File

Volatility 3 Framework 2.7.
Offset Name Size
0xaa8b2a8a8ed0 \Windows\System32\wlanapi.dll 216

0xaa8b2ab7d0a0 \Windows\System32\drivers\vwififlt.sys 216
0xaa8b2ab7d660 \Windows\System32\drivers\pacer.sys 216
0xaa8b2ab7d7d0 \Windows\System32\drivers\tdi.sys 216
0xaa8b2ab7dab0 \Windows\System32\drivers\cimfs.sys 216
0xaa8b2ab7e4c0 \Windows\System32\drivers\afunix.sys 216
0xaa8b2ab7ea80 \Windows\System32\drivers\afd.sys 216
0xaa8b2ab7ebf0 \Windows\System32\drivers\tdx.sys 216
0xaa8b2ab7eed0 \Windows\System32\drivers\netbt.sys 216
0xaa8b2ad23100 \Windows\System32\prnfldr.dll 216
0xaa8b2ad23290 \Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e 216
0xaa8b2ad23420 \Windows\System32\winmmbase.dll 216
0xaa8b2ad235b0 \Windows\rescache\_merged\3526546810\1634505096.pri 216
0xaa8b2ad238d0 \Windows\System32\stobject.dll 216
0xaa8b2ad23a60 \Windows\System32\windows.applicationmodel.datatransfer.dll216
0xaa8b2ad23bf0 \$Directory 216
0xaa8b2ad23d80 \Dev\Query 216
0xaa8b2ad240a0 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\
TileCache_100_3_PNGEncoded_Data.bin 216
0xaa8b2ad24230 \Windows\System32\Speech_OneCore\common\sapi_onecore.dll 216
0xaa8b2ad243c0 \Windows\Fonts\segoeui.ttf 216
0xaa8b2ad246e0 \Windows\System32\ConstraintIndex.Search.dll 216
0xaa8b2ad24870 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
resources.pri 216
0xaa8b2ad24a00 \Windows\System32\RTMediaFrame.dll 216
0xaa8b2ad24b90 \Windows\System32\Windows.Web.Http.dll 216
0xaa8b2ad24d20 \CMApi 216
0xaa8b2ad24eb0 \Windows\System32\Windows.UI.Input.Inking.dll 216
0xaa8b2ad251d0 \Windows\System32\RuntimeBroker.exe 216
0xaa8b2ad25360 \Users\mctf_user\AppData\Local\Microsoft\GameDVR\
KnownGameList.bin 216
0xaa8b2ad254f0 \Windows\System32\en-US\stobject.dll.mui 216
0xaa8b2ad25680 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b2ad25810 \CMNotify 216
0xaa8b2ad259a0 \Windows\SystemResources\stobject.dll.mun 216
0xaa8b2ad25b30 \Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-
00C04FC295EE}\catdb 216
0xaa8b2ad25cc0 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
Cortana.Search.winmd 216
0xaa8b2ad25e50 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\
TileCache_100_3_PNGEncoded_Header.bin 216
0xaa8b2ad26170 \Windows\System32\RTWorkQ.dll 216
0xaa8b2ad26300 \Windows\System32\shdocvw.dll 216
0xaa8b2ad26620 \Windows\System32\ActionCenter.dll 216
0xaa8b2ad267b0 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\V01.log
216
0xaa8b2ad26940 \Windows\System32\StorSvc.dll 216
0xaa8b2ad26ad0 \Windows\System32\srpapi.dll 216
0xaa8b2ad26c60 \Windows\System32\pnidui.dll 216
0xaa8b2ad27110 \Dev\Query 216
0xaa8b2ad27430 \Windows\System32\atlthunk.dll 216
0xaa8b2ad275c0 \CMNotify 216
0xaa8b2ad27750 \Windows\System32\bcd.dll 216
0xaa8b2ad278e0 \Windows\Globalization\ICU\icudtl.dat 216
0xaa8b2ad27a70 \Windows\Globalization\ICU\timezoneTypes.res 216
0xaa8b2ad27d90 \Windows\System32\Windows.Cortana.Desktop.dll 216
0xaa8b2ad280b0 \Windows\System32\DXP.dll 216
0xaa8b2ad28240 \Windows\System32\en-US\sndvolsso.dll.mui 216
0xaa8b2ad283d0 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b2ad28560 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
iconcache_32.db 216
0xaa8b2ad286f0 \$Directory 216
0xaa8b2ad28a10 \CMNotify 216
0xaa8b2ad28ba0 \Windows\System32\Syncreg.dll 216
0xaa8b2ad28d30 \Windows\SystemResources\batmeter.dll.mun 216
0xaa8b2ad291e0 \CMNotify 216
0xaa8b2ad29370 \Windows\SystemResources\SndVolSSO.dll.mun 216
0xaa8b2ad29500 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\
windows_immersivecontrolpanel_cw5n1h2txyewy!microsoft_windows_immersivecontrolpanel
216
0xaa8b2ad29820 \$Directory 216
0xaa8b2ad29cd0 \Windows\System32\duser.dll 216
0xaa8b2ad29e60 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b2ad2a180 \Windows\System32\WPDShServiceObj.dll 216
0xaa8b2ad2a310 \Windows\System32\dui70.dll 216
0xaa8b2ad2a4a0 \CMNotify 216
0xaa8b2ad2a630 \Windows\System32\cscobj.dll 216
0xaa8b2ad2a7c0 \$Directory 216
0xaa8b2ad2a950 \Windows\System32\chartv.dll 216
0xaa8b2ad2b120 \$Directory 216
0xaa8b2ad2b2b0 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb 216
0xaa8b2ad2b5d0 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb 216
0xaa8b2ad2b760 \Users\mctf_user\AppData\Local\Packages\
Microsoft_Windows_ControlPanel 216
0xaa8b2ad2ba80 \Windows\System32\en-US\pnidui.dll.mui 216
0xaa8b2ad2c570 \Windows\SystemResources\shell32.dll.mun 216
0xaa8b2ad2c890 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b2ad2ca20 \Windows\System32\ksuser.dll 216
0xaa8b2ad2cbb0 \Program Files\Common Files\System\Ole DB\oledb32.dll 216
0xaa8b2ad2cd40 \$Directory 216
0xaa8b2ad2ced0 \Windows\System32\WinMetadata\Windows.Foundation.winmd 216
0xaa8b2ad2d510 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b2ad2d830 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\
SVLTGCCL 216
0xaa8b2ad2db50 \$Directory 216
0xaa8b2ad2e4b0 \CMApi 216
0xaa8b2ad2e7d0 \$Directory 216
0xaa8b2ad2ee10 \Windows\System32\srchadmin.dll 216
0xaa8b2ad2f450 \Windows\System32\SyncCenter.dll 216
0xaa8b2ad2f5e0 \Windows\System32\WinMetadata\Windows.UI.winmd 216
0xaa8b2ad2fa90 \Windows\System32\SettingsEnvironment.Desktop.dll 216
0xaa8b2ad300d0 \Windows\System32\msdart.dll 216
0xaa8b2ad303f0 \Windows\System32\en-US\shell32.dll.mui 216
0xaa8b2ad30710 \Dev\Query 216
0xaa8b2ad308a0 \Windows\System32\regapi.dll 216
0xaa8b2ad30a30 \Dev\Query 216
0xaa8b2ad30d50 \Windows\System32\en-US\audiodg.exe.mui 216
0xaa8b2ad31200 \Windows\System32\en-US\propsys.dll.mui 216
0xaa8b2ad319d0 \Windows\System32\Windows.Cortana.ProxyStub.dll 216
0xaa8b2ad31b60 \Windows\System32\
Windows.ApplicationModel.Background.SystemEventsBroker.dll 216
0xaa8b2ad31e80 \$Directory 216
0xaa8b2ad321a0 \CMApi 216
0xaa8b2ad32330 \Windows\System32\en-US\propsys.dll.mui 216
0xaa8b2ad32970 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b2ad32c90 \Windows\System32\VBoxTray.exe 216
0xaa8b2ad8f0a0 \$Extend\$RmMetadata\$Repair:$Verify:$DATA 216
0xaa8b2ad8f210 \$Secure:$SII:$INDEX_ALLOCATION 216
0xaa8b2ad8f380 \$Extend\$RmMetadata\$Repair 216
0xaa8b2ad8f660 \$Extend:$I30:$INDEX_ALLOCATION 216
0xaa8b2ad8f7d0 \$Extend\$RmMetadata\$Repair:$Corrupt:$DATA 216
0xaa8b2ad8f940 \$Extend\$UsnJrnl:$J:$DATA 216
0xaa8b2ad8fab0 \Windows\System32\drivers\dumpfve.sys 216
0xaa8b2ad8fc20 \Windows\System32\drivers\storahci.sys 216
0xaa8b2ad901e0 \$BitMap 216
0xaa8b2ad904c0 \:$I30:$INDEX_ALLOCATION 216
0xaa8b2ad90630 \$Extend\$Deleted:$I30:$INDEX_ALLOCATION 216
0xaa8b2ad90a80 \$Mft::$BITMAP 216
0xaa8b2ad90d60 \$Secure:$SDS:$DATA 216
0xaa8b2ad90ed0 \$MapAttributeValue 216
0xaa8b2ae5e0a0 \$MftMirr 216
0xaa8b2ae5e380 \$LogFile 216
0xaa8b2ae5e940 \$Mft 216
0xaa8b2ae5eab0 \Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLog216
0xaa8b2d062380 \$Directory 216
0xaa8b2d062ab0 \$Directory 216
0xaa8b2d062d90 \Windows\System32\drivers\crashdmp.sys 216
0xaa8b2d0631e0 \$Directory 216
0xaa8b2d0634c0 \$Directory 216
0xaa8b2d063d60 \$Extend\$Reparse:$R:$INDEX_ALLOCATION 216
0xaa8b2d063ed0 \$Directory 216
0xaa8b2d06d0a0 \Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLog216
0xaa8b2d06d210 \:$I30:$INDEX_ALLOCATION 216
0xaa8b2d06d380 \$Directory 216
0xaa8b2d06d660 \$Extend\$RmMetadata\$TxfLog\$TxfLog.blf 216
0xaa8b2d06d7d0 \Windows\System32\drivers\Diskdump.sys 216
0xaa8b2d06d940 \$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000001
216
0xaa8b2d06dc20 \$Extend\$RmMetadata\$TxfLog\$Tops 216
0xaa8b2d06dd90 KtmLog 216
0xaa8b2d06e070 \$Extend\$RmMetadata\$Txf:$I30:$INDEX_ALLOCATION 216
0xaa8b2d06e350 \$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002
216
0xaa8b2d06e910 \Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLog216
0xaa8b2d06ebf0 TxfLog 216
0xaa8b2d06eed0 \$Extend\$RmMetadata\$TxfLog\$Tops:$T:$DATA 216
0xaa8b2d0780a0 \Windows\System32\drivers\tbs.sys 216
0xaa8b2d078210 \Windows\System32\DriverStore\FileRepository\
basicrender.inf_amd64_ed345fdc37d65139\BasicRender.sys 216
0xaa8b2d0784f0 \$Directory 216
0xaa8b2d0787d0 \Windows\System32\vertdll.dll 216
0xaa8b2d078940 \Windows\System32\drivers\cdrom.sys 216
0xaa8b2d078ab0 \Windows\System32\drivers\filecrypt.sys 216
0xaa8b2d078d90 \Windows\SysWOW64\ntdll.dll 216
0xaa8b2d079630 \Windows\System32\ntdll.dll 216
0xaa8b2d08f0d0 \Windows\System32\csrsrv.dll 216
0xaa8b2d08f260 \Sessions\1\AppContainerNamedObjects 216
0xaa8b2d08f3f0 \Windows\System32\csrss.exe 216
0xaa8b2d08f580 \Windows\System32\services.exe 216
0xaa8b2d08f710 \Windows\System32\drivers\hidparse.sys 216
0xaa8b2d08f8a0 \Windows\System32\csrss.exe 216
0xaa8b2d08fa30 \Windows\System32 216
0xaa8b2d08fbc0 \CMApi 216
0xaa8b2d08fee0 \$Directory 216
0xaa8b2d090200 \Windows\System32\drivers\dxgmms2.sys 216
0xaa8b2d090520 \Windows\System32\en-US\winsrv.dll.mui 216
0xaa8b2d0906b0 \Windows\System32\en-US\csrss.exe.mui 216
0xaa8b2d090840 \Windows\System32\sxssrv.dll 216
0xaa8b2d0909d0 \Windows\System32\winsrvext.dll 216
0xaa8b2d090cf0 \Windows\System32\winsrv.dll 216
0xaa8b2d0911a0 \Windows\System32\en-US\win32kbase.sys.mui 216
0xaa8b2d091330 \Windows\System32\basesrv.dll 216
0xaa8b2d0914c0 \Windows\System32\locale.nls 216
0xaa8b2d091970 \Windows\System32\wininit.exe 216
0xaa8b2d091b00 \Sessions\0\AppContainerNamedObjects 216
0xaa8b2d091c90 \Windows\System32 216
0xaa8b2d091e20 \Windows\System32\profapi.dll 216
0xaa8b2d092140 \Windows\System32 216
0xaa8b2d0925f0 \Windows\System32\SmartCardBackgroundPolicy.dll 216
0xaa8b2d092780 \Windows\System32\wininitext.dll 216
0xaa8b2d092910 \CMApi 216
0xaa8b2d092aa0 \Windows\System32\ShareHost.dll 216
0xaa8b2d092c30 \Windows\System32\userenv.dll 216
0xaa8b2d092dc0 \CMApi 216
0xaa8b2d0dd0a0 \Windows\System32\drivers\msfs.sys 216
0xaa8b2d0dd4f0 \Windows\System32\drivers\watchdog.sys 216
0xaa8b2d0dd940 \Windows\System32\drivers\null.sys 216
0xaa8b2d0de070 \Windows\System32\drivers\dxgkrnl.sys 216
0xaa8b2d0de4c0 \Windows\System32\drivers\beep.sys 216
0xaa8b2d0de630 \$Directory 216
0xaa8b2d0ded60 \Windows\System32\DriverStore\FileRepository\
basicdisplay.inf_amd64_fc93ae411c02f280\BasicDisplay.sys 216
0xaa8b2d0deed0 \Windows\System32\drivers\npfs.sys 216
0xaa8b2d1f57d0 \Windows\System32\drivers\rdbss.sys 216
0xaa8b2d1f5c20 \Windows\System32\drivers\winhvr.sys 216
0xaa8b2d1f5d90 \Windows\System32\drivers\csc.sys 216
0xaa8b2d1f64c0 \Windows\System32\drivers\ndiscap.sys 216
0xaa8b2d1f6630 \Windows\System32\drivers\Vid.sys 216
0xaa8b2d1f6bf0 \Windows\System32\drivers\netbios.sys 216
0xaa8b2d1f6d60 \Windows\System32\drivers\VBoxSF.sys 216
0xaa8b2d257d90 \Windows\System32\drivers\dfsc.sys 216
0xaa8b2d258070 \Windows\System32\drivers\nsiproxy.sys 216
0xaa8b2d258910 \Windows\System32\drivers\mssmbios.sys 216
0xaa8b2d258d60 \Windows\System32\drivers\npsvctrig.sys 216
