nmap-os-db,File,"/img_WindowsServer2016-disk001.v
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nmap-update.exe,File,"/img_WindowsServer2016-disk
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nmap.exe,File,"/img_WindowsServer2016-disk001.vm
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nselib/rdp.lua,File,"/img_WindowsServer2016-disk001
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/scripts/http-affiliate-id.nse,File,"/img_WindowsServer2
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/scripts/rdp-vuln-ms12-020.nse,File,"/img_WindowsSe
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/scripts/smb-system-info.nse,File,"/img_WindowsServe
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/vcredist2008_x86.exe,File,"/img_WindowsServer2016
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/vcredist_x64.exe,File,"/img_WindowsServer2016-disk0
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/vcredist_x86.exe,File,"/img_WindowsServer2016-disk0
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/CHANGELOG,File,"/img_WindowsServer2016-disk001.
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nmap-service-probes,File,"/img_WindowsServer2016-
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nmap-update.exe,File,"/img_WindowsServer2016-disk
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nselib/data/wp-plugins.lst,File,"/img_WindowsServer2
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nselib/rdp.lua,File,"/img_WindowsServer2016-disk001
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nselib/tn3270.lua,File,"/img_WindowsServer2016-disk
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/scripts/rdp-vuln-ms12-020.nse,File,"/img_WindowsSe
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/scripts/smb-system-info.nse,File,"/img_WindowsServe
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/vcredist2008_x86.exe,File,"/img_WindowsServer2016
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/vcredist_x86.exe,File,"/img_WindowsServer2016-disk0
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/pestudio889/xml/strings.xml,File,"/img_WindowsServer2016-disk
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/PrcView/foo.txt,File,"/img_WindowsServer2016-disk001.vmdk/vo
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/PrcView/PrcMon.dll,File,"/img_WindowsServer2016-disk001.vmdk
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/PrcView/PrcView.exe,File,"/img_WindowsServer2016-disk001.vm
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/RawCopy/RawCopy64.exe,File,"/img_WindowsServer2016-disk001
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Autoruns.exe,File,"/img_WindowsServer2016-di
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Autoruns64.dll,File,"/img_WindowsServer2016-
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Autoruns64.exe,File,"/img_WindowsServer2016
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/autorunsc.exe,File,"/img_WindowsServer2016-d
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/autorunsc64.exe,File,"/img_WindowsServer2016
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/pslist.exe,File,"/img_WindowsServer2016-disk00
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/pslist64.exe,File,"/img_WindowsServer2016-disk
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Pstools.chm,File,"/img_WindowsServer2016-dis
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/TrueCrypt/TrueCrypt Setup.exe,File,"/img_WindowsServer2016-di
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/winaudit/WinAudit.exe,File,"/img_WindowsServer2016-disk001.v
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/adshattrdefs.dl
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/icudt44.dll,File
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/chs_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/deu_ads
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/esp_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/fra_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ita_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/jpn_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/kor_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/nld_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ptb_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/sve_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/trk_adsh
3348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/ProfUIS293ad3
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/adshattrdefs.dll,File,"/img_WindowsServer2
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/icudt44.dll,File,"/img_WindowsServer2016-
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/chs_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/deu_adshattrdefs.dll,File,"/img_Wind
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/esp_adshattrdefs.dll,File,"/img_Wind
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/fra_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ita_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/jpn_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/kor_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/nld_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ptb_adshattrdefs.dll,File,"/img_Wind
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/sve_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/trk_adshattrdefs.dll,File,"/img_Windo
3348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/ProfUIS293ad32.dll,File,"/img_WindowsSer
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/default_apps/youtube.crx,File,"/img_WindowsServer2016-disk001.vmdk/v
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/WidevineCdm/_platform_specific/win_x64/widevinecdm.dll,File,"/img_Win
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/icudtl.dat,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/resources.pak,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Prog
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/chrome.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/chrome_elf.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Pro
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/notification_helper.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_
/90.0.4430.93/Installer/chrome.7z/Chrome-bin/chrome.exe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Googl
er2016-disk001.vmdk/vol_vol2/Boot/bootvhd.dll","2021-05-06 17:14:50 CEST"
mg_WindowsServer2016-disk001.vmdk/vol_vol2/Recovery/WindowsRE/Winre.wim","2021-05-06 16:16:28 CEST"
ws/ServerRoles/RemoteDesktop.Events.xml,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Event Viewe
amData/Microsoft/Event Viewer/Views/ServerRoles/RemoteDesktop.Events.xml","2021-05-06 17:02:52 CEST"
vol3/ProgramData/Microsoft/Windows/Start Menu/Programs/Accessories/Windows Media Player.lnk","2021-05-10 12:59:31 CEST"
rver2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows/SystemData/S-1-5-18/ReadOnly/LockScreen_Z/LockScreen___1024_
gramData/Microsoft/Windows Defender/Definition Updates/Backup/mpasbase.vdm","2021-05-10 11:31:11 CEST"
gramData/Microsoft/Windows Defender/Definition Updates/Backup/mpavbase.vdm","2021-05-10 11:31:11 CEST"
amData/Microsoft/Windows Defender/Definition Updates/Backup/mpengine.dll","2021-05-10 11:31:11 CEST"
ogramData/Microsoft/Windows Defender/Definition Updates/Default/MpAsBase.vdm","2021-05-10 11:31:10 CEST"
ogramData/Microsoft/Windows Defender/Definition Updates/Default/MpAvBase.vdm","2021-05-10 11:31:10 CEST"
amData/Microsoft/Windows Defender/Definition Updates/Default/MpEngine.dll","2021-05-10 11:31:10 CEST"
erver2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C
rver2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C
erver2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86
ver2016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Definition Updates/{BE9D5059-B96F-4B57-849F-CA4EB86C4
016-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB
-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB45.
16-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB
16-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB
16-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB
16-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB
16-disk001.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Scans/mpcache-4C8728E7DBB21144E3F40A5E3CEA9519F165DB
/Windows Defender/Scans/mpenginedb.db","2021-05-11 12:35:58 CEST"
1.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Support/MpWppTracing-05072021-095951-00000003-ffffffff.bin","2021-05
1.vmdk/vol_vol3/ProgramData/Microsoft/Windows Defender/Support/MpWppTracing-05102021-112029-00000003-ffffffff.bin","2021-05
/ProgramData/Package Cache/{53f1dc9d-ed94-4650-a079-129785ce7905}/VC_redist.x64.exe","2021-05-06 17:30:07 CEST"
rs/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_1","2021-05-07 12:36:38 CEST"
rs/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_3","2021-05-07 12:36:38 CEST"
sers/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000011","2021-05-07 12:15:48 CEST"
01.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Code Cache/js/a82444b92fb85fb7_0","2021-
01.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Code Cache/js/30f3b5e1e27f5ce4_0","2021-0
1.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Code Cache/js/a2f8c54c35cc7cc8_0","2021-05
omputed_hashes.json,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User
ing_hangouts.js,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data
01.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Sessions/Tabs_13264856418938881","2021-0
01.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Sessions/Tabs_13264857228958276","2021-0
ministrador/AppData/Local/Google/Chrome/User Data/Default/History","2021-05-07 12:36:38 CEST"
vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/History Provider Cache","2021-05-07 12:36:38 CEST"
vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Safe Browsing/UrlMalBin.store","2021-05-07 12:16:38 CEST"
vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Safe Browsing/UrlSoceng.store","2021-05-07 12:16:37 CEST"
dk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/SwReporter/90.261.200/em003_64.dll","2021-05-07 12:34:1
6-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/SwReporter/90.261.200/software_reporter_to
57BC}.dat,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Microsoft/Internet Explorer/Reco
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Microsoft/Internet Explorer/Recovery/High/Last
/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Microsoft/Windows/Caches/{3DA71D5A-20CC-4
b5-b82c-863565c1790e}/appssynonyms.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/
12588436.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Packages/Microsoft.Windows
69173413.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Packages/Microsoft.Windows
sers/Administrador/AppData/Local/Temp/chrome_BITS_4840_666032396/BIT84E0.tmp","2018-10-10 19:49:21 CEST"
rador/AppData/Local/TileDataLayer/Database/EDB00001.log","2021-05-06 16:19:16 CEST"
nistrador/AppData/Local/TileDataLayer/Database/vedatamodel.edb","2021-05-11 12:35:58 CEST"
dministrador/AppData/Roaming/SoftPerfect Network Scanner/netscan.xml","2021-05-07 13:50:58 CEST"
ds/network-scanner-8-0-2.exe","2021-05-07 12:15:48 CEST"
in/S-1-5-21-1846813697-208363348-2122892913-500/$RTRBI0W.exe","2021-05-11 12:35:30 CEST"
3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R340NIJ/modules/sqlite3.c","2021-05-11 12:34:05 CEST"
s/eventlogs/Logs/Application.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20836334
s/eventlogs/Logs/HardwareEvents.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083
s/eventlogs/Logs/Internet Explorer.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083
s/eventlogs/Logs/Key Management Service.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-18468136
s/eventlogs/Logs/Microsoft-Client-Licensing-Platform%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx,File,"/img_WindowsServer2016-dis
s/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx,File,"/img_WindowsServer20
s/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Inventory.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_v
s/eventlogs/Logs/Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx,File,"/img_WindowsServer2016-disk0
s/eventlogs/Logs/Microsoft-Windows-AppModel-Runtime%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycl
s/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/
s/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Microsoft-Windows-AppXDeployment%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Rec
s/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
s/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/
s/eventlogs/Logs/Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-Biometrics%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bi
s/eventlogs/Logs/Microsoft-Windows-Bits-Client%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Microsoft-Windows-Containers-Wcifs%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Rec
s/eventlogs/Logs/Microsoft-Windows-Containers-Wcnfs%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Rec
s/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
s/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx,File,"/img_WindowsServer2016
s/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
s/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$
s/eventlogs/Logs/Microsoft-Windows-Dhcp-Client%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
s/eventlogs/Logs/Microsoft-Windows-Dhcpv6-Client%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/
s/eventlogs/Logs/Microsoft-Windows-Diagnosis-PLA%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$
s/eventlogs/Logs/Microsoft-Windows-FileServices-ServerManager-EventProvider%4Admin.evtx,File,"/img_WindowsServer2016-disk001.v
s/eventlogs/Logs/Microsoft-Windows-FileServices-ServerManager-EventProvider%4Operational.evtx,File,"/img_WindowsServer2016-disk
s/eventlogs/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
s/eventlogs/Logs/Microsoft-Windows-HomeGroup Control Panel%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_v
s/eventlogs/Logs/Microsoft-Windows-IKE%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-
s/eventlogs/Logs/Microsoft-Windows-International%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.