0xaa8b2d258ed0 \Windows\System32\drivers\gpuenergydrv.sys 216
0xaa8b2d2980c0 \Windows\System32\config\SAM 216
0xaa8b2d298250 \Windows\System32\sechost.dll 216
0xaa8b2d2983e0 \Windows\System32\rpcrt4.dll 216
0xaa8b2d298570 \Windows\System32\msctf.dll 216
0xaa8b2d298700 \Windows\System32\combase.dll 216
0xaa8b2d298890 \Windows\System32\Wldap32.dll 216
0xaa8b2d298a20 \Windows\System32\nsi.dll 216
0xaa8b2d298d40 \Windows\System32\user32.dll 216
0xaa8b2d2991f0 \Windows\System32\coml2.dll 216
0xaa8b2d299510 \Windows\System32\wow64.dll 216
0xaa8b2d2996a0 \Windows\System32\wow64win.dll 216
0xaa8b2d299830 \Windows\System32\setupapi.dll 216
0xaa8b2d2999c0 \Windows\System32\psapi.dll 216
0xaa8b2d299ce0 \Windows 216
0xaa8b2d299e70 \Windows\System32\config\DEFAULT 216
0xaa8b2d2c2670 \Windows\System32\drivers\kdnic.sys 216
0xaa8b2d2c2ac0 \Windows\System32\drivers\i8042prt.sys 216
0xaa8b2d2c2da0 \$Directory 216
0xaa8b2d2c37b0 \Windows\System32\DriverStore\FileRepository\
compositebus.inf_amd64_7500cffa210c6946\CompositeBus.sys 216
0xaa8b2d2c3c00 \Windows\System32\smss.exe 216
0xaa8b2d2c4780 \Windows\System32\DriverStore\FileRepository\
umbus.inf_amd64_b78a9c5b6fd62c27\umbus.sys 216
0xaa8b2d2c48f0 \Windows\System32\drivers\CAD.sys 216
0xaa8b2d2c5750 \Windows\System32\drivers\kbdclass.sys 216
0xaa8b2d2c5a30 \Windows\System32\drivers\VBoxMouse.sys 216
0xaa8b2d2c5d10 \Windows\System32\drivers\mouclass.sys 216
0xaa8b2d2d10b0 \$Extend:$I30:$INDEX_ALLOCATION 216
0xaa8b2d2d1220 \$Extend\$Deleted:$I30:$INDEX_ALLOCATION 216
0xaa8b2d2d1390 \Windows\System32\drivers\bam.sys 216
0xaa8b2d2d1500 \$LogFile 216
0xaa8b2d2d1670 \Device\HarddiskVolume1\$Extend\$RmMetadata\$TxfLog\$TxfLog216
0xaa8b2d2d1950 \:$I30:$INDEX_ALLOCATION 216
0xaa8b2d2d1c30 \$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000001
216
0xaa8b2d2d2080 \$Mft::$BITMAP 216
0xaa8b2d2d21f0 \$Secure:$SDS:$DATA 216
0xaa8b2d2d2360 \$Secure:$SII:$INDEX_ALLOCATION 216
0xaa8b2d2d2920 \$BitMap 216
0xaa8b2d2d2c00 \$Extend\$RmMetadata\$TxfLog\$TxfLog.blf 216
0xaa8b2d2d3330 \$Extend\$RmMetadata\$Repair 216
0xaa8b2d2d34a0 \$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002
216
0xaa8b2d2d38f0 \$Mft 216
0xaa8b2d2d3a60 \$MftMirr 216
0xaa8b2d2d3eb0 \Device\HarddiskVolume1\$Extend\$RmMetadata\$TxfLog\$TxfLog216
0xaa8b2d2d4300 \Device\HarddiskVolume1\$Extend\$RmMetadata\$TxfLog\$TxfLog216
0xaa8b2d2d4470 \Windows\System32\drivers\ahcache.sys 216
0xaa8b2d2d45e0 KtmLog 216
0xaa8b2d2d4a30 \$Extend\$RmMetadata\$TxfLog\$Tops:$T:$DATA 216
0xaa8b2d2d4ba0 \:$I30:$INDEX_ALLOCATION 216
0xaa8b2d2d4d10 TxfLog 216
0xaa8b2d2d4e80 \$Extend\$RmMetadata\$TxfLog\$Tops 216
0xaa8b2d3660c0 \Windows\System32\shell32.dll 216
0xaa8b2d3663e0 \Windows\System32\imm32.dll 216
0xaa8b2d366570 \Windows\System32\wow64cpu.dll 216
0xaa8b2d366700 \Windows\System32\advapi32.dll 216
0xaa8b2d366890 \Windows\System32\SHCore.dll 216
0xaa8b2d366a20 \Windows\System32\msvcrt.dll 216
0xaa8b2d366bb0 \Windows\System32\ole32.dll 216
0xaa8b2d366d40 \Windows\System32\GdiPlus.dll 216
0xaa8b2d366ed0 \Windows\System32\difxapi.dll 216
0xaa8b2d3671f0 \Windows\System32\kernel32.dll 216
0xaa8b2d367380 \Windows\System32\clbcatq.dll 216
0xaa8b2d367510 \Windows\System32\ws2_32.dll 216
0xaa8b2d3676a0 \Windows\System32\normaliz.dll 216
0xaa8b2d367830 \Windows\System32\comdlg32.dll 216
0xaa8b2d3679c0 \Windows\System32\shlwapi.dll 216
0xaa8b2d367b50 \Windows\System32\imagehlp.dll 216
0xaa8b2d367ce0 \Windows\System32\oleaut32.dll 216
0xaa8b2d367e70 \Windows\System32\gdi32.dll 216
0xaa8b2d36d220 \Windows\System32\drivers\E1G6032E.sys 216
0xaa8b2d36dc30 \Windows\System32\drivers\drmk.sys 216
0xaa8b2d36dda0 \Windows\System32\drivers\VBoxWddm.sys 216
0xaa8b2d36eee0 \Windows\System32\drivers\hdaudbus.sys 216
0xaa8b2d36f1c0 \Windows\System32\drivers\portcls.sys 216
0xaa8b2d36f780 \Windows\System32\drivers\ks.sys 216
0xaa8b2d36feb0 \Windows\System32\drivers\USBXHCI.SYS 216
0xaa8b2d3708c0 \Windows\System32\drivers\Ucx01000.sys 216
0xaa8b2d37f0c0 \Windows\SysWOW64\gdi32.dll 216
0xaa8b2d37f250 \Windows\SysWOW64\wintrust.dll 216
0xaa8b2d37f3e0 \Windows\System32\wintrust.dll 216
0xaa8b2d37f570 \Windows\System32\ucrtbase.dll 216
0xaa8b2d37f700 \Windows\System32\gdi32full.dll 216
0xaa8b2d37f890 \Windows\SysWOW64\coml2.dll 216
0xaa8b2d37fa20 \Windows\SysWOW64\win32u.dll 216
0xaa8b2d37fbb0 \Windows\System32\crypt32.dll 216
0xaa8b2d37fd40 \Windows\SysWOW64\ole32.dll 216
0xaa8b2d37fed0 \Windows\SysWOW64\imagehlp.dll 216
0xaa8b2d3801f0 \Windows\System32\bcrypt.dll 216
0xaa8b2d380380 \Windows\System32\msvcp_win.dll 216
0xaa8b2d380510 \Windows\System32\win32u.dll 216
0xaa8b2d3806a0 \Windows\System32\comctl32.dll 216
0xaa8b2d380830 \Windows\System32\KernelBase.dll 216
0xaa8b2d3809c0 \Windows\System32\cfgmgr32.dll 216
0xaa8b2d380b50 \Windows\SysWOW64\shell32.dll 216
0xaa8b2d380ce0 \Windows\SysWOW64\clbcatq.dll 216
0xaa8b2d38e500 \Windows\System32\drivers\battc.sys 216
0xaa8b2d38f7b0 \Windows\System32\drivers\NdisVirtualBus.sys 216
0xaa8b2d38fd70 \Windows\System32\DriverStore\FileRepository\
swenum.inf_amd64_16a14542b63c02af\swenum.sys 216
0xaa8b2d390610 \Windows\System32\drivers\amdppm.sys 216
0xaa8b2d3908f0 \Windows\System32\drivers\CmBatt.sys 216
0xaa8b2d3918c0 \Windows\System32\drivers\rdpbus.sys 216
0xaa8b2d4310c0 \Windows\SysWOW64\msvcp_win.dll 216
0xaa8b2d431250 \Windows\SysWOW64\shlwapi.dll 216
0xaa8b2d4313e0 \Windows\SysWOW64\normaliz.dll 216
0xaa8b2d431570 \Windows\SysWOW64\comdlg32.dll 216
0xaa8b2d431700 \Windows\SysWOW64\kernel32.dll 216
0xaa8b2d431890 \Windows\SysWOW64\ws2_32.dll 216
0xaa8b2d431a20 \Windows\SysWOW64\nsi.dll 216
0xaa8b2d431bb0 \Windows\SysWOW64\GdiPlus.dll 216
0xaa8b2d431d40 \Windows\SysWOW64\crypt32.dll 216
0xaa8b2d431ed0 \Windows\SysWOW64\bcrypt.dll 216
0xaa8b2d4321f0 \Windows\SysWOW64\rpcrt4.dll 216
0xaa8b2d432380 \Windows\SysWOW64\psapi.dll 216
0xaa8b2d432510 \Windows\SysWOW64\SHCore.dll 216
0xaa8b2d4326a0 \Windows\SysWOW64\difxapi.dll 216
0xaa8b2d432830 \Windows\SysWOW64\imm32.dll 216
0xaa8b2d4329c0 \Windows\SysWOW64\oleaut32.dll 216
0xaa8b2d432b50 \Windows\SysWOW64\bcryptprimitives.dll 216
0xaa8b2d432ce0 \Windows\SysWOW64\msctf.dll 216
0xaa8b2d432e70 \Windows\SysWOW64\combase.dll 216
0xaa8b2d472db0 \$Directory 216
0xaa8b2d473370 \Windows\System32\drivers\HdAudio.sys 216
0xaa8b2d474d50 \Windows\System32\drivers\en-US\USBXHCI.SYS.mui 216
0xaa8b2d475d20 \$Directory 216
0xaa8b2d476170 \Windows\System32\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-
RdpIdd-Trace.etl 216
0xaa8b2d4768a0 \Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
216
0xaa8b2d476a10 \Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-
Security.etl 216
0xaa8b2d476b80 \$Directory 216
0xaa8b2d476cf0 \Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl 216
0xaa8b2d476e60 \Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-
Application.etl 216
0xaa8b2d477140 \Windows\System32\WDI\LogFiles\WdiContextLog.etl.003 216
0xaa8b2d4772b0 \$Directory 216
0xaa8b2d477590 \$Secure:$SDH:$INDEX_ALLOCATION 216
0xaa8b2d477cc0 \Windows\System32\drivers\usbd.sys 216
0xaa8b2d4786d0 \Windows\System32\config\TxR\{53b39e3e-18c4-11ea-a811-
000d3aa4692b}.TM.blf 216
0xaa8b2d478e00 \Windows\System32\drivers\USBHUB3.SYS 216
0xaa8b2d479810 \Windows\System32\drivers\ksthunk.sys 216
0xaa8b2d507250 \Windows\System32\config\SYSTEM.LOG1 216
0xaa8b2d5073e0 \Sessions 216
0xaa8b2d507700 \Windows\System32\config\DEFAULT.LOG2 216
0xaa8b2d507bb0 \Windows\System32\config\SOFTWARE.LOG1 216
0xaa8b2d507d40 \Windows\System32\config\SECURITY 216
0xaa8b2d507ed0 \Windows\System32\config\SOFTWARE 216
0xaa8b2d5081f0 \$Directory 216
0xaa8b2d508380 \Windows\System32\config\SAM.LOG1 216
0xaa8b2d508510 \Windows\System32\config\SECURITY.LOG1 216
0xaa8b2d5086a0 \Windows\System32\config\SECURITY.LOG2 216
0xaa8b2d508830 \Windows\System32\config\SOFTWARE.LOG2 216
0xaa8b2d5089c0 \Windows\System32\config\DEFAULT.LOG1 216
0xaa8b2d508b50 \Windows\System32\config\SAM.LOG2 216
0xaa8b2d508ce0 \Windows\System32\config\SYSTEM 216
0xaa8b2d508e70 \Windows\System32\config\SYSTEM.LOG2 216
0xaa8b2d5640c0 \Windows\System32\config\TxR\{53b39e3d-18c4-11ea-a811-
000d3aa4692b}.TxR.0.regtrans-ms 216
0xaa8b2d564230 \Windows\System32\config\TxR\{53b39e3d-18c4-11ea-a811-
000d3aa4692b}.TxR.blf 216
0xaa8b2d5643a0 \Windows\System32\config\TxR\{53b39e3d-18c4-11ea-a811-
0xaa8b2d564960 \SystemRoot\System32\Config\TxR\{53b39e3d-18c4-11ea-a811-
000d3aa4692b}.TxR 216
0xaa8b2d565200 \Windows\System32\config\TxR\{53b39e3d-18c4-11ea-a811-
0xaa8b2d565aa0 \Windows\System32\config\TxR\{53b39e3e-18c4-11ea-a811-
000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms 216
0xaa8b2d566060 \SystemRoot\System32\Config\TxR\{53b39e3e-18c4-11ea-a811-
000d3aa4692b}.TM 216
0xaa8b2d5661d0 \Windows\System32\config\TxR\{53b39e3e-18c4-11ea-a811-
000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms 216
0xaa8b2d566790 \SystemRoot\System32\Config\TxR\{53b39e3e-18c4-11ea-a811-
000d3aa4692b}.TM 216
0xaa8b2d566be0 \Windows\System32\drivers\cdfs.sys 216
0xaa8b2d567a40 \Windows\System32\drivers\hidclass.sys 216
0xaa8b2d567d20 \Windows\System32\drivers\monitor.sys 216
0xaa8b2d568cf0 \Windows\System32\drivers\mouhid.sys 216
0xaa8b2d569140 \Windows\System32\drivers\hidusb.sys 216
0xaa8b2d5c90c0 \Windows\System32\sspicli.dll 216
0xaa8b2d5c9250 \DumpStack.log.tmp 216
0xaa8b2d5c9570 \Windows\System32\win32k.sys 216
0xaa8b2d5c9bb0 \Windows\System32\win32kbase.sys 216
0xaa8b2d5c9d40 $PATH_TABLE$ 216
0xaa8b2d5ca1f0 \ 216
0xaa8b2d5ca380 \Boot\BCD 216
0xaa8b2d5ca6a0 \Boot\BCD.LOG 216
0xaa8b2d5ca830 \swapfile.sys 216
0xaa8b2d5cace0 \pagefile.sys 216
0xaa8b2d5cae70 \Windows\System32\win32kfull.sys 216
0xaa8b2ecfc0c0 \ProtectedPrefix\NetWorkService 216
0xaa8b2ecfc250 \Windows\SysWOW64\cfgmgr32.dll 216
0xaa8b2ecfc3e0 \Windows\SysWOW64\KernelBase.dll 216
0xaa8b2ecfc570 \ProtectedPrefix\LocalService 216
0xaa8b2ecfc700 \ProtectedPrefix 216
0xaa8b2ecfc890 \Windows\SysWOW64\advapi32.dll 216
0xaa8b2ecfca20 \Windows\SysWOW64\setupapi.dll 216
0xaa8b2ecfcbb0 \Windows\SysWOW64\ucrtbase.dll 216
0xaa8b2ecfcd40 \Windows\SysWOW64\sechost.dll 216
0xaa8b2ecfced0 \ProtectedPrefix\Administrators 216
0xaa8b2ecfd1f0 \ProtectedPrefix\NetWorkService 216
0xaa8b2ecfd380 \Windows\SysWOW64\comctl32.dll 216
0xaa8b2ecfd510 \Windows\SysWOW64\gdi32full.dll 216
0xaa8b2ecfd6a0 \ProtectedPrefix\Administrators 216
0xaa8b2ecfd830 \Windows\SysWOW64\Wldap32.dll 216
0xaa8b2ecfd9c0 \ProtectedPrefix 216
0xaa8b2ecfdb50 \Windows\SysWOW64\user32.dll 216
0xaa8b2ecfdce0 \Windows\SysWOW64\msvcrt.dll 216
0xaa8b2ecfde70 \ProtectedPrefix\LocalService 216
0xaa8b2f6ae9b0 \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\
NTUSER.DAT{53b39e87-18c4-11ea-a811-000d3aa4692b}.TxR 216