s/eventlogs/Logs/Microsoft-Windows-Iphlpsvc%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S
s/eventlogs/Logs/Microsoft-Windows-Kernel-Boot%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
s/eventlogs/Logs/Microsoft-Windows-Kernel-IO%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.
s/eventlogs/Logs/Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/
s/eventlogs/Logs/Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Re
s/eventlogs/Logs/Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
s/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Errors.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S
s/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Microsoft-Windows-Known Folders API Service.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
s/eventlogs/Logs/Microsoft-Windows-LiveId%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
s/eventlogs/Logs/Microsoft-Windows-MUI%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1
s/eventlogs/Logs/Microsoft-Windows-MUI%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5
s/eventlogs/Logs/Microsoft-Windows-NCSI%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-
s/eventlogs/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recyc
s/eventlogs/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-
s/eventlogs/Logs/Microsoft-Windows-Ntfs%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5
s/eventlogs/Logs/Microsoft-Windows-Ntfs%4WHC.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-18
s/eventlogs/Logs/Microsoft-Windows-PrintService%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-
s/eventlogs/Logs/Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx,File,"/img_WindowsServer2016-disk0
s/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$R
s/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_v
s/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vm
s/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-SessionServices%4Operational.evtx,File,"/img_WindowsServer2016-disk00
s/eventlogs/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-RestartManager%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
s/eventlogs/Logs/Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-ServerManager-DeploymentProvider%4Operational.evtx,File,"/img_WindowsServer2016-disk001.v
s/eventlogs/Logs/Microsoft-Windows-ServerManager-MgmtProvider%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiMachine%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
s/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiMachine%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-SettingSync%4Debug.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
s/eventlogs/Logs/Microsoft-Windows-SettingSync%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
s/eventlogs/Logs/Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/v
s/eventlogs/Logs/Microsoft-Windows-Shell-Core%4ActionCenter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
s/eventlogs/Logs/Microsoft-Windows-Shell-Core%4AppDefaults.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bi
s/eventlogs/Logs/Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Rec
s/eventlogs/Logs/Microsoft-Windows-Shell-Core%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-SmartCard-DeviceEnum%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
s/eventlogs/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bi
s/eventlogs/Logs/Microsoft-Windows-SMBClient%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-SmbClient%4Security.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
s/eventlogs/Logs/Microsoft-Windows-SMBServer%4Audit.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-
s/eventlogs/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.B
s/eventlogs/Logs/Microsoft-Windows-SMBServer%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bi
s/eventlogs/Logs/Microsoft-Windows-SMBServer%4Security.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-
s/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.
s/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Informational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$R
s/eventlogs/Logs/Microsoft-Windows-StateRepository%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recy
s/eventlogs/Logs/Microsoft-Windows-StateRepository%4Restricted.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_
s/eventlogs/Logs/Microsoft-Windows-Store%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1
s/eventlogs/Logs/Microsoft-Windows-TaskScheduler%4Maintenance.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recyc
s/eventlogs/Logs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmd
s/eventlogs/Logs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx,File,"/img_WindowsServer2016-disk001
s/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$R
s/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
s/eventlogs/Logs/Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx,File,"/img_WindowsServer2016-disk00
s/eventlogs/Logs/Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx,File,"/img_WindowsServer2016-
s/eventlogs/Logs/Microsoft-Windows-TWinUI%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S
s/eventlogs/Logs/Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vo
s/eventlogs/Logs/Microsoft-Windows-User Profile Service%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$R
s/eventlogs/Logs/Microsoft-Windows-UserPnp%4ActionCenter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
s/eventlogs/Logs/Microsoft-Windows-VPN%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5
s/eventlogs/Logs/Microsoft-Windows-Wcmsvc%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/
s/eventlogs/Logs/Microsoft-Windows-WFP%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-
s/eventlogs/Logs/Microsoft-Windows-Windows Defender%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$R
s/eventlogs/Logs/Microsoft-Windows-Windows Defender%4WHC.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.
s/eventlogs/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx,File,"/img_WindowsServer20
s/eventlogs/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx,File,"/img_WindowsServer2016-disk001.
s/eventlogs/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/
s/eventlogs/Logs/Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol
s/eventlogs/Logs/Microsoft-Windows-Winlogon%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin
s/eventlogs/Logs/Microsoft-Windows-WinRM%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S
s/eventlogs/Logs/Microsoft-Windows-WMI-Activity%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
s/eventlogs/Logs/Security.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2
s/eventlogs/Logs/Setup.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212
s/eventlogs/Logs/System.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-21
s/eventlogs/Logs/Windows PowerShell.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
s/logfile/$LogFile,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-50
s/mft/$MFT,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R
s/prefetch,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
s/registry/COMPONENTS,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
s/registry/SOFTWARE,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289291
s/registry/SYSTEM,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-5
s/usnjrnl/$UsnJrnl_$J.bin,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
s/chrome/Administrador/cache/data_1,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083
s/chrome/Administrador/cache/data_3,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083
s/chrome/Administrador/history/History,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208
s/forecopy_handy.log,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289291
eMechanisms/autorunsc.csv,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212
eMechanisms/autorunsc.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122
eMechanisms/Startup_wmic.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2
Full_file_listing.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-5
Hashes_md5_System32_AllFiles_and_Dates.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-184681369
Hashes_sha256_System32_AllFiles_and_Dates.txt,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813
list.docx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/README-Windows.txt","2021-05-11 12:35:06 CE
r2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/ExtractUsnJrnl/Extract
vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/FGET/FGET.exe","2021-05-11 12:35:06 CES
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/forecopy/forecopy_handy.e
Server2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/FTKImager-comm
r2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/lastactivityview/LastA
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/lastactivityview/readme.txt","2
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/CHANGELOG","2021-0
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nmap-service
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nmap-update.ex
er2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nselib/d
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nselib/rdp.lua","202
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/nselib/tn3270.lua
Server2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/scrip
rver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/scripts
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/vcredist2008
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-7.70/vcredist_x86.exe"
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/pestudio889/xml/strings.xml"
/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/PrcView/foo.txt","2021-05-11 12:35:06 CE
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/PrcView/PrcMon.dll","2021-05-11 12:3
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/PrcView/PrcView.exe","2021-05-11 1
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/RawCopy/RawCopy64.exe","202
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Autoruns
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Autorun
016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Autoru
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/autorun
016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/autor
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/pslist.exe","2
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/pslist64.ex
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/SysinternalsSuite/Pstools.ch
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/TrueCrypt/TrueCrypt Setup
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/winaudit/WinAudit.exe","2021-05-
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/ca-bundle.crt","2021
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/CHANGELOG","2021-0
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nmap-os-db","2021-05
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nmap-update.ex
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nmap.exe","2021-05-11
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/nselib/rdp.lua","202
ver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/scripts/h
Server2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/scrip
rver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/scripts
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/vcredist2008
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/vcredist_x64.exe"
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/Tools/nmap-6.47/vcredist_x86.exe"
ommon Files/microsoft shared/ink/FlickLearningWizard.exe","2021-05-06 17:07:47 CEST"
microsoft shared/ink/InkDiv.dll","2021-05-06 17:07:47 CEST"
microsoft shared/ink/InkObj.dll","2021-05-06 17:07:47 CEST"
ommon Files/microsoft shared/ink/InputPersonalization.exe","2021-05-06 17:07:47 CEST"
microsoft shared/ink/rtscom.dll","2021-05-06 17:07:47 CEST"
on Files/microsoft shared/ink/ShapeCollector.exe","2021-05-06 17:07:47 CEST"
microsoft shared/ink/tabskb.dll","2021-05-06 17:12:02 CEST"
microsoft shared/ink/tipskins.dll","2021-05-06 17:12:02 CEST"
crosoft shared/ink/tiptsf.dll","2021-05-06 17:12:02 CEST"
mmon Files/microsoft shared/ink/IpsMigrationPlugin.dll","2021-05-06 17:07:47 CEST"
s/microsoft shared/ink/IpsPlugin.dll","2021-05-06 17:07:47 CEST"
microsoft shared/ink/micaut.dll","2021-05-06 17:07:47 CEST"
crosoft shared/ink/mip.exe","2021-05-06 17:07:47 CEST"
microsoft shared/ink/mraut.dll","2021-05-06 17:07:47 CEST"
es/microsoft shared/ink/mshwLatin.dll","2021-05-06 17:07:47 CEST"
s/microsoft shared/VC/msdia100.dll","2021-05-07 15:15:34 CEST"
crosoft shared/VGX/VGX.dll","2021-05-06 17:07:47 CEST"
/ado/msado15.dll","2021-05-06 17:02:51 CEST"
m/ado/msadomd.dll","2021-05-06 17:02:50 CEST"
ado/msadox.dll","2021-05-06 17:02:50 CEST"
m/ado/msadrh15.dll","2021-05-06 17:02:50 CEST"
m/msadc/msadce.dll","2021-05-06 17:02:50 CEST"
m/msadc/msadco.dll","2021-05-06 17:02:50 CEST"
m/msadc/msadds.dll","2021-05-06 17:02:50 CEST"
em/msadc/msdaprst.dll","2021-05-06 17:02:50 CEST"
em/msadc/msdarem.dll","2021-05-06 17:02:50 CEST"
m/Ole DB/msdasql.dll","2021-05-06 17:02:50 CEST"
m/Ole DB/msdatl3.dll","2021-05-06 17:02:50 CEST"
m/Ole DB/oledb32.dll","2021-05-06 17:02:50 CEST"
m/Ole DB/sqloledb.dll","2021-05-06 17:02:50 CEST"
Chrome/Application/90.0.4430.93/chrome.dll","2021-05-07 12:14:44 CEST"
gle/Chrome/Application/90.0.4430.93/chrome_elf.dll","2021-05-07 12:14:44 CEST"
m Files/Google/Chrome/Application/90.0.4430.93/default_apps/youtube.crx","2021-05-07 12:14:44 CEST"
hrome/Application/90.0.4430.93/icudtl.dat","2021-05-07 12:14:44 CEST"
s/Google/Chrome/Application/90.0.4430.93/Installer/chrmstp.exe","2021-05-07 12:14:11 CEST"
Google/Chrome/Application/90.0.4430.93/Installer/setup.exe","2021-05-07 12:14:11 CEST"
les/Google/Chrome/Application/90.0.4430.93/notification_helper.exe","2021-05-07 12:14:44 CEST"
le/Chrome/Application/90.0.4430.93/resources.pak","2021-05-07 12:14:44 CEST"
6-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/WidevineCdm/_platform_specific/win_x64/widevinec
ication/chrome.exe","2021-05-07 12:14:44 CEST"
17:30:39 CEST"
:30:31 CEST"
alBox Guest Additions/VBoxGuest.inf","2021-05-06 16:20:07 CEST"
alBox Guest Additions/VBoxMouse.inf","2021-05-06 16:20:07 CEST"
Hacker.exe","2021-05-07 12:18:40 CEST"
","2021-05-07 12:18:40 CEST"
/ProcessHacker.exe","2021-05-07 12:18:38 CEST"
Scanner/netscan.exe","2021-05-07 12:16:08 CEST"
k Scanner/unins000.exe","2021-05-07 12:16:08 CEST"
1:07 CEST"
is.DLL","2021-05-06 17:07:47 CEST"
setup_wm.exe","2021-05-06 17:12:02 CEST"
wmlaunch.exe","2021-05-06 17:12:02 CEST"
mprph.exe","2021-05-06 17:07:47 CEST"
ows NT/TableTextService/TableTextServiceArray.txt","2021-05-06 17:07:47 CEST"
hotoAcq.dll","2021-05-06 17:12:02 CEST"
er/PhotoViewer.dll","2021-05-06 17:07:47 CEST"
ver2016-disk001.vmdk/vol_vol3/Program Files/WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagem
m Files/WindowsPowerShell/Modules/Pester/3.4.0/Functions/Mock.Tests.ps1","2021-05-06 17:02:51 CEST"
am Files/WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PSModule.psm1","2021-05-06 17:10:50 CEST"
der/AMMonitoringProvider.dll","2021-05-06 17:02:50 CEST"
dll","2021-05-06 16:15:52 CEST"
mu.dll","2021-05-06 17:02:51 CEST"
vider.dll","2021-05-06 17:02:50 CEST"
2021-05-06 16:15:53 CEST"
2021-05-06 16:15:52 CEST"
"2021-05-06 17:02:50 CEST"
.exe","2021-05-06 17:07:47 CEST"
","2021-05-06 17:07:47 CEST"
1-05-06 17:12:02 CEST"
5-06 17:29:45 CEST"
5-06 17:31:16 CEST"
17:31:14 CEST"
:31:13 CEST"
ommon Files/Microsoft Shared/DAO/dao360.dll","2021-05-06 17:07:47 CEST"
mon Files/Microsoft Shared/ink/InkDiv.dll","2021-05-06 17:07:47 CEST"
mon Files/Microsoft Shared/ink/InkObj.dll","2021-05-06 17:07:47 CEST"
mon Files/Microsoft Shared/ink/micaut.dll","2021-05-06 17:07:47 CEST"
mon Files/Microsoft Shared/ink/mraut.dll","2021-05-06 17:07:47 CEST"
Common Files/Microsoft Shared/ink/mshwLatin.dll","2021-05-06 17:07:47 CEST"
mon Files/Microsoft Shared/ink/rtscom.dll","2021-05-06 17:07:47 CEST"
mon Files/Microsoft Shared/ink/tiptsf.dll","2021-05-06 17:12:02 CEST"
ommon Files/Microsoft Shared/VC/msdia100.dll","2021-05-07 15:15:43 CEST"
mon Files/Microsoft Shared/VGX/VGX.dll","2021-05-06 17:07:47 CEST"
les/System/ado/msado15.dll","2021-05-06 17:02:51 CEST"
Files/System/ado/msadomd.dll","2021-05-06 17:02:51 CEST"
es/System/ado/msadox.dll","2021-05-06 17:02:51 CEST"
Files/System/ado/msadrh15.dll","2021-05-06 17:02:51 CEST"
Files/System/msadc/msadce.dll","2021-05-06 17:02:51 CEST"
Files/System/msadc/msadco.dll","2021-05-06 17:02:51 CEST"
Files/System/msadc/msadds.dll","2021-05-06 17:02:51 CEST"
n Files/System/msadc/msdaprst.dll","2021-05-06 17:02:51 CEST"
n Files/System/msadc/msdarem.dll","2021-05-06 17:02:51 CEST"
n Files/System/Ole DB/msdaora.dll","2021-05-06 17:02:51 CEST"
Files/System/Ole DB/msdasql.dll","2021-05-06 17:02:51 CEST"
Files/System/Ole DB/msdatl3.dll","2021-05-06 17:02:51 CEST"
Files/System/Ole DB/oledb32.dll","2021-05-06 17:10:50 CEST"
Files/System/Ole DB/sqloledb.dll","2021-05-06 17:02:51 CEST"
ate/1.3.36.82/goopdate.dll","2021-05-07 12:13:52 CEST"
Google/Update/1.3.36.82/GoogleCrashHandler.exe","2021-05-07 12:13:52 CEST"
6)/Google/Update/1.3.36.82/GoogleCrashHandler64.exe","2021-05-07 12:13:52 CEST"
am Files (x86)/Google/Update/1.3.36.82/GoogleUpdateComRegisterShell64.exe","2021-05-07 12:13:52 CEST"
oogle/Update/1.3.36.82/GoogleUpdateCore.exe","2021-05-07 12:13:52 CEST"
date/1.3.36.82/psmachine.dll","2021-05-07 12:13:52 CEST"
/Update/1.3.36.82/psmachine_64.dll","2021-05-07 12:13:52 CEST"
e/1.3.36.82/psuser.dll","2021-05-07 12:13:52 CEST"
date/1.3.36.82/psuser_64.dll","2021-05-07 12:13:52 CEST"
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/Google/Update/Download/{8A69D345-D564-463C-AFF1-A69D9E5
r/MpClient.dll","2021-05-06 17:02:52 CEST"
shellext.dll","2021-05-06 17:07:47 CEST"
ES.dll","2021-05-06 17:12:02 CEST"
Player/mpvis.DLL","2021-05-06 17:07:47 CEST"
edia Player/setup_wm.exe","2021-05-06 17:12:02 CEST"
edia Player/wmlaunch.exe","2021-05-06 17:12:02 CEST"
ia Player/wmprph.exe","2021-05-06 17:07:47 CEST"
(x86)/Windows NT/TableTextService/TableTextServiceArray.txt","2021-05-06 17:07:47 CEST"
to Viewer/PhotoAcq.dll","2021-05-06 17:12:02 CEST"
hoto Viewer/PhotoViewer.dll","2021-05-06 17:07:47 CEST"
wsServer2016-disk001.vmdk/vol_vol3/Program Files (x86)/WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.Packag
Program Files (x86)/WindowsPowerShell/Modules/Pester/3.4.0/Functions/Mock.Tests.ps1","2021-05-06 17:02:51 CEST"
Program Files (x86)/WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PSModule.psm1","2021-05-06 17:10:50 CEST"
","2021-05-06 17:10:50 CEST"
","2021-05-06 17:10:50 CEST"
stics.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/GAC_MSIL/Microsoft.PowerShell.Commands.Diagno
mands.Diagnostics.resources.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/GAC_MSIL/Microsoft.PowerS
dowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/GAC_MSIL/System.Management.Automation/1.0.0.0__31bf3856ad364e35
le,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft.Baa2ca56b#/25d1a58
Diagnostics.ni.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft.P17
.Management.ni.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/Microsoft
ices.ServerManager.DeploymentPlugin.ni.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v
erver2016-disk001.vmdk/vol_vol3/Windows/assembly/NativeImages_v4.0.30319_32/MIGUIControls/cbed01df96b8486a809135335afb6
wsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_3/data_3__c
wsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_3/data_3__c3
wsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_3/data_3__c
wsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_3/data_3__c3
wsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/data_3/data_3__c
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000004/f_000004/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000006/f_000006/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00000a/f_00000a/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00000d/f_00000d/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000014/f_000014/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000015/f_000015/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000018/f_000018/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000034/f_000034/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00003a/f_00003a/0",
_WindowsServer2016-disk001.vmdk/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00003b/
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00003c/f_00003c/0",
/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00005f/f_00005f/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000062/f_000062/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000063/f_000063/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00007e/f_00007e/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000080/f_000080/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_000081/f_000081/0",
k/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00008e/f_00008e/0",
/vol_vol3/Users/Administrador/AppData/Local/Google/Chrome/User Data/Default/Cache/f_00008f/f_00008f/0",
r2016-disk001.vmdk/vol_vol3/Users/Administrador/Downloads/2.2.0 20200918 Zerologon encrypted.zip/gentilkiwi-mimikatz-09fb1f6/mo
m Live Data Gathering Checklist.docx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363
wsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_R
xe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.z
wsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Re
,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Wi
defs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26M
xe,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windo
g_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Window
g_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Window
_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Win
WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_L
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Window
.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP
020.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26M
o.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Wind
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Wind
g_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Window
ile,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Win
s.lst,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Window
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Win
020.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26M
o.nse,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MM
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Wind
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Wind
wsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Re
ndowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Liv
WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Li
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Window
e,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/W
ile,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/W
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/
le,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/W
,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windo
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Win
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Win
e,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/W
WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_
ager_Lite_3.1.1/adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-
ager_Lite_3.1.1/icudt44.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122
ager_Lite_3.1.1/langs/chs_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
ager_Lite_3.1.1/langs/deu_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
ager_Lite_3.1.1/langs/esp_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
ager_Lite_3.1.1/langs/fra_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20
ager_Lite_3.1.1/langs/ita_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20
ager_Lite_3.1.1/langs/jpn_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20
ager_Lite_3.1.1/langs/kor_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
ager_Lite_3.1.1/langs/nld_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20
ager_Lite_3.1.1/langs/ptb_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
ager_Lite_3.1.1/langs/sve_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2
ager_Lite_3.1.1/langs/trk_adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20
ager_Lite_3.1.1/ProfUIS293ad32.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083633
s.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
ile,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/To
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
adshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
dshattrdefs.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
ad32.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Application.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Re
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/HardwareEvents.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Internet Explorer.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Key Management Service.evtx,File,"/img_WindowsServer2016-disk001.vmdk
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Client-Licensing-Platform%4Admin.evtx,File,"/img_WindowsServer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Assista
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Trouble
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Inventory.evtx,File,"/
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx,File,"
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx,File,"/img
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ApplicationResourceManagementSystem%4Operational
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppModel-Runtime%4Admin.evtx,File,"/img_WindowsS
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Admin.evtx,File,"/img_WindowsServer2
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Operational.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeployment%4Operational.evtx,File,"/img_Window
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%4Operational.evtx,File,"/img_W
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx,File,"/img_Wi
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx,File,"/
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Biometrics%4Operational.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Bits-Client%4Operational.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Containers-Wcifs%4Operational.evtx,File,"/img_Window
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Containers-Wcnfs%4Operational.evtx,File,"/img_Window
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx,File,"/img_Windows
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4Operational.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4A
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Admin.evtx,File,"/img_Windows
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Operational.evtx,File,"/img_Win
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Dhcp-Client%4Admin.evtx,File,"/img_WindowsServer201
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Dhcpv6-Client%4Admin.evtx,File,"/img_WindowsServer2
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Diagnosis-PLA%4Operational.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx,File,"/img_Wind
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-FileServices-ServerManager-EventProvider%4Admin.evtx
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-FileServices-ServerManager-EventProvider%4Operationa
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx,File,"/img_WindowsServ
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-HomeGroup Control Panel%4Operational.evtx,File,"/img
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-IKE%4Operational.evtx,File,"/img_WindowsServer2016-d
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-International%4Operational.evtx,File,"/img_WindowsSer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Iphlpsvc%4Operational.evtx,File,"/img_WindowsServer2
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-Boot%4Operational.evtx,File,"/img_WindowsServ