0xaa8b2f6aeb20 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e87-18c4-
11ea-a811-000d3aa4692b}.TxR.blf 216
0xaa8b2f6af530 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e87-18c4-
11ea-a811-000d3aa4692b}.TxR.0.regtrans-ms 216
0xaa8b2f71c260 \Windows\System32 216
0xaa8b2f71c710 \Windows\System32\cdd.dll 216
0xaa8b2f71c8a0 \Windows\System32\umpdc.dll 216
0xaa8b2f71cbc0 \Windows\System32\WaaSMedicSvc.dll 216
0xaa8b2f71cee0 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b2f71d200 \Windows\System32\sru\SRU.loglog 216
0xaa8b2f71d390 \Windows\System32\WaaSMedicPS.dll 216
0xaa8b2f71db60 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b2f71e1a0 \Windows\System32\winlogon.exe 216
0xaa8b2f71e4c0 \Windows\System32\powrprof.dll 216
0xaa8b2f71ec90 \$Directory 216
0xaa8b2f71f140 \Windows\System32\KBDUS.DLL 216
0xaa8b2f71f2d0 \Windows\System32\winsta.dll 216
0xaa8b2f71f460 \InitShutdown 216
0xaa8b2f71f5f0 \InitShutdown 216
0xaa8b2f71f780 \Windows\System32\sxs.dll 216
0xaa8b2f71fc30 \InitShutdown 216
0xaa8b2f7c60d0 \Windows\System32\ncrypt.dll 216
0xaa8b2f7c6710 \Windows\System32\msasn1.dll 216
0xaa8b2f7c68a0 \Windows\System32\devobj.dll 216
0xaa8b2f7c6a30 \Windows\System32\samsrv.dll 216
0xaa8b2f7c6d50 \Windows\System32\ntasn1.dll 216
0xaa8b2f7c6ee0 \Windows\System32 216
0xaa8b2f7c7200 \Windows\System32\en-US\lsasrv.dll.mui 216
0xaa8b2f7c7390 \Windows\System32\msprivs.dll 216
0xaa8b2f7c7520 \Windows\System32\netprovfw.dll 216
0xaa8b2f7c76b0 \Windows\System32\wldp.dll 216
0xaa8b2f7c7840 \Windows\System32 216
0xaa8b2f7c79d0 \Windows\System32\joinutil.dll 216
0xaa8b2f7c7b60 \CMApi 216
0xaa8b2f7c81a0 \$Directory 216
0xaa8b2f7c8330 \Windows\System32\EventAggregation.dll 216
0xaa8b2f7c84c0 \Windows\Globalization\Sorting\SortDefault.nls 216
0xaa8b2f7c8650 \$Directory 216
0xaa8b2f7c8970 \Windows\System32\lsasrv.dll 216
0xaa8b2f7c8c90 \Windows\System32\dpapi.dll 216
0xaa8b2f7c8e20 \Windows\System32\lsass.exe 216
0xaa8b2f7c92d0 \$Directory 216
0xaa8b2f7c9460 \Windows\System32\negoexts.dll 216
0xaa8b2f7c95f0 \Windows\System32\kerberos.dll 216
0xaa8b2f7c9780 \Windows\System32\cryptdll.dll 216
0xaa8b2f7c9910 \Windows\System32\KerbClientShared.dll 216
0xaa8b2f7c9c30 \Windows\System32\cryptbase.dll 216
0xaa8b2f7c9dc0 \Windows\System32\cryptsp.dll 216
0xaa8b2f8e40e0 \ntsvcs 216
0xaa8b2f8e4270 \Windows\System32\imm32.dll 216
0xaa8b2f8e4400 \Windows\System32\authz.dll 216
0xaa8b2f8e48b0 \scerpc 216
0xaa8b2f8e4a40 \Windows\System32\svchost.exe 216
0xaa8b2f8e4bd0 \$Directory 216
0xaa8b2f8e4d60 \Windows\System32 216
0xaa8b2f8e4ef0 \ntsvcs 216
0xaa8b2f8e5080 \Windows\System32 216
0xaa8b2f8e53a0 \ntsvcs 216
0xaa8b2f8e5530 \$Directory 216
0xaa8b2f8e56c0 \$Directory 216
0xaa8b2f8e5850 \scerpc 216
0xaa8b2f8e5b70 \Windows\System32\kdcpw.dll 216
0xaa8b2f8e5d00 \Windows\System32\scecli.dll 216
0xaa8b2f8e6340 \Windows\System32\scesrv.dll 216
0xaa8b2f8e64d0 \Windows\System32\profext.dll 216
0xaa8b2f8e6660 \Windows\System32\FirewallAPI.dll 216
0xaa8b2f8e67f0 \scerpc 216
0xaa8b2f8e6980 \Windows\System32\WUDFPlatform.dll 216
0xaa8b2f8e6ca0 \Windows\System32\fwbase.dll 216
0xaa8b2f8e7150 \Windows\ServiceState 216
0xaa8b2f8e72e0 \Windows\System32\en-US\services.exe.mui 216
0xaa8b2f8e7470 \CMApi 216
0xaa8b2f8e7920 \Windows\System32\umpnpmgr.dll 216
0xaa8b2f8e7ab0 \Windows\System32\dxgi.dll 216
0xaa8b2f8e7c40 \Windows\Fonts\vgasys.fon 216
0xaa8b2f8e80f0 \Windows\System32 216
0xaa8b2f8e8280 \Windows\System32\sppc.dll 216
0xaa8b2f8e8410 \Windows\System32\fontdrvhost.exe 216
0xaa8b2f8e85a0 \Windows\System32\hid.dll 216
0xaa8b2f8e8730 \Windows\System32\umpo-overrides.dll 216
0xaa8b2f8e8760 螸⾎ꪋ螸⾎ꪋ 0
0xaa8b2f8e88c0 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
Cortana.Internal.Search.winmd 216
0xaa8b2f8e8a50 \Windows\System32 216
0xaa8b2f8e8be0 \Windows\System32\gpapi.dll 216
0xaa8b2f8e8d70 \Windows\System32\fontdrvhost.exe 216
0xaa8b2f8e9090 \CMNotify 216
0xaa8b2f8e9220 \Windows\System32\windows.storage.dll 216
0xaa8b2f8e93b0 \Windows\System32\en-US\combase.dll.mui 216
0xaa8b2f8e9540 \Windows\System32\tdh.dll 216
0xaa8b2f8e96d0 \Sessions\1\AppContainerNamedObjects\S-1-15-2-95739096-486727260-
2033287795-3853587803-1685597119-444378811-2746676523 216
0xaa8b2f8e9860 \CurrentIn 216
0xaa8b2f8e99f0 \Sessions\0\AppContainerNamedObjects\S-1-15-2-95739096-486727260-
2033287795-3853587803-1685597119-444378811-2746676523 216
0xaa8b2f8e9b80 \Windows\System32\umpoext.dll 216
0xaa8b2f8e9d10 \$Directory 216
0xaa8b2f8e9ea0 \Windows\System32\slc.dll 216
0xaa8b2f8ea1c0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b2f8ea350 \Windows\System32\umpo.dll 216
0xaa8b2f8ea4e0 \Winsock2\CatalogChangeListener-2a0-0 216
0xaa8b2f8ea800 \CMNotify 216
0xaa8b2f8ea990 \$Directory 216
0xaa8b2f8eab20 \CMNotify 216
0xaa8b2f8eacb0 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2 216
0xaa8b2f8eb160 \CMNotify 216
0xaa8b2f8eb480 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 216
0xaa8b2f8eb610 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e88-18c4-
11ea-a811-000d3aa4692b}.TM.blf 216
0xaa8b2f8eb7a0 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e88-18c4-
11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms 216
0xaa8b2f8eb930 \Windows\System32\SleepStudy\UserNotPresentSession.etl 216
0xaa8b2f8ebac0 \$Directory 216
0xaa8b2f8ebc50 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e88-18c4-
11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms 216
0xaa8b2f8ebde0 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT 216
0xaa8b2f8fb0d0 \Windows\System32\netutils.dll 216
0xaa8b2f8fb260 \Windows\System32\gmsaclient.dll 216
0xaa8b2f8fb580 \Windows\System32\cloudAP.dll 216
0xaa8b2f8fb8a0 \Windows\System32\dnsapi.dll 216
0xaa8b2f8fbbc0 \Windows\System32\netlogon.dll 216
0xaa8b2f8fbd50 \Windows\System32\IPHLPAPI.DLL 216
0xaa8b2f8fbee0 \Windows\System32\ntmarta.dll 216
0xaa8b2f8fc200 \Windows\System32\logoncli.dll 216
0xaa8b2f8fc390 \Windows\System32\wkscli.dll 216
0xaa8b2f8fc520 \Windows\System32\MicrosoftAccountCloudAP.dll 216
0xaa8b2f8fc6b0 \Windows\System32\wdigest.dll 216
0xaa8b2f8fc840 \Windows\System32\C_28591.NLS 216
0xaa8b2f8fc9d0 \Windows\System32\schannel.dll 216
0xaa8b2f8fcb60 \lsass 216
0xaa8b2f8fce80 \Windows\System32\rsaenh.dll 216
0xaa8b2f8fd1a0 \Windows\System32\mswsock.dll 216
0xaa8b2f8fd330 \Windows\System32\msv1_0.dll 216
0xaa8b2f8fd4c0 \Windows\System32\TSpkg.dll 216
0xaa8b2f8fd650 \Windows\debug\PASSWD.LOG 216
0xaa8b2f8fd7e0 \$Directory 216
0xaa8b2f8fd970 \$Directory 216
0xaa8b2f8fdb00 \Windows\System32\msvcp110_win.dll 216
0xaa8b2f8fdc90 \Windows\System32\pku2u.dll 216
0xaa8b2f8fde20 \Windows\System32\NtlmShared.dll 216
0xaa8b2f8fe140 \Windows\System32\aadcloudap.dll 216
0xaa8b2f8fe460 \lsass 216
0xaa8b2f8fe5f0 \Windows\System32\efslsaext.dll 216
0xaa8b2f8fe910 \Windows\System32\dpapisrv.dll 216
0xaa8b2f8fedc0 \Windows\System32\sspisrv.dll 216
0xaa8b2f902270 \Windows\System32\RpcEpMap.dll 216
0xaa8b2f902590 \Endpoint 216
0xaa8b2f902720 \Windows\System32\usosvc.dll 216
0xaa8b2f902bd0 \$Directory 216
0xaa8b2f902d60 \Windows\System32 216
0xaa8b2f902ef0 \Windows\System32\Windows.Storage.ApplicationData.dll 216
0xaa8b2f903080 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat
216
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
216
0xaa8b2f9033a0 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2
216
0xaa8b2f9036c0 \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\
NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM 216
0xaa8b2f903850 \Windows\System32\svchost.exe 216
0xaa8b2f9039e0 \Windows\System32\rpcss.dll 216
0xaa8b2f903d00 \Endpoint 216
0xaa8b2f9041b0 \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\
NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM 216
0xaa8b2f904340 \Windows\rescache\_merged\24768367\3520438480.pri 216
0xaa8b2f9047f0 \Windows\System32\RpcRtRemote.dll 216
0xaa8b2f904b10 \Windows\Fonts\segoeui.ttf 216
0xaa8b2f904ca0 \Windows\Fonts\marlett.ttf 216
0xaa8b2f904e30 \Endpoint 216
0xaa8b2f905150 \$Directory 216
0xaa8b2f9052e0 \Endpoint 216
0xaa8b2f905600 \Winsock2\CatalogChangeListener-1f8-0 216
0xaa8b2f905790 \epmapper 216
0xaa8b2f905c40 \Windows\System32\lsm.dll 216
0xaa8b2f905dd0 \Windows\System32\dwmapi.dll 216
0xaa8b2f9060f0 \epmapper 216
0xaa8b2f906280 \Windows\System32\psmsrv.dll 216
0xaa8b2f906410 \epmapper 216
0xaa8b2f9065a0 \Windows\System32\kernel.appcore.dll 216
0xaa8b2f9068c0 \Endpoint 216
0xaa8b2f906a50 \Endpoint 216
0xaa8b2f906be0 \Endpoint 216
0xaa8b2f906d70 \CMNotify 216
0xaa8b2f9073b0 \Winsock2\CatalogChangeListener-388-0 216
0xaa8b2f9076d0 \Endpoint 216
0xaa8b2f9079f0 \Windows\Fonts\micross.ttf 216
0xaa8b2f907b80 \Windows\System32\PsmServiceExtHost.dll 216
0xaa8b2f907d10 \Windows\System32\wer.dll 216
0xaa8b2f907ea0 \Windows\System32\rmclient.dll 216
0xaa8b2f908350 \Windows\System32\en-US\mswsock.dll.mui 216
0xaa8b2f9084e0 \Windows\System32\ResourcePolicyClient.dll 216
0xaa8b2f908670 \Windows\System32\sysntfy.dll 216
0xaa8b2f908800 \Winsock2\CatalogChangeListener-314-0 216
0xaa8b2f908990 \Windows\System32\wshhyperv.dll 216
0xaa8b2f908b20 \Windows\System32\UXInit.dll 216
0xaa8b2f908cb0 \LSM_API_service 216
0xaa8b2f908e40 \LSM_API_service 216
0xaa8b2f909160 \LSM_API_service 216
0xaa8b2f9092f0 \Windows\System32\embeddedmodesvcapi.dll 216
0xaa8b2f909610 \Windows\System32\uxtheme.dll 216
0xaa8b2f9097a0 \Windows\Resources\Themes\aero\aero.msstyles 216
0xaa8b2f909930 \Windows\System32\Windows.Internal.Shell.Broker.dll 216
0xaa8b2f909de0 \Windows\System32\bisrv.dll 216
0xaa8b2f911af0 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e87-18c4-
0xaa8b2f912c30 \Windows\ServiceProfiles\NetworkService\NTUSER.DAT{53b39e87-18c4-
0xaa8b2f917cb0 \Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl 216
0xaa8b2f91a210 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a00-52f9-
11ed-a64f-85d007eed5b5}.TxR.2.regtrans-ms 216
0xaa8b2f91b070 \Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\
NTUSER.DAT{1ff77a00-52f9-11ed-a64f-85d007eed5b5}.TxR 216
0xaa8b2f91b350 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a00-52f9-
11ed-a64f-85d007eed5b5}.TxR.blf 216
0xaa8b2f91b7a0 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a00-52f9-
0xaa8b2f91b910 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a00-52f9-
0xaa8b2f91da20 \Windows\System32\drivers\wcifs.sys 216
0xaa8b2f91f570 \Windows\System32\drivers\cldflt.sys 216
0xaa8b2f91fe10 \Windows\System32\drivers\bindflt.sys 216
0xaa8b2f920260 \Windows\System32\drivers\storqosflt.sys 216
0xaa8b2f9c0270 \Windows\System32\dsreg.dll 216
0xaa8b2f9c0400 \Windows\System32\dwminit.dll 216
0xaa8b2f9c0590 \Windows\System32\d2d1.dll 216
0xaa8b2f9c0720 \Windows\System32\ResourcePolicyServer.dll 216
0xaa8b2f9c0a40 \Windows\System32\SystemEventsBrokerServer.dll 216