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-IO%4Operational.evtx,File,"/img_WindowsServer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx,File,"/img_WindowsSer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx,File,"/img_W
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx,File,"/img_Windo
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx,File,"/img_Window
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Errors.evtx,File,"/img_WindowsServer20
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Operational.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Known Folders API Service.evtx,File,"/img_WindowsServ
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-LiveId%4Operational.evtx,File,"/img_WindowsServer201
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-MUI%4Admin.evtx,File,"/img_WindowsServer2016-disk0
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-MUI%4Operational.evtx,File,"/img_WindowsServer2016
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NCSI%4Operational.evtx,File,"/img_WindowsServer2016
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx,File,"/img_WindowsS
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx,File,"/img_WindowsServer20
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Ntfs%4Operational.evtx,File,"/img_WindowsServer2016
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Ntfs%4WHC.evtx,File,"/img_WindowsServer2016-disk00
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PrintService%4Admin.evtx,File,"/img_WindowsServer20
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%4Admin.evtx,File,"/img_Wind
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%4Operational.evtx,File,"/img_
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx,File,"/
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx,
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-SessionServices%4Operational.e
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx,File,"/
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RestartManager%4Operational.evtx,File,"/img_Windows
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx,File,"
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-DeploymentProvider%4Operational.evtx
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MgmtProvider%4Operational.evtx,File,"
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiMachine%4Admin.evtx,File,"/img_
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiMachine%4Operational.evtx,File,"/
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SettingSync%4Debug.evtx,File,"/img_WindowsServer201
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SettingSync%4Operational.evtx,File,"/img_WindowsServ
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx,File,"
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4ActionCenter.evtx,File,"/img_WindowsServ
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4AppDefaults.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx,File,"/img_Window
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4Operational.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmartCard-DeviceEnum%4Operational.evtx,File,"/img_W
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBClient%4Operational.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmbClient%4Security.evtx,File,"/img_WindowsServer201
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Audit.evtx,File,"/img_WindowsServer2016
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx,File,"/img_WindowsServ
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Operational.evtx,File,"/img_WindowsServe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Security.evtx,File,"/img_WindowsServer20
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Admin.evtx,File,"/img_WindowsSer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Informational.evtx,File,"/img_Wind
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StateRepository%4Operational.evtx,File,"/img_Windows
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StateRepository%4Restricted.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx,File,"/im
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Store%4Operational.evtx,File,"/img_WindowsServer201
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TaskScheduler%4Maintenance.evtx,File,"/img_Windows
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx,Fil
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.ev
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%4Admin.evtx,File,"/img_Wind
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%4Operational.evtx,File,"/img_
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operati
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TWinUI%4Operational.evtx,File,"/img_WindowsServer20
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx,File,"/img_
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-User Profile Service%4Operational.evtx,File,"/img_Windo
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UserPnp%4ActionCenter.evtx,File,"/img_WindowsServer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx,File,"/img_WindowsServer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx,File,"/img_W
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-VPN%4Operational.evtx,File,"/img_WindowsServer2016
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Wcmsvc%4Operational.evtx,File,"/img_WindowsServer2
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WFP%4Operational.evtx,File,"/img_WindowsServer2016
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Defender%4Operational.evtx,File,"/img_Windo
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Defender%4WHC.evtx,File,"/img_WindowsSer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4Connection
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evt
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx,File,"/img_Wi
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx,File,"/img_W
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Winlogon%4Operational.evtx,File,"/img_WindowsServer
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WinRM%4Operational.evtx,File,"/img_WindowsServer20
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WMI-Activity%4Operational.evtx,File,"/img_WindowsSe
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Security.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recyc
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Setup.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/System.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycl
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Windows PowerShell.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol
507_151521/LiveResponseData/CopiedFiles/prefetch,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846
owsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.44
widevinecdm.dll,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Install
isk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/icudtl.dat
16-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/resou
disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/chrome.
016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/chro
sServer2016-disk001.vmdk/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430
k/vol_vol3/Program Files/Google/Chrome/Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/chrome.exe",
amData/Microsoft/Event Viewer/Views/ServerRoles/RemoteDesktop.Events.xml","2021-05-06 17:02:52 CEST"
021-05-10 12:59:31 CEST"
Screen_Z/LockScreen___1024_0768_notdimmed.jpg","2021-05-06 16:18:20 CEST"
5059-B96F-4B57-849F-CA4EB86C4CF3}/mpasbase.vdm","2021-05-10 11:31:11 CEST"
059-B96F-4B57-849F-CA4EB86C4CF3}/mpasdlta.vdm","2021-05-10 11:31:11 CEST"
5059-B96F-4B57-849F-CA4EB86C4CF3}/mpavbase.vdm","2021-05-10 11:31:11 CEST"
59-B96F-4B57-849F-CA4EB86C4CF3}/mpengine.dll","2021-05-10 11:30:41 CEST"
144E3F40A5E3CEA9519F165DB45.bin.A0","2021-05-10 11:31:10 CEST"
4E3F40A5E3CEA9519F165DB45.bin","2021-05-10 11:31:10 CEST"
144E3F40A5E3CEA9519F165DB45.bin.67","2021-05-10 11:30:53 CEST"
144E3F40A5E3CEA9519F165DB45.bin.79","2021-05-10 11:31:02 CEST"
144E3F40A5E3CEA9519F165DB45.bin.7C","2021-05-10 11:31:07 CEST"
144E3F40A5E3CEA9519F165DB45.bin.7E","2021-05-10 11:31:07 CEST"
144E3F40A5E3CEA9519F165DB45.bin.80","2021-05-10 11:31:10 CEST"
-00000003-ffffffff.bin","2021-05-07 10:29:19 CEST"
-00000003-ffffffff.bin","2021-05-10 18:10:50 CEST"
06 17:30:07 CEST"
:15:48 CEST"
s/a82444b92fb85fb7_0","2021-05-07 12:35:31 CEST"
/30f3b5e1e27f5ce4_0","2021-05-07 12:16:33 CEST"
/a2f8c54c35cc7cc8_0","2021-05-07 12:16:32 CEST"
ata/Local/Google/Chrome/User Data/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_0/_metadata/computed_hashes
ocal/Google/Chrome/User Data/Default/Extensions/pkedcjkdefgpdelpbcmbmeomcjbeemfm/9021.222.0.0_0/mirroring_hangouts.js","202
_13264856418938881","2021-05-07 12:20:18 CEST"
_13264857228958276","2021-05-07 12:36:38 CEST"
21-05-07 12:36:38 CEST"
21-05-07 12:16:38 CEST"
21-05-07 12:16:37 CEST"
003_64.dll","2021-05-07 12:34:12 CEST"
0.261.200/software_reporter_tool.exe","2021-05-07 12:19:38 CEST"
icrosoft/Internet Explorer/Recovery/High/Last Active/RecoveryStore.{EBE1278E-AF0A-11EB-A0B5-0800279357BC}.dat","2021-05-07 10:05
et Explorer/Recovery/High/Last Active/{EBE1278F-AF0A-11EB-A0B5-0800279357BC}.dat","2021-05-07 10:05:01 CEST"
ows/Caches/{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db","2021-05-10 11:21:12 CEST"
/Administrador/AppData/Local/Packages/Microsoft.Windows.Cortana_cw5n1h2txyewy/LocalState/ConstraintIndex/Input_{a069a524-78
l/Packages/Microsoft.Windows.Cortana_cw5n1h2txyewy/LocalState/DeviceSearchCache/AppCache132647843412588436.txt","2021-05-
l/Packages/Microsoft.Windows.Cortana_cw5n1h2txyewy/LocalState/DeviceSearchCache/AppCache132647843469173413.txt","2021-05-
49:21 CEST"
5-11 12:34:05 CEST"
-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/ev
Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFi
.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedF
$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/
,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-
vtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DH
Server2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20
img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/L
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_
ver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021
er2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1
r2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_202105
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Liv
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/L
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021050
_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JT
"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-S
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
Server2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20
dk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveRe
sk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1515
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/L
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/
sk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1515
er2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210
016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Li
isk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Live
ol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveRespo
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveR
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveR
-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Liv
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveR
_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveRespons
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Liv
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF
2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021050
erver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DH
WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF0
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DH
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DH
_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JT
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DH
rver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_202
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Liv
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
owsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DH
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
16-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
ver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Liv
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveR
k001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15152
.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Liv
sk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1515
2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021050
6-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
sServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Live
-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15
indowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01
2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021050
erver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_202
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF0
ile,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WI
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Li
erver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_202
016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/
ver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveR
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/L
mdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveR
016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507
sk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1515
tx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
g_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01J
er2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210
rver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021
01.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/
1.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/Li