0xaa8b2f9c0bd0 \Windows\System32\BrokerLib.dll 216
0xaa8b2f9c0d60 \Windows\System32 216
0xaa8b2f9c0ef0 \Windows\System32\uDWM.dll 216
0xaa8b2f9c1080 \Windows\System32\dwmredir.dll 216
0xaa8b2f9c1210 \Windows\System32\dwmcore.dll 216
0xaa8b2f9c16c0 \Windows\System32\dwm.exe 216
0xaa8b2f9c19e0 \Windows\System32\dab.dll 216
0xaa8b2f9c1d00 \Windows\System32\ShellExperiences\
Windows.UI.Shell.SharedUtilities.dll 216
0xaa8b2f9c1e90 \Windows\System32\dabapi.dll 216
0xaa8b2f9c2660 \Windows\System32\CoreMessaging.dll 216
0xaa8b2f9c27f0 \Windows\System32\apphelp.dll 216
0xaa8b2f9c2980 \Windows\System32\CoreUIComponents.dll 216
0xaa8b2f9c2b10 \Windows\System32\xmllite.dll 216
0xaa8b2f9c2e30 \Windows\System32\WinTypes.dll 216
0xaa8b2f9c32e0 \Windows\System32\config\BBI.LOG1 216
0xaa8b2f9c3470 \Windows\System32\config\BBI 216
0xaa8b2f9c3600 \Windows\System32\en-US\d2d1.dll.mui 216
0xaa8b2f9c3790 \Windows\System32\wtsapi32.dll 216
0xaa8b2f9c3ab0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b2f9c3c40 \Windows\System32\dcomp.dll 216
0xaa8b2f9c3dd0 \Windows\System32\config\BBI.LOG2 216
0xaa8b2f9c40f0 \Windows\System32\D3DCompiler_47.dll 216
0xaa8b2f9c4280 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b2f9c4410 \Windows\System32\svchost.exe 216
0xaa8b2f9c45a0 \Windows\System32\d3d11.dll 216
0xaa8b2f9c4730 \CMNotify 216
0xaa8b2f9c48c0 \Windows\System32\svchost.exe 216
0xaa8b2f9c4a50 \Windows\System32 216
0xaa8b2f9c4be0 \Windows\System32\gpsvc.dll 216
0xaa8b2f9c4d70 \Windows\System32\en-US\dwm.exe.mui 216
0xaa8b2f9c5090 \Windows\System32\nlaapi.dll 216
0xaa8b2f9c5220 \Windows\System32\dsrole.dll 216
0xaa8b2f9c53b0 \CMApi 216
0xaa8b2f9c56d0 \Windows\System32\ncbservice.dll 216
0xaa8b2f9c5860 \Windows\System32\propsys.dll 216
0xaa8b2f9c5b80 \Windows\System32\samlib.dll 216
0xaa8b2f9c5d10 \Windows\System32\bi.dll 216
0xaa8b2f9c5ea0 \Windows\System32 216
0xaa8b2f9c61c0 \CMNotify 216
0xaa8b2f9c64e0 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a01-52f9-
11ed-a64f-85d007eed5b5}.TM.blf 216
0xaa8b2f9c6670 \Windows\System32\dwmghost.dll 216
0xaa8b2f9c6b20 \CMNotify 216
0xaa8b2f9c6e40 \Windows\System32\taskschd.dll 216
0xaa8b2f9c7160 \Windows\System32\httpprxc.dll 216
0xaa8b2f9c7480 \Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2 216
0xaa8b2f9c7610 \Windows\System32\SystemEventsBrokerClient.dll 216
0xaa8b2f9c77a0 \Windows\ServiceProfiles\LocalService\NTUSER.DAT 216
0xaa8b2f9c7930 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a01-52f9-
11ed-a64f-85d007eed5b5}.TMContainer00000000000000000001.regtrans-ms 216
0xaa8b2f9c7ac0 \$Directory 216
0xaa8b2f9c7c50 \Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 216
0xaa8b30023740 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
SearchApi.ProxyStub.dll 216
0xaa8b300238d0 \Users\mctf_user\AppData\Local\Microsoft\Internet Explorer\
CacheStorage\edb.log 216
0xaa8b30023a60 \ProgramData\Microsoft\Windows\AppRepository\Packages\
Microsoft.Windows.Search_1.14.7.19041_neutral_neutral_cw5n1h2txyewy\
ActivationStore.dat.LOG1 216
0xaa8b30023bf0 \Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-
0xaa8b30024550 \$Directory 216
0xaa8b300246e0 \PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER 216
0xaa8b30024870 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm 216
0xaa8b30024b90 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30024d20 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy 216
0xaa8b300251d0 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
SearchApi.dll 216
0xaa8b30025360 \Windows\System32\en-US\Windows.Globalization.dll.mui 216
0xaa8b300254f0 \ProgramData\Microsoft\Windows\AppRepository\Packages\
ActivationStore.dat 216
0xaa8b30025680 \ProgramData\Microsoft\Windows\AppRepository\Packages\
Search.Core.dll 216
0xaa8b30025b30 \$Directory 216
0xaa8b30026170 \Windows\System32\wbem\NCProv.dll 216
0xaa8b30026300 \Windows\System32\EdgeManager.dll 216
0xaa8b30026620 \Windows\System32\edgehtml.dll 216
0xaa8b300267b0 \Windows\System32\imapi2.dll 216
0xaa8b30026ad0 \Windows\System32\rometadata.dll 216
0xaa8b30026c60 \Windows\System32\en-US\windows.storage.dll.mui 216
BingConfigurationClient.dll 216
0xaa8b300272a0 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat 216
0xaa8b30027430 \Windows\System32\mfplat.dll 216
0xaa8b300275c0 \Windows\System32 216
Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat.LOG1 216
0xaa8b300278e0 \Windows\System32\en-US\explorerframe.dll.mui 216
0xaa8b30027a70 \Windows\System32\en-US\InputSwitch.dll.mui 216
0xaa8b30027c00 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b30027d90 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat.LOG2 216
0xaa8b300280b0 \Windows\System32\en-US\winnlsres.dll.mui 216
0xaa8b30028560 \Windows\System32\en-US\batmeter.dll.mui 216
Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-
4E5D-B744-2EB1AE5198B7}_SnippingTool_exe 216
0xaa8b30028ba0 \Windows\bcastdvr 216
0xaa8b30028d30 \Users\mctf_user\AppData\Local\Microsoft\GameDVR 216
0xaa8b300291e0 \Windows\System32\IconCodecService.dll 216
0xaa8b30029500 \Windows\System32\CapabilityAccessManager.dll 216
0xaa8b30029690 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30029820 \Windows\System32\en-US\hcproviders.dll.mui 216
0xaa8b300299b0 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\
WebCacheV01.dat 216
0xaa8b30029b40 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30029cd0 \Windows\System32\ieproxy.dll 216
0xaa8b3002a310 \Windows\System32\en-US\bthprops.cpl.mui 216
0xaa8b3002a4a0 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\V01.log
216
0xaa8b3002a630 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\
WebCacheV01.jfm 216
0xaa8b3002a950 \Windows\System32\msimtf.dll 216
0xaa8b3002aae0 \CMNotify 216
0xaa8b3002ae00 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b3002b120 \Windows\System32\PortableDeviceTypes.dll 216
0xaa8b3002b2b0 \Windows\System32\Windows.UI.Shell.dll 216
0xaa8b3002b440 \Windows\System32\Windows.Storage.Search.dll 216
0xaa8b3002b760 \Windows\System32\en-US\ActionCenter.dll.mui 216
0xaa8b3002b8f0 \Windows\System32\icuuc.dll 216
0xaa8b3002ba80 \Windows\System32\Windows.FileExplorer.Common.dll 216
0xaa8b3002bc10 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCacheLock.dat
216
0xaa8b3002bda0 \Windows\System32\en-US\edgehtml.dll.mui 216
0xaa8b3002c0c0 \Windows\System32\WinMetadata\Windows.Web.winmd 216
0xaa8b3002c250 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b3002c3e0 \Windows\System32\wscsvc.dll 216
0xaa8b3002c570 \Windows\System32\edgeIso.dll 216
0xaa8b3002c890 \CMNotify 216
0xaa8b3002d1f0 \Windows\System32\WinMetadata\Windows.ApplicationModel.winmd
216
0xaa8b3002d510 \Windows\System32\WinMetadata\Windows.Security.winmd 216
0xaa8b3002d830 \Windows\System32\audiodg.exe 216
0xaa8b3002d9c0 \Windows\System32\Windows.Cortana.OneCore.dll 216
0xaa8b3002db50 \Windows\System32\RuntimeBroker.exe 216
0xaa8b3002dce0 \Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_5.82.19041.1110_none_792d1c772443f647 216
0xaa8b3002e320 \Windows\System32\en-US\imapi2.dll.mui 216
0xaa8b3002e4b0 \Windows\System32 216
0xaa8b3002e640 \$Directory 216
0xaa8b3002e7d0 \Windows\System32\bthprops.cpl 216
0xaa8b3002fc20 \Windows\System32\wdmaud.drv 216
0xaa8b300300d0 \Windows\System32\en-US\netmsg.dll.mui 216
0xaa8b300308a0 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30030bc0 \Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_5.82.19041.1110_none_792d1c772443f647\comctl32.dll 216
0xaa8b30030d50 \Windows\System32\VBoxTray.exe 216
0xaa8b30030ee0 \CMApi 216
0xaa8b30031200 \Windows\System32\SystemSettings.DataModel.dll 216
0xaa8b30031b60 \Program Files\Common Files\System\Ole DB\oledb32r.dll 216
0xaa8b300e90e0 \Windows\System32\ubpm.dll 216
0xaa8b300e9270 \Windows\System32\netprofm.dll 216
0xaa8b300e9400 \CMNotify 216
0xaa8b300e98b0 \CMNotify 216
0xaa8b300e9a40 \CMNotify 216
0xaa8b300e9bd0 \CMNotify 216
0xaa8b300e9d60 \Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\
NTUSER.DAT{1ff77a01-52f9-11ed-a64f-85d007eed5b5}.TM 216
0xaa8b300e9ef0 \CMNotify 216
0xaa8b300ea080 \CMNotify 216
0xaa8b300ea3a0 \CMNotify 216
0xaa8b300ea6c0 \Windows\System32\taskcomp.dll 216
0xaa8b300ea850 \Windows\ServiceProfiles\LocalService\NTUSER.DAT{1ff77a01-52f9-
11ed-a64f-85d007eed5b5}.TMContainer00000000000000000002.regtrans-ms 216
0xaa8b300ead00 \$Directory 216
0xaa8b300eae90 \Windows\System32\svchost.exe 216
0xaa8b300eb1b0 \Windows\System32\usermgrcli.dll 216
0xaa8b300eb340 \Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\
NTUSER.DAT{1ff77a01-52f9-11ed-a64f-85d007eed5b5}.TM 216
0xaa8b300eb4d0 \Windows\System32\schedsvc.dll 216
0xaa8b300eb7f0 \Windows\System32\profsvc.dll 216
0xaa8b300eb980 \CMNotify 216
0xaa8b300ebb10 \Windows\System32\wmiclnt.dll 216
0xaa8b300ebca0 \CMNotify 216
0xaa8b300ebe30 \CMNotify 216
0xaa8b300ec150 \CMNotify 216
0xaa8b300ec2e0 \Windows\System32\d3d10warp.dll 216
0xaa8b300ec600 \Windows\System32\ISM.dll 216
0xaa8b300ecc40 \Windows\System32\usermgr.dll 216
0xaa8b300ecdd0 \Windows\System32 216
0xaa8b300ed0f0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b300ed280 \CMNotify 216
0xaa8b300ed410 \atsvc 216
0xaa8b300ed5a0 \CMNotify 216
0xaa8b300ed730 \CMNotify 216
0xaa8b300ed8c0 \CMNotify 216
0xaa8b300eda50 \CMNotify 216
0xaa8b300ee090 \CMNotify 216
0xaa8b300ee3b0 \atsvc 216
0xaa8b300ee540 \Windows\Tasks 216
0xaa8b300ee6d0 \atsvc 216
0xaa8b300ee860 \CMNotify 216
0xaa8b300ee9f0 \Windows\System32\profsvcext.dll 216
0xaa8b300eeb80 \Windows\System32\svchost.exe 216
0xaa8b300eed10 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b300eeea0 \Windows\System32 216
0xaa8b300ef1c0 \CMNotify 216
0xaa8b300ef350 \Windows\System32\wevtsvc.dll 216
0xaa8b300ef4e0 \Windows\SystemApps\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll 216
0xaa8b300ef800 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b300efb20 \Windows\System32\avrt.dll 216
0xaa8b300efe40 \CMNotify 216
0xaa8b300f0160 \CMApi 216
0xaa8b300f02f0 \Windows\System32\AppXDeploymentClient.dll 216
0xaa8b300f0480 \CMNotify 216
0xaa8b300f0610 \Windows\System32\ninput.dll 216
0xaa8b300f07a0 \Windows\System32\CSystemEventsBrokerClient.dll 216
0xaa8b3016d0e0 \Windows\System32\PortableDeviceApi.dll 216
0xaa8b3016d400 \Windows\Fonts\segoeui.ttf 216
0xaa8b3016d590 \Windows\System32\mscms.dll 216
0xaa8b3016da40 \Windows\System32\twinapi.appcore.dll 216
0xaa8b3016def0 \$Directory 216
0xaa8b3016e3a0 \eventlog 216
0xaa8b3016e6c0 \eventlog 216
0xaa8b3016e850 \eventlog 216
0xaa8b3016eb70 \Windows\System32\coloradapterclient.dll 216
0xaa8b3016ee90 \Windows\System32\wevtapi.dll 216
0xaa8b3016f1b0 \Windows\System32\TimeBrokerClient.dll 216
0xaa8b3016f4d0 \Windows\System32\UIAnimation.dll 216
0xaa8b3016f820 〖ꪋ〖ꪋ 0
0xaa8b3016f980 \Windows\System32\UserMgrProxy.dll 216
0xaa8b3016fb10 \Windows\System32\DispBroker.Desktop.dll 216
0xaa8b3016fe30 \Windows\System32\WindowManagementAPI.dll 216
0xaa8b30170150 \Windows\System32\WindowsCodecs.dll 216
0xaa8b301702e0 \Endpoint 216
0xaa8b30170ab0 \Windows\System32\VBoxService.exe 216
0xaa8b30171280 \Windows\System32\svchost.exe 216
0xaa8b30171410 \Windows\System32 216
0xaa8b301715a0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b30171a50 \Windows\System32\netjoin.dll 216
0xaa8b30171be0 \ProgramData\USOShared\Logs\System\
UpdateSessionOrchestration.893a3b02-bd34-472e-b09c-1777dbcf09fb.1.etl 216
0xaa8b30171d70 \Winsock2\CatalogChangeListener-428-0 216
0xaa8b301723b0 \Windows\System32\TimeBrokerServer.dll 216
0xaa8b30172540 \Endpoint 216
0xaa8b30172b80 \Windows\System32\WPTaskScheduler.dll 216
0xaa8b30172d10 \Endpoint 216
0xaa8b30172ea0 \$Directory 216
0xaa8b30173350 \Windows\SystemApps\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\resources.en-US.pri
216
0xaa8b301734e0 \Windows\System32\winevt\Logs\System.evtx 216
0xaa8b30173670 \Windows\System32\nsisvc.dll 216
0xaa8b30173800 \Windows\System32\mpr.dll 216
0xaa8b30173cb0 \Windows\System32\winevt\Logs\Application.evtx 216
0xaa8b30173e40 \Windows\System32\GameInput.dll 216
0xaa8b30174610 \Winsock2\CatalogChangeListener-170-0 216
0xaa8b301747a0 \Endpoint 216
0xaa8b30174930 \Windows\System32\policymanager.dll 216
0xaa8b30174ac0 \Windows\System32\version.dll 216
0xaa8b30174c50 \Endpoint 216
0xaa8b30174de0 \Windows\System32\en-US\crypt32.dll.mui 216
0xaa8b301ee950 \$PrepareToShrinkFileSize 216
0xaa8b301eec30 \$PrepareToShrinkFileSize 216
0xaa8b301f1190 \$PrepareToShrinkFileSize 216
0xaa8b30234100 \Windows\System32\dllhost.exe 216
0xaa8b30234290 \Windows\System32\Windows.Gaming.Input.dll 216
0xaa8b30234420 \CMApi 216
0xaa8b302345b0 \Windows\System32\winevt\Logs\Key Management Service.evtx 216
0xaa8b302348d0 \Windows\SystemResources\Windows.UI.ShellCommon\
Windows.UI.ShellCommon.pri 216
0xaa8b30234a60 \Windows\System32\dhcpcore6.dll 216
0xaa8b30234d80 \CMApi 216
0xaa8b302350a0 \$Directory 216
0xaa8b30235230 \Windows\System32\OneCoreUAPCommonProxyStub.dll 216
0xaa8b302353c0 \Windows\System32\winevt\Logs\Internet Explorer.evtx 216
0xaa8b30235550 \Windows\System32\AudioEndpointBuilder.dll 216
0xaa8b302356e0 \Windows\System32\DispBroker.dll 216
0xaa8b30235870 \Windows\System32\FntCache.dll 216
0xaa8b30235a00 \CMNotify 216
0xaa8b30235b90 \Windows\System32\winnsi.dll 216
0xaa8b30235d20 \Windows\System32\sysmain.dll 216
0xaa8b30235eb0 \Windows\System32\winevt\Logs\HardwareEvents.evtx 216
0xaa8b302361d0 \CMNotify 216
0xaa8b30236360 \Windows\SystemApps\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources.pri 216
0xaa8b30236680 \Windows\System32\icu.dll 216
0xaa8b30236810 \Windows\System32\winevt\Logs\Security.evtx 216
0xaa8b302369a0 \Windows\System32\dhcpcore.dll 216
0xaa8b30236b30 \CMNotify 216
0xaa8b30236cc0 \CMApi 216
0xaa8b30236e50 \Windows\System32\actxprxy.dll 216
0xaa8b30237170 \Windows\System32\themeservice.dll 216
0xaa8b302377b0 \Windows\System32 216
0xaa8b30237ad0 \Windows\System32\ncsi.dll 216
0xaa8b30237c60 \Windows\System32\winevt\Logs\Windows PowerShell.evtx 216
0xaa8b30237df0 \Windows\System32 216
0xaa8b30238110 \Windows\System32\dhcpcsvc6.dll 216
0xaa8b30238750 \color 216
0xaa8b30238d90 \Windows\System32\dhcpcsvc.dll 216
0xaa8b302393d0 \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\
~FontCache-FontFace.dat 216
0xaa8b30239560 \Windows\rescache\_merged\348087742\3373494208.pri 216
0xaa8b30239880 \Windows\System32\MMDevAPI.dll 216
0xaa8b30239a10 \Windows\Fonts\times.ttf 216
0xaa8b30239ba0 \CMNotify 216
0xaa8b30239ec0 \Windows\System32\secur32.dll 216
0xaa8b3023a1e0 \Windows\System32\DXCore.dll 216
0xaa8b3023a370 \Windows\System32\Windows.Graphics.dll 216
0xaa8b3023a500 \Windows\System32\en-US\localspl.dll.mui 216
0xaa8b3023a820 \ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-
3716689AF493}.2.ver0x0000000000000001.db 216
0xaa8b3023a9b0 \CMNotify 216
0xaa8b3023ab40 \Windows\System32\en-US\windows.storage.dll.mui 216
0xaa8b3023acd0 \espeakertopo 216
0xaa8b3023ae60 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b3023b180 \Windows\System32\osbaseln.dll 216
0xaa8b3023b310 \Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll 216
0xaa8b3023b4a0 \srvsvc 216
0xaa8b3023b7c0 \$Directory 216
0xaa8b3023b950 \Windows\System32\AppMon.dll 216
0xaa8b3023c120 \$Directory 216
0xaa8b3023c2b0 \$Directory 216
0xaa8b3023c440 \Windows\System32\en-US\MMDevAPI.dll.mui 216
0xaa8b3023c5d0 \Windows\System32\en-US\AudioEndpointBuilder.dll.mui 216
0xaa8b3023c760 \eheadphonetopo 216
0xaa8b3023c8f0 \Users\mctf_user\AppData\Local\Packages\
Microsoft_Windows_Shell_RunDialog 216
0xaa8b3023ca80 \Windows\System32\appwiz.cpl 216
0xaa8b3023cc10 \Windows\System32\cabinet.dll 216
0xaa8b3023cda0 \Windows\Fonts 216
0xaa8b3023d0c0 \Windows\System32\nlasvc.dll 216
0xaa8b3023d250 \Windows\System32\WinMetadata\Windows.Storage.winmd 216
0xaa8b3023d570 \Windows\System32\UiaManager.dll 216
0xaa8b3023da20 \Windows\System32\spool\drivers\x64\PCC 216
0xaa8b3023dbb0 \Windows\System32\netprofmsvc.dll 216
0xaa8b3023dd40 \Windows\Fonts\StaticCache.dat 216
0xaa8b3023e1f0 \Windows\System32\ssdpapi.dll 216
0xaa8b3023e510 \Windows\System32\mssrch.dll 216
0xaa8b3023e6a0 \CMApi 216
0xaa8b3023e830 \emicintopo 216
0xaa8b3023e9c0 \Windows\System32\DevDispItemProvider.dll 216
0xaa8b3023ece0 \Windows\System32\spool\prtprocs\x64\winprint.dll 216
0xaa8b3023ee70 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b3023f190 \Windows\System32\en-US\inetpp.dll.mui 216
0xaa8b3023f4b0 \Windows\System32\spool\drivers\W32X86\PCC 216
0xaa8b3023f7d0 \SwDevice 216
0xaa8b3023fc80 \Windows\System32\MTF.dll 216
0xaa8b3023fe10 \Windows\System32\spool\drivers\x64\PCC 216
0xaa8b30240130 \CMNotify 216
0xaa8b30240450 \SwDevice 216
0xaa8b30240770 \Windows\System32\spool\drivers\x64\PCC 216
0xaa8b30240a90 \Windows\System32\en-US\netprofmsvc.dll.mui 216
0xaa8b30240c20 \Windows\System32\HolographicExtensions.dll 216
0xaa8b30240db0 \$Directory 216
0xaa8b30241710 \Dev\Query 216
0xaa8b302418a0 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30241a30 \SwDevice 216
0xaa8b30241bc0 \Windows\System32\taskhostw.exe 216
0xaa8b30241d50 \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\
~FontCache-S-1-5-21-1732203096-1246889736-2804438105-1002.dat 216
0xaa8b30241ee0 \Windows\System32\wincorlib.dll 216
0xaa8b30242200 \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\
~FontCache-FontSet-S-1-5-21-1732203096-1246889736-2804438105-1002.dat 216
0xaa8b302426b0 \Windows\System32\en-US\propsys.dll.mui 216
0xaa8b302429d0 \Windows\System32\ShellCommonCommonProxyStub.dll 216
0xaa8b30242b60 \eheadphonetopo 216
0xaa8b30242cf0 \Dev\Query 216
0xaa8b30242e80 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b302437e0 \Windows\System32\NPSM.dll 216
0xaa8b30243970 \Windows\Fonts\consola.ttf 216
0xaa8b30243c90 \Windows\System32\BCP47Langs.dll 216
0xaa8b30243e20 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b303af9d0 \Windows\System32\drivers\condrv.sys 216
0xaa8b303b65a0 \Windows\System32\drivers\lltdio.sys 216
0xaa8b303b7570 \Windows\System32\drivers\mslldp.sys 216
0xaa8b303b8260 \Windows\System32\drivers\rspndr.sys 216
0xaa8b303b8820 \Windows\System32\drivers\wanarp.sys 216
0xaa8b303eb100 \$Directory 216
0xaa8b303eb290 \Windows\System32\MrmCoreR.dll 216
0xaa8b303eb420 \Users\mctf_user\AppData\Local\Microsoft\Windows\Caches\
{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db 216
0xaa8b303eb5b0 \Windows\System32\AudioSes.dll 216
0xaa8b303eb740 \Windows\System32\C_1251.NLS 216
0xaa8b303eb8d0 \Windows\System32\C_1256.NLS 216
0xaa8b303eba60 \Windows\System32\InputHost.dll 216
0xaa8b303ebbf0 \Windows\System32\TextInputFramework.dll 216
0xaa8b303ebd80 \Windows\System32\vcruntime140_clr0400.dll 216
0xaa8b303ec0a0 \$Directory 216
0xaa8b303ec230 \Windows\System32\localspl.dll 216
0xaa8b303ec3c0 \Windows\System32\C_1254.NLS 216
0xaa8b303ec550 \Windows\ServiceState\EventLog\Data\lastalive0.dat 216
0xaa8b303ec6e0 \CMNotify 216
0xaa8b303ec870 \Windows\System32\C_1253.NLS 216
0xaa8b303eca00 \CMNotify 216
0xaa8b303ecb90 \Dev\Query 216
0xaa8b303ecd20 \Windows\System32\Windows.UI.dll 216
0xaa8b303eceb0 \SwDevice 216
0xaa8b303ed1d0 \espeakertopo 216
0xaa8b303ed360 \Windows\System32\C_1250.NLS 216
0xaa8b303ed4f0 \Windows\System32 216
0xaa8b303ed680 \$Directory 216
0xaa8b303ed810 \Windows\System32\dmiso8601utils.dll 216
0xaa8b303ed9a0 \$Directory 216
0xaa8b303edb30 \Windows\System32\LanguageOverlayUtil.dll 216
0xaa8b303edcc0 \Windows\System32\AppResolver.dll 216
0xaa8b303ede50 \Windows\System32\PrintIsolationProxy.dll 216
0xaa8b303ee170 \Windows\System32\CoreShellExtFramework.dll 216
0xaa8b303ee300 \Windows\System32\oleaut32.dll 216
0xaa8b303ee490 \Users\mctf_user\Desktop\DESKTOP-UULMDM7-20241108-212634.raw
216
0xaa8b303ee620 \Users\Public\Desktop\desktop.ini 216
0xaa8b303ee7b0 \$Directory 216
0xaa8b303ee940 \Windows\System32\Windows.UI.Immersive.dll 216
0xaa8b303eead0 \CMApi 216
0xaa8b303eec60 \$Directory 216
0xaa8b303eedf0 \Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\
de013c985ad100d05dc94ec118f77b92\mscorlib.ni.dll 216
0xaa8b303ef110 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
thumbcache_idx.db 216
0xaa8b303ef2a0 \$Directory 216
0xaa8b303ef5c0 \Users\Public\desktop.ini 216
0xaa8b303ef750 \emicintopo 216
0xaa8b303ef8e0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Themes\
CachedFiles\CachedImage_1024_768_POS4.jpg 216
0xaa8b303efa70 \Windows\System32\BCP47mrm.dll 216
0xaa8b303efc00 \Windows\en-US\explorer.exe.mui 216
0xaa8b303efd90 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
thumbcache_48.db 216
0xaa8b303f00b0 \Windows\System32\winhttp.dll 216
0xaa8b303f0240 \Users\mctf_user\AppData\Local\Microsoft\Windows\Caches\
cversions.3.db 216
0xaa8b303f03d0 \Windows\System32\OnDemandConnRouteHelper.dll 216
0xaa8b303f06f0 \Windows\System32\iertutil.dll 216
0xaa8b303f0880 \Windows\System32\computenetwork.dll 216
0xaa8b303f0a10 \Windows\System32\npmproxy.dll 216
0xaa8b303f0ba0 \Windows\System32\TileDataRepository.dll 216
0xaa8b303f0d30 \$Directory 216
0xaa8b303f0ec0 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b303f11e0 \$Directory 216
0xaa8b303f1370 \Windows\System32\Windows.UI.Xaml.dll 216
0xaa8b303f1500 \Windows\System32\DataExchange.dll 216
Microsoft_Windows_RemoteDesktop 216
0xaa8b303f19b0 \Windows\System32\rasadhlp.dll 216
0xaa8b303f1b40 \Users\mctf_user\AppData\Local\Packages\
Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8} 216
0xaa8b303f1e60 \Windows\System32\urlmon.dll 216
0xaa8b303f2180 \Windows\System32\drivers\etc 216