sk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1515
5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/even
21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlo
-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/event
ycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/logfile/$LogFile","2
208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/mft/$MFT","2021-05-11
8363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/prefetch","2021-05-11 12
846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/registry/CO
6813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/registry/SOFTW
3697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/registry/SYSTEM"
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/usnjrnl/$U
Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFi
Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFi
e.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copied
6813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/forecopy_han
1-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/PersistenceMechan
1-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/PersistenceMechani
-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/PersistenceMech
3697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/BasicInfo/Full_file_listing.txt",
Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/B
/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
63348-2122892913-500/$R5A4NMW/Checklists/Compromised Windows System Live Data Gathering Checklist.docx","2021-05-11 12:35:0
ws.txt","2021-05-11 12:35:06 CEST"
W/Tools/ExtractUsnJrnl/ExtractUsnJrnl64.exe","2021-05-11 12:35:06 CEST"
.exe","2021-05-11 12:35:06 CEST"
ols/forecopy/forecopy_handy.exe","2021-05-11 12:35:06 CEST"
A4NMW/Tools/FTKImager-commandline/adshattrdefs.dll","2021-05-11 12:35:06 CEST"
MW/Tools/lastactivityview/LastActivityView.exe","2021-05-11 12:35:06 CEST"
/lastactivityview/readme.txt","2021-05-11 12:35:06 CEST"
map-7.70/CHANGELOG","2021-05-11 12:35:06 CEST"
Tools/nmap-7.70/nmap-service-probes","2021-05-11 12:35:06 CEST"
ols/nmap-7.70/nmap-update.exe","2021-05-11 12:35:06 CEST"
MW/Tools/nmap-7.70/nselib/data/wp-plugins.lst","2021-05-11 12:35:06 CEST"
nmap-7.70/nselib/rdp.lua","2021-05-11 12:35:06 CEST"
ols/nmap-7.70/nselib/tn3270.lua","2021-05-11 12:35:06 CEST"
A4NMW/Tools/nmap-7.70/scripts/rdp-vuln-ms12-020.nse","2021-05-11 12:35:06 CEST"
4NMW/Tools/nmap-7.70/scripts/smb-system-info.nse","2021-05-11 12:35:06 CEST"
/Tools/nmap-7.70/vcredist2008_x86.exe","2021-05-11 12:35:06 CEST"
s/nmap-7.70/vcredist_x86.exe","2021-05-11 12:35:06 CEST"
ls/pestudio889/xml/strings.xml","2021-05-11 12:35:06 CEST"
o.txt","2021-05-11 12:35:06 CEST"
w/PrcMon.dll","2021-05-11 12:35:06 CEST"
ew/PrcView.exe","2021-05-11 12:35:06 CEST"
RawCopy/RawCopy64.exe","2021-05-11 12:35:06 CEST"
ools/SysinternalsSuite/Autoruns.exe","2021-05-11 12:35:06 CEST"
Tools/SysinternalsSuite/Autoruns64.dll","2021-05-11 12:35:06 CEST"
/Tools/SysinternalsSuite/Autoruns64.exe","2021-05-11 12:35:06 CEST"
Tools/SysinternalsSuite/autorunsc.exe","2021-05-11 12:35:06 CEST"
W/Tools/SysinternalsSuite/autorunsc64.exe","2021-05-11 12:35:06 CEST"
/SysinternalsSuite/pslist.exe","2021-05-11 12:35:06 CEST"
ols/SysinternalsSuite/pslist64.exe","2021-05-11 12:35:06 CEST"
ols/SysinternalsSuite/Pstools.chm","2021-05-11 12:35:06 CEST"
ools/TrueCrypt/TrueCrypt Setup.exe","2021-05-11 12:35:06 CEST"
naudit/WinAudit.exe","2021-05-11 12:35:06 CEST"
map-6.47/ca-bundle.crt","2021-05-11 12:35:06 CEST"
map-6.47/CHANGELOG","2021-05-11 12:35:06 CEST"
map-6.47/nmap-os-db","2021-05-11 12:35:06 CEST"
ols/nmap-6.47/nmap-update.exe","2021-05-11 12:35:06 CEST"
p-6.47/nmap.exe","2021-05-11 12:35:06 CEST"
nmap-6.47/nselib/rdp.lua","2021-05-11 12:35:06 CEST"
NMW/Tools/nmap-6.47/scripts/http-affiliate-id.nse","2021-05-11 12:35:06 CEST"
A4NMW/Tools/nmap-6.47/scripts/rdp-vuln-ms12-020.nse","2021-05-11 12:35:06 CEST"
4NMW/Tools/nmap-6.47/scripts/smb-system-info.nse","2021-05-11 12:35:06 CEST"
/Tools/nmap-6.47/vcredist2008_x86.exe","2021-05-11 12:35:06 CEST"
s/nmap-6.47/vcredist_x64.exe","2021-05-11 12:35:06 CEST"
s/nmap-6.47/vcredist_x86.exe","2021-05-11 12:35:06 CEST"
rm_specific/win_x64/widevinecdm.dll","2021-05-07 12:14:44 CEST"
.1/Microsoft.PackageManagement.MsuProvider.dll","2021-05-06 17:02:51 CEST"
D345-D564-463C-AFF1-A69D9E530F96}/90.0.4430.93/90.0.4430.93_chrome_installer.exe","2021-05-07 12:14:01 CEST"
ment/1.0.0.1/Microsoft.PackageManagement.MsuProvider.dll","2021-05-06 17:02:51 CEST"
7:02:51 CEST"
17:10:50 CEST"
.PowerShell.Commands.Diagnostics/1.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.Commands.Diagnostics.dll","2021-05-06 17:02:52
ly/GAC_MSIL/Microsoft.PowerShell.Commands.Diagnostics.Resources/1.0.0.0_es_31bf3856ad364e35/Microsoft.PowerShell.Commands.D
n/1.0.0.0__31bf3856ad364e35/System.Management.Automation.dll","2021-05-06 17:02:52 CEST"
Microsoft.Baa2ca56b#/25d1a58ad398684c5b9f8590d778c729/Microsoft.Build.Tasks.v4.0.ni.dll","2021-05-10 13:06:51 CEST"
s_v4.0.30319_32/Microsoft.P1706cafe#/2d34a6f7d4f6c87db716364364cbe53d/Microsoft.PowerShell.Commands.Diagnostics.ni.dll","202
ages_v4.0.30319_32/Microsoft.Pae3498d9#/e7182cd347c7b82372b80da07a435e4a/Microsoft.PowerShell.Commands.Management.ni.d
dows/assembly/NativeImages_v4.0.30319_32/Microsoft.R251a4777#/ca6a0bbfdea1b54b878fd7503822e857/Microsoft.RightsManageme
d01df96b8486a809135335afb66cb/MIGUIControls.ni.dll","2021-05-06 16:47:57 CEST"
efault/Cache/data_3/data_3__c3030384/data_3__c3030384/0",
fault/Cache/data_3/data_3__c30300ec/data_3__c30300ec/0",
efault/Cache/data_3/data_3__c10300a0/data_3__c10300a0/0",
fault/Cache/data_3/data_3__c30300c8/data_3__c30300c8/0",
efault/Cache/data_3/data_3__c3030378/data_3__c3030378/0",
Data/Default/Cache/f_00003b/gentilkiwi-mimikatz-09fb1f6/modules/sqlite3.c",
gentilkiwi-mimikatz-09fb1f6/modules/sqlite3.c",
n/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Checklists/Compromised Windows System
RJ26MMP.zip/Windows_Live_Response/README-Windows.txt",
-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/ExtractUsnJrnl/ExtractUsnJrnl64.exe",
RJ26MMP.zip/Windows_Live_Response/Tools/FGET/FGET.exe",
892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/forecopy/forecopy_handy.exe",
63348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTKImager-commandline/adshattrdefs.dll",
8-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/lastactivityview/LastActivityView.exe",
2913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/lastactivityview/readme.txt",
13-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/ca-bundle.crt",
13-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/CHANGELOG",
3-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nmap-os-db",
892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nmap-update.exe",
500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nmap.exe",
913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/nselib/rdp.lua",
48-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/scripts/http-affiliate-id.nse",
63348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/scripts/rdp-vuln-ms12-020.nse",
348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/scripts/smb-system-info.nse",
122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/vcredist2008_x86.exe",
92913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/vcredist_x64.exe",
92913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-6.47/vcredist_x86.exe",
13-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/CHANGELOG",
22892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nmap-service-probes",
892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nmap-update.exe",
48-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nselib/data/wp-plugins.lst",
913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nselib/rdp.lua",
92913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/nselib/tn3270.lua",
63348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/scripts/rdp-vuln-ms12-020.nse",
348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/scripts/smb-system-info.nse",
122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/vcredist2008_x86.exe",
92913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/nmap-7.70/vcredist_x86.exe",
92913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/pestudio889/xml/strings.xml",
RJ26MMP.zip/Windows_Live_Response/Tools/PrcView/foo.txt",
0/$RJ26MMP.zip/Windows_Live_Response/Tools/PrcView/PrcMon.dll",
500/$RJ26MMP.zip/Windows_Live_Response/Tools/PrcView/PrcView.exe",
913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/RawCopy/RawCopy64.exe",
2892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Autoruns.exe",
22892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Autoruns64.dll",
122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Autoruns64.exe",
22892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/autorunsc.exe",
2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/autorunsc64.exe",
2913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/pslist.exe",
892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/pslist64.exe",
892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/SysinternalsSuite/Pstools.chm",
2892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/TrueCrypt/TrueCrypt Setup.exe",
3-500/$RJ26MMP.zip/Windows_Live_Response/Tools/winaudit/WinAudit.exe",
-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_
1-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
ycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/F
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
cle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FT
/S-1-5-21-1846813697-208363348-2122892913-500/$RJ26MMP.zip/Windows_Live_Response/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Ima
48-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/adshattrdefs.dll",
22892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/icudt44.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/chs_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/deu_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/esp_adshattrdefs.dll",
-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/fra_adshattrdefs.dll",
-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ita_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/jpn_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/kor_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/nld_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ptb_adshattrdefs.dll",
7-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/sve_adshattrdefs.dll",
-208363348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/trk_adshattrdefs.dll",
63348-2122892913-500/$R5A4NMW/Tools/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/ProfUIS293ad32.dll",
016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507
ver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021
rver2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2021
ndowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2D
evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
4Program-Compatibility-Assistant.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20836
4Program-Compatibility-Troubleshooter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697
4Program-Inventory.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
4Program-Telemetry.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
4Steps-Recorder.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289291
agementSystem%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083633
dmin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A
evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
onal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A
rational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R
%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-
%4Restricted.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-50
cture%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
l.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
onal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
ational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R
rational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R
KeySvc.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
onal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
erprise-Diagnostics-Provider%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20
Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-50
x,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/
evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
onal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500
ger-EventProvider%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-
ger-EventProvider%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363
nal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
el%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289291
le,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN
nal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
vtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
al.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
on.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
-Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-50
erational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
ational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
vtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
onal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
e.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
x,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
tional.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A
tx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
mg_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01
tx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/
ssistant%4CompatAfterUpgrade.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363
m%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500
m%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913
RdpCoreTS%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
RdpCoreTS%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2
SessionServices%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083633
tector%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
ational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
tions%4ActionCenter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
entProvider%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2
ovider%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
chine%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913
chine%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212289
x,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/
al.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
State%4ActionCenter.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-21228
er.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
s.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
Channel.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$
.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-5
y.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
l.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
x,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
ty.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
al.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
tx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
min.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
ormational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
tional.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
cted.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A
mentAgent%4WHC.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-21228929
,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
nance.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5
ssionManager%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-212
ssionManager%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-20836334
s%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500
s%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913
eConnectionManager%4Admin.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-2083633
eConnectionManager%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208
vtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
t%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913
perational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
%4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-5
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
vtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/W
perational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/
HC.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4N
dvanced Security%4ConnectionSecurity.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-
dvanced Security%4Firewall.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348
4Operational.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-50
ConfigChanged.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-
evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NM
vtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW
nal.evtx,File,"/img_WindowsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4
-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_15
sk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_1515
disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151
wsServer2016-disk001.vmdk/vol_vol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_2
ol3/$Recycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JT
chrome.7z/Chrome-bin/90.0.4430.93/default_apps/youtube.crx",
Application/90.0.4430.93/Installer/chrome.7z/Chrome-bin/90.0.4430.93/WidevineCdm/_platform_specific/win_x64/widevinecdm.dll",
me-bin/90.0.4430.93/icudtl.dat",
Chrome-bin/90.0.4430.93/resources.pak",
ome-bin/90.0.4430.93/chrome.dll",
Chrome-bin/90.0.4430.93/chrome_elf.dll",
rome.7z/Chrome-bin/90.0.4430.93/notification_helper.exe",
0/_metadata/computed_hashes.json","2021-05-07 12:15:16 CEST"
_0/mirroring_hangouts.js","2021-05-07 12:15:10 CEST"
9357BC}.dat","2021-05-07 10:05:01 CEST"
05:01 CEST"
:21:12 CEST"
raintIndex/Input_{a069a524-78e3-42b5-b82c-863565c1790e}/appssynonyms.txt","2021-05-06 16:19:10 CEST"
47843412588436.txt","2021-05-06 16:19:02 CEST"
47843469173413.txt","2021-05-06 16:19:09 CEST"
veResponseData/CopiedFiles/eventlogs/Logs/Application.evtx","2021-05-11 12:35:06 CEST"
21/LiveResponseData/CopiedFiles/eventlogs/Logs/HardwareEvents.evtx","2021-05-11 12:35:06 CEST"
521/LiveResponseData/CopiedFiles/eventlogs/Logs/Internet Explorer.evtx","2021-05-11 12:35:06 CEST"
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Key Management Service.evtx","2021-05-11 12:35:06 CEST"
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Client-Licensing-Platform%4Admin.evtx","2021-
892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-App
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Window
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Expe
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Expe
A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experien
2913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Applic
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppModel-Runtime%4Admin.evt
1JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Admin.evtx","2021-0
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Operational.evt
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeployment%4Operatio
NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServe
MW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-BackgroundTaskI
F01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Biometrics%4Operational.evtx","202
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Bits-Client%4Operational.evtx","2021
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Containers-Wcifs%4Operation
/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Containers-Wcnfs%4Operatio
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4Operational.evtx
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Admin
MW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4O
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Dhcp-Client%4Admin.evtx","2021-05-11
1JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Dhcpv6-Client%4Admin.evtx","2021-0
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Diagnosis-PLA%4Operational.evtx
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Diagnosis-Scheduled%4Op
3-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-FileServic
92913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-FileS
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx","2
A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-HomeGroup Control
2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-IKE%4Operational.evtx","2021-05-11 12:35:
-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-International%4Operational.evtx"
1JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Iphlpsvc%4Operational.evtx","2021-05
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-Boot%4Operational.evtx","2
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-IO%4Operational.evtx","2021-
-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx",
MW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-Power%4Therma
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-ShimEngine%4Opera
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-StoreMgr%4Operationa
JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Errors.evtx","2021-05-1
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Operational.evtx
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Known Folders API Service.evtx","20
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-LiveId%4Operational.evtx","2021-05-11 1
I_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-MUI%4Admin.evtx","2021-05-11 12:35:06 CEST"
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-MUI%4Operational.evtx","2021-05-11 12:3
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NCSI%4Operational.evtx","2021-05-11 12:
IN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NetworkProfile%4Operational.e
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx","2021-05-11
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Ntfs%4Operational.evtx","2021-05-11 12:3
20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Ntfs%4WHC.evtx","2021-05-11 12:35:06 CEST"
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PrintService%4Admin.evtx","2021-05-11
92913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Progr
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%
A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PushNotification-Platf
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktop
-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDes
2913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Remot
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Resource-Exhaus
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RestartManager%4Operationa
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Security-SPP-UX
3-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerMan
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-
4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiM
$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-M
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SettingSync%4Debug.evtx","2021-05-11 1
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SettingSync%4Operational.evtx","20
/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Connected
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4ActionCenter.evtx","20
F01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4AppDefaults.evtx","202
/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4LogonTasksChan
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4Operational.evtx","2021
NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmartCard-DeviceEnum
F01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx","202
F01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBClient%4Operational.evtx","202
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmbClient%4Security.evtx","2021-05-11
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Audit.evtx","2021-05-11 12:3
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx","20
F01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Operational.evtx","20
JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Security.evtx","2021-05-1
-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Admin.evtx"
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Inform
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StateRepository%4Operational
N-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StateRepository%4Restricted.evt
5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StorageSpaces-Man
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Store%4Operational.evtx","2021-05-11 12
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TaskScheduler%4Maintenance.
00/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServ
913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Termina
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%
4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Prin
2913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Termin
22892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-T
JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TWinUI%4Operational.evtx","2021-05-1
4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UniversalTelemetryCli
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-User Profile Service%4Oper
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UserPnp%4ActionCenter.evtx","2021
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx","2021-0
NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-VolumeSnapshot-Drive
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-VPN%4Operational.evtx","2021-05-11 12:3
1JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Wcmsvc%4Operational.evtx","2021-05
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WFP%4Operational.evtx","2021-05-11 12:
W/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Defender%4Opera
SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Defender%4WHC.evtx","
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Window
13-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows
MW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WindowsUpdateClient%
NMW/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WinINet-Config%4Prox
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Winlogon%4Operational.evtx","2021-
JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WinRM%4Operational.evtx","2021-05-1
-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WMI-Activity%4Operational.evtx"
ResponseData/CopiedFiles/eventlogs/Logs/Security.evtx","2021-05-11 12:35:06 CEST"
ponseData/CopiedFiles/eventlogs/Logs/Setup.evtx","2021-05-11 12:35:06 CEST"
esponseData/CopiedFiles/eventlogs/Logs/System.evtx","2021-05-11 12:35:06 CEST"
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Windows PowerShell.evtx","2021-05-11 12:35:06 CEST"
/CopiedFiles/logfile/$LogFile","2021-05-11 12:35:06 CEST"
edFiles/mft/$MFT","2021-05-11 12:35:06 CEST"
dFiles/prefetch","2021-05-11 12:35:06 CEST"
nseData/CopiedFiles/registry/COMPONENTS","2021-05-11 12:35:06 CEST"
Data/CopiedFiles/registry/SOFTWARE","2021-05-11 12:35:06 CEST"
a/CopiedFiles/registry/SYSTEM","2021-05-11 12:35:06 CEST"
nseData/CopiedFiles/usnjrnl/$UsnJrnl_$J.bin","2021-05-11 12:35:06 CEST"
521/LiveResponseData/CopiedFiles/chrome/Administrador/cache/data_1","2021-05-11 12:35:06 CEST"
521/LiveResponseData/CopiedFiles/chrome/Administrador/cache/data_3","2021-05-11 12:35:06 CEST"
1521/LiveResponseData/CopiedFiles/chrome/Administrador/history/History","2021-05-11 12:35:06 CEST"
Data/CopiedFiles/forecopy_handy.log","2021-05-11 12:35:06 CEST"
ponseData/PersistenceMechanisms/autorunsc.csv","2021-05-11 12:35:06 CEST"
ponseData/PersistenceMechanisms/autorunsc.txt","2021-05-11 12:35:06 CEST"
ResponseData/PersistenceMechanisms/Startup_wmic.txt","2021-05-11 12:35:06 CEST"
a/BasicInfo/Full_file_listing.txt","2021-05-11 12:35:06 CEST"
7_151521/LiveResponseData/BasicInfo/Hashes_md5_System32_AllFiles_and_Dates.txt","2021-05-11 12:35:06 CEST"
0507_151521/LiveResponseData/BasicInfo/Hashes_sha256_System32_AllFiles_and_Dates.txt","2021-05-11 12:35:06 CEST"