0xaa8b303f24a0 \Users\mctf_user\AppData\Local\Packages\
Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F} 216
0xaa8b303f2630 \Windows\System32\FWPUCLNT.DLL 216
0xaa8b303f27c0 \SwDevice 216
0xaa8b303f2ae0 \SwDevice 216
0xaa8b303f2e00 \Users\mctf_user\AppData\Local\ConnectedDevicesPlatform\
L.mctf_user\ActivitiesCache.db 216
0xaa8b303f32b0 \Windows\System32\SndVolSSO.dll 216
0xaa8b303f35d0 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_charmap_exe 216
0xaa8b303f38f0 \Windows\System32\srvcli.dll 216
0xaa8b303f3a80 \Windows\System32\dnsrslvr.dll 216
0xaa8b303f3c10 \Users\mctf_user\AppData\Local\Packages\
Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5} 216
0xaa8b303f40c0 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_cmd_exe 216
0xaa8b303f4250 \Windows\System32\StartTileData.dll 216
0xaa8b303f43e0 \CMNotify 216
0xaa8b303f4700 \Windows\System32\DWrite.dll 216
0xaa8b303f4890 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b303f4bb0 \Windows\System32\ntshrui.dll 216
0xaa8b303f4ed0 \Windows\System32\ApplicationFrame.dll 216
0xaa8b303f5510 \eheadphonetopo 216
0xaa8b303f5830 \Windows\System32\Windows.Globalization.dll 216
0xaa8b303f5ce0 \Windows\System32\en-US\propsys.dll.mui 216
0xaa8b303f6190 \Windows\System32\Windows.UI.Xaml.Resources.19h1.dll 216
0xaa8b303f6960 \Windows\System32\linkinfo.dll 216
0xaa8b303f6af0 \Windows\System32\nrpsrv.dll 216
0xaa8b303f72c0 \Windows\System32\Windows.UI.Xaml.Phone.dll 216
0xaa8b303f7450 \Windows\System32\drvstore.dll 216
0xaa8b303f7770 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b303f83f0 \Windows\System32\directmanipulation.dll 216
0xaa8b303f88a0 \Windows\rescache\_merged\3677477565\3189285431.pri 216
0xaa8b303f8a30 \Windows\System32\usoapi.dll 216
0xaa8b303f8d50 \Windows\System32\Windows.UI.Xaml.Controls.dll 216
0xaa8b303f8ee0 \Windows\SystemResources\Windows.UI.ShellCommon\pris\
Windows.UI.ShellCommon.en-US.pri 216
0xaa8b303f9390 \Windows\System32\en-US\dsreg.dll.mui 216
0xaa8b303f9520 \Windows\System32\Windows.Devices.Radios.dll 216
0xaa8b303f9840 \ProgramData\USOPrivate\UpdateStore\store.db 216
0xaa8b303f9cf0 \Windows\System32\BthRadioMedia.dll 216
0xaa8b303f9e80 \Windows\System32\Windows.Internal.Signals.dll 216
0xaa8b303fa650 \Endpoint 216
0xaa8b303fa7e0 \Windows\System32\Windows.UI.Xaml.InkControls.dll 216
0xaa8b303fa970 \Windows\System32\en-US\ESENT.dll.mui 216
0xaa8b303fac90 \Windows\System32\BluetoothApis.dll 216
0xaa8b303fae20 \CMNotify 216
0xaa8b30455100 \Windows\System32\sru\SRUDB.dat 216
0xaa8b30455420 \Windows\System32\AppExtension.dll 216
0xaa8b304555b0 \Windows\System32\spinf.dll 216
0xaa8b30455740 \Windows\System32\sru\SRU.chk 216
0xaa8b304558d0 \Windows\System32\inetpp.dll 216
0xaa8b30455d80 \Windows\System32\en-US\twinui.pcshell.dll.mui 216
0xaa8b304560a0 \Windows\Fonts\segmdl2.ttf 216
0xaa8b30456230 \Windows\System32\spool\drivers\W32X86\PCC 216
0xaa8b304566e0 \Windows\System32\AudioSrvPolicyManager.dll 216
0xaa8b30456870 \Windows\System32\sru\SRUDB.jfm 216
0xaa8b30456a00 \Program Files (x86)\KeePass Password Safe 2\KeePass.exe.config
216
0xaa8b30456d20 \Windows\System32\audiosrv.dll 216
0xaa8b304571d0 \Windows\System32\AudioEng.dll 216
0xaa8b30457360 \Windows\System32\sru\SRUtmp. 216
0xaa8b304574f0 \Windows\System32\drivers\storport.sys 216
0xaa8b30457680 \CMApi 216
0xaa8b304579a0 \Windows\System32 216
0xaa8b30457b30 \Users\mctf_user\AppData\Local\ConnectedDevicesPlatform\
L.mctf_user\ActivitiesCache.db-wal 216
0xaa8b30457cc0 \Users\mctf_user\AppData\Local\ConnectedDevicesPlatform\
L.mctf_user\ActivitiesCache.db-shm 216
0xaa8b30457e50 \Windows\System32\APMon.dll 216
0xaa8b304587b0 \Users\mctf_user\AppData\Local\Packages\
Microsoft_Windows_Explorer 216
0xaa8b30458940 \Windows\System32\webio.dll 216
0xaa8b30458ad0 \Windows\System32\winnlsres.dll 216
0xaa8b30458c60 \espeakerwave 216
0xaa8b30458df0 \emicinwave 216
0xaa8b304592a0 \Windows\System32\AUDIOKSE.dll 216
0xaa8b30459a70 \Windows\System32\en-US\AudioSrv.dll.mui 216
0xaa8b30459c00 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b30459d90 \Windows\System32\en-US\winnlsres.dll.mui 216
0xaa8b3045a3d0 \Windows\System32\CatRoot 216
0xaa8b3045a6f0 \CMNotify 216
0xaa8b3045aa10 \espeakertopo 216
0xaa8b3045b1e0 \emicintopo 216
0xaa8b3045bb40 \Windows\System32\en-US\mswsock.dll.mui 216
0xaa8b3045bcd0 \Windows\System32\svchost.exe 216
0xaa8b3045c310 \Device\HarddiskVolume2\Users\mctf_user\NTUSER.DAT{54673804-52f1-
11ed-a651-2c44fd248b9d}.TM 216
0xaa8b3045c630 \Windows\System32\svchost.exe 216
0xaa8b3045c7c0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b3045cae0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b3045cc70 \Windows\System32\Windows.StateRepository.dll 216
0xaa8b3045d120 \ProgramData\Microsoft\Windows\AppRepository\Packages\
ActivationStore.dat 216
0xaa8b3045d2b0 \Windows\System32\HrtfApo.dll 216
0xaa8b3045d5d0 \Windows\System32\en-US\gpsvc.dll.mui 216
0xaa8b3045d760 \Windows\System32\Windows.Media.Devices.dll 216
0xaa8b3045da80 \Windows\System32\CompPkgSup.dll 216
0xaa8b3045dc10 \Windows\System32\en-US\taskhostw.exe.mui 216
0xaa8b3045dda0 \Windows\System32\svchost.exe 216
0xaa8b3045e0c0 \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\
~FontCache-System.dat 216
0xaa8b3045e250 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b3045e3e0 \Windows\System32\svchost.exe 216
0xaa8b3045e570 \Windows\System32 216
0xaa8b3045e700 \Windows\System32\BFE.DLL 216
0xaa8b3045ed40 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b3045eed0 \$Directory 216
0xaa8b3045f1f0 \Windows\System32\wcmsvc.dll 216
0xaa8b3045f510 \Windows\System32\mobilenetworking.dll 216
0xaa8b3045f9c0 \Windows\System32\en-US\bfe.dll.mui 216
0xaa8b3045fb50 \Windows\System32\vsstrace.dll 216
0xaa8b3045fce0 \Windows\System32\shsvcs.dll 216
0xaa8b30460320 \Windows\System32\dusmsvc.dll 216
0xaa8b304604b0 \CMApi 216
0xaa8b304607d0 \Windows\System32\wups.dll 216
0xaa8b30460e10 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b30461130 \Windows\System32\StateRepository.Core.dll 216
0xaa8b304612c0 \Windows\System32 216
0xaa8b304615e0 \ProgramData\Microsoft\Windows\AppRepository\StateRepository-
Machine.srd 216
0xaa8b30461900 \Windows\System32\esent.dll 216
0xaa8b30461a90 \Windows\System32\en-US\spoolsv.exe.mui 216
0xaa8b30461c20 \ProgramData\Microsoft\Windows\wfp\wfpdiag.etl 216
0xaa8b30461db0 \CMNotify 216
0xaa8b30462580 \Windows\System32\msauserext.dll 216
0xaa8b30462710 \Windows\System32\RMapi.dll 216
0xaa8b304628a0 \Windows\System32\cmintegrator.dll 216
0xaa8b30462bc0 \Windows\System32\fveapi.dll 216
0xaa8b30462d50 \Windows\System32\fontgroupsoverride.dll 216
0xaa8b30462ee0 \Windows\System32\biwinrt.dll 216
0xaa8b30463200 \Windows\System32\TextShaping.dll 216
0xaa8b30463390 \Windows\System32\spoolsv.exe 216
0xaa8b30463520 \Windows\System32\wcmcsp.dll 216
0xaa8b30463b60 \spoolss 216
0xaa8b30464b00 \spoolss 216
11ed-a651-2c44fd248b9d}.TM 216
0xaa8b30464e20 \spoolss 216
0xaa8b30495670 \Windows\System32\drivers\http.sys 216
0xaa8b30496c00 \Windows\System32\drivers\msquic.sys 216
0xaa8b304974a0 \Windows\System32\drivers\mrxsmb20.sys 216
0xaa8b30497eb0 \Windows\System32\drivers\bowser.sys 216
0xaa8b30499160 \Windows\System32\drivers\mpsdrv.sys 216
0xaa8b30499440 \Windows\System32\drivers\mrxsmb.sys 216
0xaa8b3049a130 \Windows\System32\drivers\srvnet.sys 216
0xaa8b3049a580 \Windows\System32\drivers\mmcss.sys 216
0xaa8b3049ab40 \Windows\System32\drivers\Ndu.sys 216
0xaa8b3049bb10 \$PrepareToShrinkFileSize 216
0xaa8b3049dd90 \Windows\System32\drivers\PEAuth.sys 216
0xaa8b3049e1e0 \Windows\System32\drivers\srv2.sys 216
0xaa8b3049f770 \Windows\System32\drivers\tcpipreg.sys 216
0xaa8b30557290 \Windows\System32\en-US\windows.storage.dll.mui 216
0xaa8b30557420 \Winsock2\CatalogChangeListener-7bc-0 216
0xaa8b30557740 \Windows\System32\WMALFXGFXDSP.dll 216
0xaa8b30557a60 \Windows\System32\ProximityService.dll 216
0xaa8b305583c0 \Dev\Query 216
Microsoft_Windows_Computer 216
0xaa8b305586e0 \Dev\Query 216
0xaa8b30558a00 \Dev\Query 216
0xaa8b30558b90 \Windows\System32\en-US\sysmain.dll.mui 216
0xaa8b30558d20 \Dev\Query 216
0xaa8b305591d0 \Dev\Query 216
0xaa8b30559b30 \Dev\Query 216
0xaa8b3055a490 \Windows\System32\networkexplorer.dll 216
0xaa8b3055a620 \Windows\System32\wpnclient.dll 216
0xaa8b3055a940 \Windows\System32\ProximityServicePal.dll 216
0xaa8b3055aad0 \wkssvc 216
0xaa8b3055ac60 \Windows\System32\wkssvc.dll 216
0xaa8b3055b110 \Windows\System32\netmsg.dll 216
0xaa8b3055b2a0 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
SearchApp.exe 216
0xaa8b3055b430 \Windows\System32\ProximityCommonPal.dll 216
0xaa8b3055b750 \Windows\System32\ProximityCommon.dll 216
0xaa8b3055b8e0 \Dev\Query 216
0xaa8b3055ba70 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_mspaint_exe 216
0xaa8b3055bc00 \ProgramData\Microsoft\Windows\AppRepository\StateRepository-
Machine.srd-shm 216
0xaa8b3055bd90 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_notepad_exe 216
0xaa8b3055c560 \wkssvc 216
0xaa8b3055ca10 \Windows\System32\Windows.StateRepositoryCore.dll 216
0xaa8b3055cd30 \Windows\System32\en-US\netmsg.dll.mui 216
0xaa8b3055d1e0 \Windows\System32\dsparse.dll 216
0xaa8b3055d500 \Windows\System32\dps.dll 216
0xaa8b3055d820 \Windows\System32\en-US\batmeter.dll.mui 216
0xaa8b3055e310 \Windows\SystemResources\batmeter.dll.mun 216
0xaa8b3055e4a0 \Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll 216
0xaa8b3055e7c0 \Windows\System32\wbem\MOF 216
0xaa8b3055eae0 \Windows\System32\en-US\FirewallAPI.dll.mui 216
0xaa8b3055ec70 \Windows\System32\cryptcatsvc.dll 216
0xaa8b3055ee00 \Windows\System32\wbem\WMIsvc.dll 216
0xaa8b3055f5d0 \Windows\System32\cryptsvc.dll 216
0xaa8b3055fa80 \Windows\System32\FirewallAPI.dll 216
0xaa8b3055fc10 \Windows\System32\wbemcomn.dll 216
0xaa8b305600c0 \Windows\System32\MPSSVC.dll 216
0xaa8b30560250 \Windows\System32\batmeter.dll 216
0xaa8b305603e0 \Windows\System32\webauthn.dll 216
0xaa8b30560570 \Windows\System32\crypttpmeksvc.dll 216
0xaa8b30560700 \Windows\System32\sstpsvc.dll 216
0xaa8b30560890 \Windows\System32\rtutils.dll 216
0xaa8b30560a20 \Windows\System32\EthernetMediaManager.dll 216
0xaa8b30560bb0 \Windows\System32\shutdownux.dll 216
0xaa8b30560d40 \Windows\System32\vssapi.dll 216
0xaa8b30561380 \Windows\System32\NetworkUXBroker.dll 216
0xaa8b305616a0 \Windows\System32\samcli.dll 216
0xaa8b305619c0 \Windows\System32\PhotoMetadataHandler.dll 216
0xaa8b30561ce0 \Windows\System32\fwpolicyiomgr.dll 216
0xaa8b30562190 \Windows\System32\Windows.Devices.Enumeration.dll 216
0xaa8b30562640 \Windows\System32\wdi.dll 216
0xaa8b30562af0 \Windows\System32\es.dll 216
0xaa8b30562c80 \Windows\System32\httpapi.dll 216
0xaa8b30563130 \Windows\System32\wpnservice.dll 216
0xaa8b30563450 \SwDevice 216
0xaa8b305635e0 \Windows\System32\diagperf.dll 216
0xaa8b30563900 \CMApi 216
0xaa8b30563a90 \Windows\System32\MSWB7.dll 216
0xaa8b30563c20 \Windows\System32\wpncore.dll 216
0xaa8b30563db0 \Windows\System32\srvsvc.dll 216
0xaa8b305640d0 \Windows\System32\en-US\propsys.dll.mui 216
0xaa8b30564260 \Windows\System32\prm0009.dll 216
0xaa8b30564580 \Windows\System32\pnpts.dll 216
0xaa8b30564a30 \ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-
1A9A39C3FDA2}.2.ver0x0000000000000001.db 216
0xaa8b30564ee0 \ProgramData\Microsoft\Windows\Caches\cversions.2.db 216
0xaa8b30565520 \Windows\System32\en-US\vsstrace.dll.mui 216
0xaa8b305661a0 \Windows\System32\perftrack.dll 216
0xaa8b305664c0 \Windows\System32\StructuredQuery.dll 216
0xaa8b305667e0 \Windows\System32\threadpoolwinrt.dll 216
0xaa8b30566970 \Windows\System32\en-US\vsstrace.dll.mui 216
0xaa8b30566b00 \Windows\System32\winsqlite3.dll 216
0xaa8b30566e20 \Windows\System32\wbem\fastprox.dll 216
0xaa8b30644ac0 \Windows\System32\drivers\rassstp.sys 216
0xaa8b3064ab10 \Windows\System32\drivers\ndproxy.sys 216
0xaa8b3064c7d0 \Windows\System32\LogFiles\WMI\RtBackup\EtwRTWFP-IPsec
Diagnostics.etl 216
0xaa8b3064f740 \ 216
0xaa8b30650cd0 \Windows\System32\drivers\agilevpn.sys 216
0xaa8b306526b0 \Windows\System32\drivers\raspptp.sys 216
0xaa8b30652c70 \Windows\System32\drivers\rasl2tp.sys 216
0xaa8b306ca100 \CMApi 216
0xaa8b306ca290 \Windows\System32\sscore.dll 216
0xaa8b306ca5b0 \Windows\System32 216
0xaa8b306caa60 \Windows\System32\IDStore.dll 216
0xaa8b306cabf0 \Windows\System32\miutils.dll 216
0xaa8b306cad80 \Windows\System32\OneCoreCommonProxyStub.dll 216
0xaa8b306cb0a0 \Windows\System32\rasmans.dll 216
0xaa8b306cb3c0 \Windows\System32\adhapi.dll 216
0xaa8b306cb550 \Windows\System32\en-US\ole32.dll.mui 216
0xaa8b306cb6e0 \Windows\System32\mi.dll 216
0xaa8b306cb870 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
0xaa8b306cbb90 \Windows\System32\svchost.exe 216
0xaa8b306cbd20 \Endpoint 216
0xaa8b306cbeb0 \Winsock2\CatalogChangeListener-288-0 216
0xaa8b306cc1d0 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b306cc360 \Windows\System32\wmidcom.dll 216
0xaa8b306cc4f0 \Windows\System32\wwapi.dll 216
0xaa8b306cc680 \Windows\System32\rasman.dll 216
0xaa8b306cc810 \Windows\System32\eappprxy.dll 216
0xaa8b306cc9a0 \Windows\System32\sscoreext.dll 216
0xaa8b306cccc0 \Endpoint 216
0xaa8b306cce50 \Windows\System32\WwanRadioManager.dll 216
0xaa8b306cd170 \Windows\System32\rasapi32.dll 216
0xaa8b306cd300 \Windows\System32\es.dll 216
0xaa8b306cd940 \Windows\System32\WlanRadioManager.dll 216
0xaa8b306cdad0 \CMApi 216
0xaa8b306cdc60 \Windows\System32\wbem\wbemcore.dll 216
0xaa8b306cddf0 \Dev\Query 216
0xaa8b306ce110 \Windows\System32\NfcRadioMedia.dll 216
0xaa8b306ce2a0 \CMNotify 216
0xaa8b306ce430 \Endpoint 216
0xaa8b306ce5c0 \Windows\System32\wfapigp.dll 216
0xaa8b306ce750 \Windows\System32\resutils.dll 216
0xaa8b306ce8e0 \Windows\System32\srumsvc.dll 216
0xaa8b306cea70 \Windows\System32\cryptngc.dll 216
0xaa8b306cec00 \Endpoint 216
0xaa8b306ced90 \wkssvc 216
0xaa8b306cf0b0 \Windows\System32\clusapi.dll 216
0xaa8b306cf6f0 \Windows\System32\XboxGipRadioManager.dll 216
0xaa8b306cf880 \Windows\System32\stdole2.tlb 216
0xaa8b306cfba0 \Windows\System32\TaskFlowDataEngine.dll 216
0xaa8b306cfd30 \CMNotify 216
0xaa8b306d01e0 \SwDevice 216
0xaa8b306d0370 \Windows\System32\wbem\esscli.dll 216
0xaa8b306d0690 \SwDevice 216
0xaa8b306d09b0 \CMNotify 216
0xaa8b306d0b40 \SwDevice 216
0xaa8b306d14a0 \srvsvc 216
0xaa8b306d1630 \Windows\System32\en-US\ESENT.dll.mui 216
0xaa8b306d17c0 \Windows\System32\Windows.StateRepositoryPS.dll 216
0xaa8b306d1ae0 \srvsvc 216
0xaa8b306d1c70 \Windows\System32\wbem\repdrvfs.dll 216
0xaa8b306d22b0 \Windows\System32\wbem\wmiutils.dll 216
0xaa8b306d25d0 \CMNotify 216
0xaa8b306d2760 \Windows\System32\wbem\wbemsvc.dll 216
0xaa8b306d28f0 \SwDevice 216
0xaa8b306d2c10 \CMNotify 216
0xaa8b306d30c0 \CMNotify 216
0xaa8b306d3250 \$Extend\$ObjId:$O:$INDEX_ALLOCATION 216
0xaa8b306d33e0 \SwDevice 216
0xaa8b306d3890 \Windows\System32\wbem\Repository\INDEX.BTR 216
0xaa8b306d3a20 \CMApi 216
0xaa8b306d3bb0 \Windows\System32\UIRibbonRes.dll 216
0xaa8b306d3ed0 \Windows\System32\eappcfg.dll 216
0xaa8b306d4380 \Windows\System32\wbem\WmiPrvSD.dll 216
0xaa8b306d46a0 \Windows\System32\amsi.dll 216
0xaa8b306d4830 \Windows\System32\wbem\Repository\MAPPING1.MAP 216
0xaa8b306d4b50 \Windows\System32\ncobjapi.dll 216
0xaa8b306d4ce0 \Windows\System32\wbem\Repository\MAPPING3.MAP 216
0xaa8b306d5190 \Windows\System32\wbem\wbemess.dll 216
0xaa8b306d5320 \SwDevice 216
0xaa8b306d54b0 \Windows\System32\rastapi.dll 216
0xaa8b306d5640 \Windows\System32\wbem\Repository\MAPPING2.MAP 216
0xaa8b306d57d0 \SwDevice 216
0xaa8b306d5960 \Windows\System32\vfuprov.dll 216
0xaa8b306d5af0 \Windows\System32\wbem\Repository\OBJECTS.DATA 216
0xaa8b306d5c80 \Windows\System32\nduprov.dll 216
0xaa8b306d62c0 \Windows\System32\eeprov.dll 216
0xaa8b306d6450 \Windows\System32\FlightSettings.dll 216
0xaa8b306d65e0 \Windows\System32\Windows.ApplicationModel.dll 216
0xaa8b306d6900 \ROUTER 216
0xaa8b306d6a90 \Windows\System32\dmenrollengine.dll 216
0xaa8b306d6c20 \Windows\System32\rasppp.dll 216
0xaa8b306d6db0 \ROUTER 216
0xaa8b306d70d0 \Windows\System32\en-US\combase.dll.mui 216
0xaa8b306d78a0 \ROUTER 216
0xaa8b306d8200 \Windows\System32\dmcmnutils.dll 216
0xaa8b306d89d0 \Windows\System32\vpnike.dll 216
0xaa8b306d8cf0 \Windows\System32\wpnsruprov.dll 216
0xaa8b306d8e80 \Windows\System32\appsruprov.dll 216
0xaa8b306d9330 \Windows\System32\rascustom.dll 216
0xaa8b306d94c0 \Windows\System32\dmprocessxmlfiltered.dll 216
0xaa8b306d9970 \lsass 216
0xaa8b3074e130 \Windows\System32\drivers\raspppoe.sys 216
0xaa8b3074e580 \Windows\System32\drivers\ndistapi.sys 216
0xaa8b30750240 \Windows\System32\drivers\ndiswan.sys 216
0xaa8b30754d00 \Windows\SysWOW64\drivers\DumpIt.sys 216
11ed-a651-2c44fd248b9d}.TxR 216
0xaa8b3076c430 \Users\mctf_user\NTUSER.DAT{54673803-52f1-11ed-a651-
2c44fd248b9d}.TxR.1.regtrans-ms 216
0xaa8b3076c710 \Users\mctf_user\NTUSER.DAT{54673803-52f1-11ed-a651-
0xaa8b3076ce40 \Users\mctf_user\NTUSER.DAT{54673803-52f1-11ed-a651-
2c44fd248b9d}.TxR.blf 216
0xaa8b3076d570 \Users\mctf_user\NTUSER.DAT{54673803-52f1-11ed-a651-
0xaa8b30802150 \Windows\System32\imageres.dll 216
0xaa8b308022e0 \Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\
de013c985ad100d05dc94ec118f77b92\mscorlib.ni.dll.aux 216
0xaa8b30802470 \Windows\System32\winevt\Logs\Microsoft-Windows-WorkFolders
%4WHC.evtx 216
0xaa8b30802600 \Windows\System32\en-US\twext.dll.mui 216
0xaa8b30802c40 \Program Files\Windows Defender\shellext.dll 216
0xaa8b30802dd0 \Windows\System32\acppage.dll 216
0xaa8b30803410 \Windows\assembly\NativeImages_v4.0.30319_64\System\
808887ebadf1a37835b907c866cede3c\System.ni.dll.aux 216
0xaa8b308035a0 \Windows\System32\en-US\acppage.dll.mui 216
0xaa8b30803730 \Windows\System32\en-US\lsm.dll.mui 216
0xaa8b308038c0 \Windows\System32\en-US\sysmain.dll.mui 216
0xaa8b30803a50 \Windows\System32\twext.dll 216
0xaa8b30803be0 \Windows\System32\dcntel.dll 216
0xaa8b30804090 \Windows\System32\wosc.dll 216
0xaa8b30804540 \Windows\System32\raschap.dll 216
0xaa8b308046d0 \Windows\System32\WorkFoldersShell.dll 216
0xaa8b30804ea0 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b308051c0 \Windows\System32\msi.dll 216
0xaa8b30805800 \Windows\System32\ncryptsslp.dll 216
0xaa8b30805990 \Windows\assembly\NativeImages_v4.0.30319_64\
System.Configuration\05fe5db1ffb6ae997c427dbd45c1dd98\System.Configuration.ni.dll
216
0xaa8b308062f0 \Windows\System32\ncuprov.dll 216
0xaa8b30806480 \Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\
daba68776a7c26bc8eee56f012716bce\System.Drawing.ni.dll 216
0xaa8b308067a0 \Windows\assembly\NativeImages_v4.0.30319_64\
System.Windows.Forms\ad4e1b74ffb168b93b882f4f96a3acc4\
System.Windows.Forms.ni.dll.aux 216
0xaa8b30806c50 \Windows\System32\ncryptprov.dll 216
0xaa8b30806de0 \Windows\System32\energyprov.dll 216
0xaa8b30807100 \Windows\SystemResources\imageres.dll.mun 216
0xaa8b30807290 \Windows\System32\srumapi.dll 216
0xaa8b30807740 \wkssvc 216
0xaa8b30807a60 \Program Files (x86)\KeePass Password Safe 2\KeePass.config.xml
216
0xaa8b30807d80 \Users\mctf_user\AppData\Local\Packages\
0xaa8b308080a0 \Windows\assembly\NativeImages_v4.0.30319_64\System.Core\
11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll.aux 216
0xaa8b30808230 \Windows\System32\winbrand.dll 216
0xaa8b30808a00 \Windows\System32\mskeyprotect.dll 216
0xaa8b30808b90 \Program Files (x86)\KeePass Password Safe 2\unins000.exe 216
0xaa8b30808eb0 \Windows\Fonts\cour.ttf 216
0xaa8b308094f0 \Sessions\1\AppContainerNamedObjects\S-1-15-2-515815643-
2845804217-1874292103-218650560-777617685-4287762684-137415000 216
0xaa8b30809cc0 \Windows\assembly\NativeImages_v4.0.30319_64\System.Security\
cdcff8b87350b01fe89ea3419fabccbd\System.Security.ni.dll 216
0xaa8b3080a300 \Windows\System32\dssenh.dll 216
0xaa8b3080a940 \Windows\win.ini 216
0xaa8b3080ba70 \$Directory 216
0xaa8b3080c240 \Windows\System32\netapi32.dll 216
0xaa8b3080d500 \Windows\System32\Clipc.dll 216
0xaa8b3080de60 \Windows\System32\cscapi.dll 216
0xaa8b3080e310 \Windows\System32\en-US\netmsg.dll.mui 216
0xaa8b3080e630 \Windows\SystemApps\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
216
0xaa8b3080ec70 \$Directory 216
0xaa8b308103e0 \Windows\System32\icuin.dll 216
0xaa8b308111f0 \Windows\System32 216
0xaa8b30811ce0 \$Directory 216
0xaa8b30812320 \Windows\Logs\waasmedic\waasmedic.20241108_200955_148.etl 216
0xaa8b308124b0 \Windows\System32\svchost.exe 216
0xaa8b30812e10 \Windows\System32\dusmapi.dll 216
0xaa8b30813450 \Windows\System32\Windows.Globalization.Fontgroups.dll 216
0xaa8b308135e0 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30813770 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30813db0 \$Directory 216
0xaa8b30814bc0 \Windows\System32\en-US\combase.dll.mui 216
0xaa8b30816970 \Windows\System32\msftedit.dll 216
0xaa8b30817460 \Windows\System32\en-US\InputSwitch.dll.mui 216
0xaa8b30817dc0 \Windows\System32\Windows.Services.TargetedContent.dll 216
0xaa8b308180e0 \Windows\System32\Windows.UI.Xaml.Resources.Common.dll 216
0xaa8b30818270 \Windows\System32\wuapi.dll 216
0xaa8b30818d60 \Windows\System32\LicenseManager.dll 216
0xaa8b30819080 \Windows\System32\LicenseManagerSvc.dll 216
0xaa8b308196c0 \Windows\System32\Windows.Networking.Connectivity.dll 216
0xaa8b308199e0 \srvsvc 216
0xaa8b3081a1b0 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b3081a4d0 \$Directory 216
0xaa8b3081ae30 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b3081b150 \Windows\System32\updatepolicy.dll 216
0xaa8b3081b2e0 \Windows\System32\Windows.Web.dll 216