cklist.docx","2021-05-11 12:35:06 CEST"
2:14:01 CEST"
ostics.dll","2021-05-06 17:02:52 CEST"
crosoft.PowerShell.Commands.Diagnostics.resources.dll","2021-05-06 17:02:52 CEST"
-10 13:06:51 CEST"
mmands.Diagnostics.ni.dll","2021-05-10 13:06:59 CEST"
ll.Commands.Management.ni.dll","2021-05-10 13:07:00 CEST"
857/Microsoft.RightsManagementServices.ServerManager.DeploymentPlugin.ni.dll","2021-05-10 13:07:36 CEST"
/Compromised Windows System Live Data Gathering Checklist.docx",
2-020.nse",
2-020.nse",
ger_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/adshattrdefs.dll",
Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/icudt44.dll",
ls/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/chs_adshattrdefs.dll",
ls/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/deu_adshattrdefs.dll",
ls/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/esp_adshattrdefs.dll",
s/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/fra_adshattrdefs.dll",
s/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ita_adshattrdefs.dll",
s/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/jpn_adshattrdefs.dll",
s/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/kor_adshattrdefs.dll",
s/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/nld_adshattrdefs.dll",
ls/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/ptb_adshattrdefs.dll",
ls/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/sve_adshattrdefs.dll",
s/FTK_Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/langs/trk_adshattrdefs.dll",
Imager_Lite_3.1.1.zip/FTK_Imager_Lite_3.1.1/ProfUIS293ad32.dll",
s/chs_adshattrdefs.dll",
gs/deu_adshattrdefs.dll",
gs/esp_adshattrdefs.dll",
s/fra_adshattrdefs.dll",
s/ita_adshattrdefs.dll",
s/jpn_adshattrdefs.dll",
s/kor_adshattrdefs.dll",
s/nld_adshattrdefs.dll",
gs/ptb_adshattrdefs.dll",
s/sve_adshattrdefs.dll",
s/trk_adshattrdefs.dll",
/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Applic
NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/H
NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/I
0/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlog
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210
cycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_
846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521
813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/Live
/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_2021050
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseD
48-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Co
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDa
208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespons
3697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRe
697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRes
846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDa
08363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponse
208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespons
08363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponse
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDa
le.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20
08363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponse
97-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResp
-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
48-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Co
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDa
97-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespo
-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_1
n/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_202105
63348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/Live
22892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedF
63348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDat
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Co
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
48-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
63348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDat
697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRes
-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespon
08363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponse
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Co
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDa
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copi
92913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copied
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copie
8363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseD
-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copied
913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/e
-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
n/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_202105
97-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespo
813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/Live
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521
5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_15
S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_2021050
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521
08363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponse
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521
-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_1
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521
13697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveR
846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/
2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copi
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/
208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespons
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
3697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRe
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/
-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copied
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData
3348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
63348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDat
7-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespo
08363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponse
363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDa
46813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/Li
2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copie
8363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseD
21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_1515
-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507
7-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespo
813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/Live
S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_2021050
e.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_202
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
13697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveR
7-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespo
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
48-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
3697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRe
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copied
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Co
122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Copie
7-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRespon
63348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDat
cycle.Bin/S-1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_
1-5-21-1846813697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_
697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveRes
13697-208363348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveR
348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/C
8-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/Cop
63348-2122892913-500/$R5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseDat
IN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Security.e
-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Setup.evtx"
N-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/System.ev
5A4NMW/WIN-SF01JTM2DHI_20210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Lo
210507_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/prefetch",
/win_x64/widevinecdm.dll",
2:35:06 CEST"
-Platform%4Admin.evtx","2021-05-11 12:35:06 CEST"
s/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx","2021-05-11 12:35:06 CEST"
ventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx","2021-05-11 12:35:06 CEST"
soft-Windows-Application-Experience%4Program-Inventory.evtx","2021-05-11 12:35:06 CEST"
osoft-Windows-Application-Experience%4Program-Telemetry.evtx","2021-05-11 12:35:06 CEST"
-Windows-Application-Experience%4Steps-Recorder.evtx","2021-05-11 12:35:06 CEST"
Logs/Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx","2021-05-11 12:35:06 CEST"
ppModel-Runtime%4Admin.evtx","2021-05-11 12:35:06 CEST"
adiness%4Admin.evtx","2021-05-11 12:35:06 CEST"
ppReadiness%4Operational.evtx","2021-05-11 12:35:06 CEST"
ws-AppXDeployment%4Operational.evtx","2021-05-11 12:35:06 CEST"
Windows-AppXDeploymentServer%4Operational.evtx","2021-05-11 12:35:06 CEST"
ndows-AppXDeploymentServer%4Restricted.evtx","2021-05-11 12:35:06 CEST"
soft-Windows-BackgroundTaskInfrastructure%4Operational.evtx","2021-05-11 12:35:06 CEST"
etrics%4Operational.evtx","2021-05-11 12:35:06 CEST"
Client%4Operational.evtx","2021-05-11 12:35:06 CEST"
odeIntegrity%4Operational.evtx","2021-05-11 12:35:06 CEST"
s-Containers-Wcifs%4Operational.evtx","2021-05-11 12:35:06 CEST"
ws-Containers-Wcnfs%4Operational.evtx","2021-05-11 12:35:06 CEST"
-Crypto-DPAPI%4BackUpKeySvc.evtx","2021-05-11 12:35:06 CEST"
ypto-DPAPI%4Operational.evtx","2021-05-11 12:35:06 CEST"
tlogs/Logs/Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx","2021-05-11 12:35:06 CEST"
-DeviceSetupManager%4Admin.evtx","2021-05-11 12:35:06 CEST"
dows-DeviceSetupManager%4Operational.evtx","2021-05-11 12:35:06 CEST"
ent%4Admin.evtx","2021-05-11 12:35:06 CEST"
6-Client%4Admin.evtx","2021-05-11 12:35:06 CEST"
iagnosis-PLA%4Operational.evtx","2021-05-11 12:35:06 CEST"
ows-Diagnosis-Scheduled%4Operational.evtx","2021-05-11 12:35:06 CEST"
s/Microsoft-Windows-FileServices-ServerManager-EventProvider%4Admin.evtx","2021-05-11 12:35:06 CEST"
/Logs/Microsoft-Windows-FileServices-ServerManager-EventProvider%4Operational.evtx","2021-05-11 12:35:06 CEST"
upPolicy%4Operational.evtx","2021-05-11 12:35:06 CEST"
-Windows-HomeGroup Control Panel%4Operational.evtx","2021-05-11 12:35:06 CEST"
tional.evtx","2021-05-11 12:35:06 CEST"
ernational%4Operational.evtx","2021-05-11 12:35:06 CEST"
c%4Operational.evtx","2021-05-11 12:35:06 CEST"
nel-Boot%4Operational.evtx","2021-05-11 12:35:06 CEST"
l-IO%4Operational.evtx","2021-05-11 12:35:06 CEST"
rnel-PnP%4Configuration.evtx","2021-05-11 12:35:06 CEST"
ndows-Kernel-Power%4Thermal-Operational.evtx","2021-05-11 12:35:06 CEST"
ws-Kernel-ShimEngine%4Operational.evtx","2021-05-11 12:35:06 CEST"
s-Kernel-StoreMgr%4Operational.evtx","2021-05-11 12:35:06 CEST"
WHEA%4Errors.evtx","2021-05-11 12:35:06 CEST"
ernel-WHEA%4Operational.evtx","2021-05-11 12:35:06 CEST"
wn Folders API Service.evtx","2021-05-11 12:35:06 CEST"
Operational.evtx","2021-05-11 12:35:06 CEST"
tx","2021-05-11 12:35:06 CEST"
rational.evtx","2021-05-11 12:35:06 CEST"
erational.evtx","2021-05-11 12:35:06 CEST"
NetworkProfile%4Operational.evtx","2021-05-11 12:35:06 CEST"
4Operational.evtx","2021-05-11 12:35:06 CEST"
rational.evtx","2021-05-11 12:35:06 CEST"
"2021-05-11 12:35:06 CEST"
ice%4Admin.evtx","2021-05-11 12:35:06 CEST"
/Logs/Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx","2021-05-11 12:35:06 CEST"
ows-PushNotification-Platform%4Admin.evtx","2021-05-11 12:35:06 CEST"
Windows-PushNotification-Platform%4Operational.evtx","2021-05-11 12:35:06 CEST"
osoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx","2021-05-11 12:35:06 CEST"
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx","2021-05-11 12:35:06 CEST"
ogs/Microsoft-Windows-RemoteDesktopServices-SessionServices%4Operational.evtx","2021-05-11 12:35:06 CEST"
osoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx","2021-05-11 12:35:06 CEST"
-RestartManager%4Operational.evtx","2021-05-11 12:35:06 CEST"
osoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx","2021-05-11 12:35:06 CEST"
/Microsoft-Windows-ServerManager-DeploymentProvider%4Operational.evtx","2021-05-11 12:35:06 CEST"
osoft-Windows-ServerManager-MgmtProvider%4Operational.evtx","2021-05-11 12:35:06 CEST"
Windows-ServerManager-MultiMachine%4Admin.evtx","2021-05-11 12:35:06 CEST"
soft-Windows-ServerManager-MultiMachine%4Operational.evtx","2021-05-11 12:35:06 CEST"
nc%4Debug.evtx","2021-05-11 12:35:06 CEST"
ttingSync%4Operational.evtx","2021-05-11 12:35:06 CEST"
osoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx","2021-05-11 12:35:06 CEST"
l-Core%4ActionCenter.evtx","2021-05-11 12:35:06 CEST"
-Core%4AppDefaults.evtx","2021-05-11 12:35:06 CEST"
ws-Shell-Core%4LogonTasksChannel.evtx","2021-05-11 12:35:06 CEST"
Core%4Operational.evtx","2021-05-11 12:35:06 CEST"
Windows-SmartCard-DeviceEnum%4Operational.evtx","2021-05-11 12:35:06 CEST"
Client%4Connectivity.evtx","2021-05-11 12:35:06 CEST"
Client%4Operational.evtx","2021-05-11 12:35:06 CEST"
t%4Security.evtx","2021-05-11 12:35:06 CEST"
%4Audit.evtx","2021-05-11 12:35:06 CEST"
BServer%4Connectivity.evtx","2021-05-11 12:35:06 CEST"
Server%4Operational.evtx","2021-05-11 12:35:06 CEST"
ver%4Security.evtx","2021-05-11 12:35:06 CEST"
MBWitnessClient%4Admin.evtx","2021-05-11 12:35:06 CEST"
ows-SMBWitnessClient%4Informational.evtx","2021-05-11 12:35:06 CEST"
-StateRepository%4Operational.evtx","2021-05-11 12:35:06 CEST"
tateRepository%4Restricted.evtx","2021-05-11 12:35:06 CEST"
ft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx","2021-05-11 12:35:06 CEST"
perational.evtx","2021-05-11 12:35:06 CEST"
TaskScheduler%4Maintenance.evtx","2021-05-11 12:35:06 CEST"
icrosoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx","2021-05-11 12:35:06 CEST"
gs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx","2021-05-11 12:35:06 CEST"
ows-TerminalServices-Printers%4Admin.evtx","2021-05-11 12:35:06 CEST"
Windows-TerminalServices-Printers%4Operational.evtx","2021-05-11 12:35:06 CEST"
ogs/Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx","2021-05-11 12:35:06 CEST"
ogs/Logs/Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx","2021-05-11 12:35:06 CEST"
%4Operational.evtx","2021-05-11 12:35:06 CEST"
Windows-UniversalTelemetryClient%4Operational.evtx","2021-05-11 12:35:06 CEST"
ows-User Profile Service%4Operational.evtx","2021-05-11 12:35:06 CEST"
np%4ActionCenter.evtx","2021-05-11 12:35:06 CEST"
np%4DeviceInstall.evtx","2021-05-11 12:35:06 CEST"
Windows-VolumeSnapshot-Driver%4Operational.evtx","2021-05-11 12:35:06 CEST"
rational.evtx","2021-05-11 12:35:06 CEST"
c%4Operational.evtx","2021-05-11 12:35:06 CEST"
erational.evtx","2021-05-11 12:35:06 CEST"
ws-Windows Defender%4Operational.evtx","2021-05-11 12:35:06 CEST"
ndows Defender%4WHC.evtx","2021-05-11 12:35:06 CEST"
entlogs/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx","2021-05-11 12:35:06 CEST"
s/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx","2021-05-11 12:35:06 CEST"
ndows-WindowsUpdateClient%4Operational.evtx","2021-05-11 12:35:06 CEST"
Windows-WinINet-Config%4ProxyConfigChanged.evtx","2021-05-11 12:35:06 CEST"
gon%4Operational.evtx","2021-05-11 12:35:06 CEST"
%4Operational.evtx","2021-05-11 12:35:06 CEST"
MI-Activity%4Operational.evtx","2021-05-11 12:35:06 CEST"
35:06 CEST"
1 12:35:06 CEST"
piedFiles/eventlogs/Logs/Application.evtx",
a/CopiedFiles/eventlogs/Logs/HardwareEvents.evtx",
ta/CopiedFiles/eventlogs/Logs/Internet Explorer.evtx",
ponseData/CopiedFiles/eventlogs/Logs/Key Management Service.evtx",
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Client-Licensing-Platform%4Admin.evtx",
21.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%
_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Exper
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-In
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Program-Te
TM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Application-Experience%4Steps-Recorder
7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ApplicationResourceMana
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppModel-Runtime%4Admin.evtx",
7_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Admin.evtx",
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppReadiness%4Operational.evtx",
20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeployment%4Operational.evtx",
2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%4Operational.evtx
DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx",
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-BackgroundTaskInfrastructure%4Ope
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Biometrics%4Operational.evtx",
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Bits-Client%4Operational.evtx",
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx",
20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Containers-Wcifs%4Operational.evtx",
20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Containers-Wcnfs%4Operational.evtx",
0210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx",
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Crypto-DPAPI%4Operational.evtx",
51521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceManagement-
0210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Admin.evtx",
HI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-DeviceSetupManager%4Operational.evtx",
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Dhcp-Client%4Admin.evtx",
7_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Dhcpv6-Client%4Admin.evtx",
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Diagnosis-PLA%4Operational.evtx",
HI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx",
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-FileServices-ServerManager-Ev
1.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-FileServices-ServerManag
0507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx",
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-HomeGroup Control Panel%4Operational
521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-IKE%4Operational.evtx",
0507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-International%4Operational.evtx",
_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Iphlpsvc%4Operational.evtx",
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-Boot%4Operational.evtx",
7_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-IO%4Operational.evtx",
0507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx",
DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx",
_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx",
0210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx",
_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Errors.evtx",
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Kernel-WHEA%4Operational.evtx",
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Known Folders API Service.evtx",
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-LiveId%4Operational.evtx",
/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-MUI%4Admin.evtx",
1521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-MUI%4Operational.evtx",
51521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NCSI%4Operational.evtx",
210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx",
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx",
1521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Ntfs%4Operational.evtx",
iveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Ntfs%4WHC.evtx",
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PrintService%4Admin.evtx",
.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Program-Compatibility-As
HI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%4Admin.evtx",
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-PushNotification-Platform%4Operational.
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%
IN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCo
7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RemoteDesktopServices-Se
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Ope
0210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-RestartManager%4Operational.evtx",
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Security-SPP-UX-Notifications%4Actio
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-DeploymentPr
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MgmtProvider%4Ope
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiMachine%4Admin.ev
01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-ServerManager-MultiMachine%4Ope
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SettingSync%4Debug.evtx",
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SettingSync%4Operational.evtx",
F01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-ConnectedAccountState%4Acti
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4ActionCenter.evtx",
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4AppDefaults.evtx",
20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx",
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Shell-Core%4Operational.evtx",
2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmartCard-DeviceEnum%4Operational.evtx
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx",
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBClient%4Operational.evtx",
151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SmbClient%4Security.evtx",
51521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Audit.evtx",
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx",
507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Operational.evtx",
_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBServer%4Security.evtx",
0507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Admin.evtx",
HI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-SMBWitnessClient%4Informational.evtx",
0210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StateRepository%4Operational.evtx",
10507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StateRepository%4Restricted.evtx",
JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-StorageSpaces-ManagementAgent%4W
51521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Store%4Operational.evtx",
0210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TaskScheduler%4Maintenance.evtx",
-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-LocalSessionMa
/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-LocalSessio
HI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%4Admin.evtx",
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Printers%4Operational.e
7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-RemoteC
1521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TerminalServices-Rem
_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-TWinUI%4Operational.evtx",
M2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UniversalTelemetryClient%4Operational.e
_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-User Profile Service%4Operational.evtx",
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UserPnp%4ActionCenter.evtx",
7_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx",
2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx
1521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-VPN%4Operational.evtx",
7_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Wcmsvc%4Operational.evtx",
51521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WFP%4Operational.evtx",
_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Defender%4Operational.evtx",
0507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Defender%4WHC.evtx",
_151521.7z/WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Firewall
WIN-SF01JTM2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Windows Firewall With Advan
DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx",
2DHI_20210507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx
07_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-Winlogon%4Operational.evtx",
_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WinRM%4Operational.evtx",
0507_151521/LiveResponseData/CopiedFiles/eventlogs/Logs/Microsoft-Windows-WMI-Activity%4Operational.evtx",
dFiles/eventlogs/Logs/Security.evtx",
les/eventlogs/Logs/Setup.evtx",
Files/eventlogs/Logs/System.evtx",
eData/CopiedFiles/eventlogs/Logs/Windows PowerShell.evtx",
12:35:06 CEST"
"2021-05-11 12:35:06 CEST"
5:06 CEST"
-05-11 12:35:06 CEST"
2:35:06 CEST"
5-11 12:35:06 CEST"
"2021-05-11 12:35:06 CEST"
ndows-Application-Experience%4Program-Compatibility-Assistant.evtx",
oft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx",
ation-Experience%4Program-Inventory.evtx",
cation-Experience%4Program-Telemetry.evtx",
on-Experience%4Steps-Recorder.evtx",
ows-ApplicationResourceManagementSystem%4Operational.evtx",
4Admin.evtx",
ational.evtx",
%4Operational.evtx",
mentServer%4Operational.evtx",
mentServer%4Restricted.evtx",
roundTaskInfrastructure%4Operational.evtx",
tional.evtx",
4Operational.evtx",
%4Operational.evtx",
kUpKeySvc.evtx",
tional.evtx",
-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx",
er%4Admin.evtx",
anager%4Operational.evtx",
ational.evtx",
duled%4Operational.evtx",
s-FileServices-ServerManager-EventProvider%4Admin.evtx",
ndows-FileServices-ServerManager-EventProvider%4Operational.evtx",
up Control Panel%4Operational.evtx",
tional.evtx",
ation.evtx",
%4Thermal-Operational.evtx",
ne%4Operational.evtx",
Operational.evtx",
tional.evtx",
erational.evtx",
dows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx",
n-Platform%4Admin.evtx",
cation-Platform%4Operational.evtx",
teDesktopServices-RdpCoreTS%4Admin.evtx",
RemoteDesktopServices-RdpCoreTS%4Operational.evtx",
ows-RemoteDesktopServices-SessionServices%4Operational.evtx",
urce-Exhaustion-Detector%4Operational.evtx",
Operational.evtx",
ity-SPP-UX-Notifications%4ActionCenter.evtx",
-ServerManager-DeploymentProvider%4Operational.evtx",
rManager-MgmtProvider%4Operational.evtx",
ager-MultiMachine%4Admin.evtx",
rManager-MultiMachine%4Operational.evtx",
-ConnectedAccountState%4ActionCenter.evtx",
nTasksChannel.evtx",
DeviceEnum%4Operational.evtx",
dmin.evtx",
nt%4Informational.evtx",
Operational.evtx",
stricted.evtx",
Spaces-ManagementAgent%4WHC.evtx",
intenance.evtx",
rminalServices-LocalSessionManager%4Admin.evtx",
ws-TerminalServices-LocalSessionManager%4Operational.evtx",
s-Printers%4Admin.evtx",
ervices-Printers%4Operational.evtx",
ows-TerminalServices-RemoteConnectionManager%4Admin.evtx",
Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx",
elemetryClient%4Operational.evtx",
ice%4Operational.evtx",
pshot-Driver%4Operational.evtx",
der%4Operational.evtx",
oft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx",
s-Windows Firewall With Advanced Security%4Firewall.evtx",
ateClient%4Operational.evtx",
nfig%4ProxyConfigChanged.evtx",
tional.evtx",
You might also like
- Malware Analysis Documentación-20241216.zip Malicious Activity - ANY - RUN - Malware Sandbox OnlineNo ratings yetMalware Analysis Documentación-20241216.zip Malicious Activity - ANY - RUN - Malware Sandbox Online19 pages
- Windows - Privilege Escalation - Internal All The ThingsNo ratings yetWindows - Privilege Escalation - Internal All The Things3 pages
- Kaspersky Security Center: Incompatible Applications ReportNo ratings yetKaspersky Security Center: Incompatible Applications Report5 pages
- Practical Windows Forensics - Cheat SheetNo ratings yetPractical Windows Forensics - Cheat Sheet4 pages
- 1.2.5. Estructura Organizacional para Operar El Programa.No ratings yet1.2.5. Estructura Organizacional para Operar El Programa.39 pages
- The OS, The Computer, and User ProgramsNo ratings yetThe OS, The Computer, and User Programs33 pages
- Student02 Configuration Sheet UniMan TablesNo ratings yetStudent02 Configuration Sheet UniMan Tables17 pages
- Release of QRadar 7.5.0 Update Package 4 SFS (750 - QRadar - UpdatePackage - 2021.6.4.20221129155237)No ratings yetRelease of QRadar 7.5.0 Update Package 4 SFS (750 - QRadar - UpdatePackage - 2021.6.4.20221129155237)6 pages
- Computer Engineering Department: Operating System Activity ManualNo ratings yetComputer Engineering Department: Operating System Activity Manual8 pages