0xaa8b3081b470 \Windows\System32\gamestreamingext.dll 216
0xaa8b3081b600 \Windows\System32\TokenBroker.dll 216
0xaa8b3081bc40 \Windows\System32\en-US\mswsock.dll.mui 216
0xaa8b3081bdd0 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b3081c0f0 \Windows\System32\en-US\winnlsres.dll.mui 216
0xaa8b3081c280 \Windows\System32\Windows.Security.Authentication.OnlineId.dll
216
0xaa8b3081c8c0 \Windows\System32\msxml6r.dll 216
0xaa8b3081ca50 \Windows\System32\AuthBroker.dll 216
0xaa8b3081d090 \Windows\System32\tokenbinding.dll 216
0xaa8b3081d220 \Windows\System32\en-US\crypt32.dll.mui 216
0xaa8b3081d540 \Windows\System32\SecureTimeAggregator.dll 216
0xaa8b3081d860 \Windows\System32\msxml6.dll 216
0xaa8b3081e800 \Users\mctf_user\AppData\Local\Microsoft\Windows\UsrClass.dat
216
0xaa8b3081e990 \Users\mctf_user\AppData\Local\Microsoft\Windows\
UsrClass.dat.LOG2 216
0xaa8b3081eb20 \Users\mctf_user\AppData\Local\Microsoft\Windows\
UsrClass.dat{6cb58d3c-9e53-11ef-a656-080027bfce9e}.TM.blf 216
0xaa8b3081f160 \Users\mctf_user\ntuser.dat.LOG2 216
0xaa8b3081f2f0 \Windows\System32\InputSwitch.dll 216
0xaa8b3081f480 \Windows\SystemResources\crypt32.dll.mun 216
0xaa8b3081f610 \Sessions\1\AppContainerNamedObjects\S-1-15-2-536077884-
713174666-1066051701-3219990555-339840825-1966734348-1611281757 216
0xaa8b3081f7a0 \Users\mctf_user\AppData\Local\Microsoft\Windows\
UsrClass.dat{6cb58d3c-9e53-11ef-a656-
080027bfce9e}.TMContainer00000000000000000001.regtrans-ms 216
0xaa8b3081fac0 \Users\mctf_user\AppData\Local\Microsoft\Windows\
UsrClass.dat.LOG1 216
0xaa8b3081fc50 \Windows\System32\en-US\crypt32.dll.mui 216
0xaa8b3081fde0 \Users\mctf_user\NTUSER.DAT{54673804-52f1-11ed-a651-
2c44fd248b9d}.TMContainer00000000000000000002.regtrans-ms 216
0xaa8b30820100 \Windows\System32\cryptnet.dll 216
0xaa8b30820420 \Users\mctf_user\ntuser.dat.LOG1 216
0xaa8b308205b0 \Users\mctf_user\NTUSER.DAT{54673804-52f1-11ed-a651-
2c44fd248b9d}.TMContainer00000000000000000001.regtrans-ms 216
0xaa8b30820740 \Windows\System32\en-US\windows.ui.xaml.dll.mui 216
0xaa8b308208d0 \Users\mctf_user\NTUSER.DAT 216
0xaa8b30820a60 \Windows\System32\Windows.CloudStore.dll 216
0xaa8b30820bf0 \Users\mctf_user\AppData\Local\Microsoft\Windows\
UsrClass.dat{6cb58d3c-9e53-11ef-a656-
080027bfce9e}.TMContainer00000000000000000002.regtrans-ms 216
0xaa8b308210a0 \Users\mctf_user\NTUSER.DAT{54673804-52f1-11ed-a651-
2c44fd248b9d}.TM.blf 216
0xaa8b30821230 \Windows\System32\globinputhost.dll 216
0xaa8b308213c0 \Windows\System32\wininet.dll 216
0xaa8b30821870 \Device\HarddiskVolume2\Users\mctf_user\AppData\Local\Microsoft\
Windows\UsrClass.dat{6cb58d3c-9e53-11ef-a656-080027bfce9e}.TM 216
0xaa8b30821a00 \Windows\System32\SettingSync.dll 216
0xaa8b30821d20 \Device\HarddiskVolume2\Users\mctf_user\AppData\Local\Microsoft\
Windows\UsrClass.dat{6cb58d3c-9e53-11ef-a656-080027bfce9e}.TM 216
0xaa8b30953150 \Windows\System32\en-US\svchost.exe.mui 216
0xaa8b309532e0 \Windows\System32\en-US\lsm.dll.mui 216
0xaa8b30953790 \Windows\System32\ClipboardServer.dll 216
0xaa8b30953920 \Windows\System32\cdpusersvc.dll 216
0xaa8b30953ab0 \Windows\System32\taskhostw.exe 216
0xaa8b30953c40 \Windows\System32\edputil.dll 216
0xaa8b30953dd0 \Windows\System32\cdp.dll 216
0xaa8b30954280 \Windows\System32\en-US\winsrv.dll.mui 216
0xaa8b30954410 \Windows\System32\sihost.exe 216
0xaa8b309548c0 \Windows\System32\upshared.dll 216
0xaa8b30954be0 \Windows\System32\SebBackgroundManagerPolicy.dll 216
0xaa8b30954d70 \Windows\System32\daxexec.dll 216
0xaa8b30955090 \Windows\System32\coreaudiopolicymanagerext.dll 216
0xaa8b30955220 \Windows\System32\fhcfg.dll 216
0xaa8b309553b0 \Windows\System32\BackgroundMediaPolicy.dll 216
0xaa8b309556d0 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b309559f0 \Windows\System32\ActivationManager.dll 216
0xaa8b30955b80 \Windows\System32\AppxAllUserStore.dll 216
0xaa8b30955d10 \Windows\System32\efsutil.dll 216
0xaa8b30955ea0 \Windows\System32\DesktopShellExt.dll 216
0xaa8b309561c0 \Windows\System32\Windows.Shell.ServiceHostBuilder.dll 216
0xaa8b30956800 \Windows\System32\dbghelp.dll 216
0xaa8b30956990 \Windows\System32\windows.immersiveshell.serviceprovider.dll
216
0xaa8b30956cb0 \Windows\System32\modernexecserver.dll 216
0xaa8b30956e40 \Windows\System32\NotificationController.dll 216
0xaa8b30957160 \Windows\System32\PlaySndSrv.dll 216
0xaa8b309572f0 \Windows\System32\WpnUserService.dll 216
0xaa8b30957480 \Windows\System32\MsCtfMonitor.dll 216
0xaa8b30957610 \Windows\System32\msutb.dll 216
0xaa8b309577a0 \Windows\System32\dbgcore.dll 216
0xaa8b30957ac0 \Windows\System32 216
0xaa8b30957c50 \Windows\System32\Faultrep.dll 216
0xaa8b30957de0 \CMNotify 216
0xaa8b30958100 \CMApi 216
0xaa8b30958420 \Windows\System32\wpnapps.dll 216
0xaa8b309588d0 \Windows\System32\AppointmentActivation.dll 216
0xaa8b30958a60 \Windows\System32\StorageUsage.dll 216
0xaa8b30958bf0 \Windows\System32\en-US\MsCtfMonitor.dll.mui 216
0xaa8b309590a0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
0xaa8b309593c0 \Windows\System32\en-US\taskhostw.exe.mui 216
0xaa8b30959550 \Windows\System32\MoUsoCoreWorker.exe 216
0xaa8b309596e0 \Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync
%4Debug.evtx 216
0xaa8b30959a00 \Windows\System32\winmm.dll 216
0xaa8b30959d20 \Windows\System32\ExecModelClient.dll 216
0xaa8b30959eb0 \Windows\System32\radardt.dll 216
0xaa8b3095a1d0 \Windows\System32\en-US\winmm.dll.mui 216
0xaa8b3095a360 \Windows\System32\keyiso.dll 216
0xaa8b3095a4f0 \Windows\System32\TextInputMethodFormatter.dll 216
0xaa8b3095a810 \Windows\System32\InputService.dll 216
0xaa8b3095a9a0 \Windows\System32\dllhost.exe 216
0xaa8b3095ab30 \Windows\System32\en-US\ctfmon.exe.mui 216
0xaa8b3095acc0 \Windows\System32\notificationplatformcomponent.dll 216
0xaa8b3095ae50 \CMNotify 216
0xaa8b3095b170 \Windows\System32\TabSvc.dll 216
0xaa8b3095b300 \Windows\System32\ctfmon.exe 216
0xaa8b3095b620 \Windows\System32\Windows.CloudStore.Schema.Shell.dll 216
0xaa8b3095b7b0 \Windows\System32\en-US\crypt32.dll.mui 216
0xaa8b3095bad0 \Input 216
0xaa8b3095bc60 \Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync
%4Operational.evtx 216
0xaa8b3095bdf0 \Windows\System32\QuietHours.dll 216
0xaa8b3095c110 \Windows\System32\Windows.StateRepositoryClient.dll 216
0xaa8b3095c430 \Windows\System32\Windows.Security.Authentication.Web.Core.dll
216
0xaa8b3095c5c0 \Windows\System32\WindowManagement.dll 216
0xaa8b3095c750 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_SnippingTool_exe 216
0xaa8b3095c8e0 \Dev\Query 216
0xaa8b3095ca70 \Windows\System32\
Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll 216
0xaa8b3095cc00 \Output 216
0xaa8b3095cd90 \Windows\System32\AppContracts.dll 216
0xaa8b3095d0b0 \Windows\System32\ACPBackgroundManagerPolicy.dll 216
0xaa8b3095d240 \Windows\System32\execmodelproxy.dll 216
0xaa8b3095d3d0 \Windows\System32\thumbcache.dll 216
0xaa8b3095d560 \Users\mctf_user\AppData\Local\Microsoft\Windows\Notifications\
wpndatabase.db-wal 216
0xaa8b3095d6f0 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\
WebCacheV01.jfm 216
0xaa8b3095d880 \Windows\System32\Windows.System.Launcher.dll 216
0xaa8b3095da10 \Windows\System32\webplatstorageserver.dll 216
0xaa8b3095dba0 \Windows\System32\winspool.drv 216
0xaa8b3095dd30 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\V01.log
216
0xaa8b3095dec0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Notifications\
wpndatabase.db-shm 216
0xaa8b3095e1e0 \$Directory 216
0xaa8b3095e370 \Windows\System32\MoUsoCoreWorker.exe 216
0xaa8b3095e500 \Windows\Prefetch\MOUSOCOREWORKER.EXE-681A8FEE.pf 216
0xaa8b3095e690 \Users\mctf_user\AppData\Local\Packages\
0xaa8b3095e9b0 \Users\mctf_user\AppData\Local\Microsoft\Windows\WebCache\
WebCacheV01.dat 216
0xaa8b3095eb40 \Windows\System32\en-US\ESENT.dll.mui 216
0xaa8b3095ecd0 \Windows\System32\MTFServer.dll 216
0xaa8b3095ee60 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b3095f180 \Users\mctf_user\AppData\Local\Microsoft\Windows\Notifications\
WPNPRMRY.tmp 216
0xaa8b3095f310 \Windows\System32\usocoreps.dll 216
0xaa8b3095f4a0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Notifications\
wpndatabase.db 216
0xaa8b3095f630 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
TextInput.dll 216
0xaa8b3095f7c0 \Windows\System32\PackageStateChangeHandler.dll 216
0xaa8b3095f950 \Windows\System32\WinMetadata\Windows.System.winmd 216
0xaa8b3095fae0 \Windows\System32\snmpapi.dll 216
0xaa8b3095fc70 \$Directory 216
0xaa8b3095fe00 \Windows\System32\wlidprov.dll 216
0xaa8b30960120 \Windows\System32\en-US\ole32.dll.mui 216
0xaa8b309602b0 \Windows\System32\tcpmon.dll 216
0xaa8b30960440 \Windows\System32\fltLib.dll 216
0xaa8b30960760 \Windows\System32\FXSMON.dll 216
Microsoft_Windows_Computer 216
0xaa8b30960c10 \Windows\System32\spoolss.dll 216
0xaa8b30960da0 \CMApi 216
0xaa8b309610c0 \Windows\System32\twinui.appcore.dll 216
0xaa8b309613e0 \Windows\System32\sfc_os.dll 216
0xaa8b30961700 \Windows\System32\container.dll 216
0xaa8b30961890 \Windows\System32\twinui.pcshell.dll 216
0xaa8b30961d40 \Windows\System32\twinui.dll 216
0xaa8b30961ed0 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_notepad_exe 216
0xaa8b309621f0 \Windows\System32\Windows.Internal.UI.Shell.WindowTabManager.dll
216
0xaa8b30962380 \Windows\System32\tquery.dll 216
0xaa8b309626a0 \Windows\System32\InputLocaleManager.dll 216
Microsoft_Windows_Explorer 216
0xaa8b30962ce0 \Windows\System32\mscoree.dll 216
0xaa8b30962e70 \Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll 216
0xaa8b30963190 \lsass 216
0xaa8b30963320 \Windows\System32\en-US\ApplicationFrame.dll.mui 216
0xaa8b309634b0 \SwDevice 216
0xaa8b30963640 \Windows\System32\win32spl.dll 216
0xaa8b309637d0 \Windows\explorer.exe 216
0xaa8b30963af0 \Users\mctf_user\AppData\Local\Packages\
216
216
0xaa8b30964130 \Windows\System32\pdh.dll 216
0xaa8b309642c0 \Windows\System32\en-US\APMon.dll.mui 216
0xaa8b30964450 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30964900 \Windows\System32\vaultcli.dll 216
http___www_virtualbox_org 216
0xaa8b30964db0 \Windows\System32\capauthz.dll 216
0xaa8b309650d0 \Windows\System32\wsnmp32.dll 216
0xaa8b30965260 \Windows\System32\usbmon.dll 216
0xaa8b309653f0 \Windows\System32\twinapi.dll 216
0xaa8b309658a0 \Windows\System32\aepic.dll 216
0xaa8b30965bc0 \Users\mctf_user\AppData\Local\Packages\
Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F} 216
0xaa8b30965d50 \Windows\System32\en-US\win32spl.dll.mui 216
0xaa8b30965ee0 \Windows\System32\msacm32.dll 216
0xaa8b30966200 \Windows\System32\utcutil.dll 216
0xaa8b30966390 \Windows\System32\msacm32.drv 216
0xaa8b30966520 \Program Files\Common Files\microsoft shared\ink\tiptsf.dll216
0xaa8b309666b0 \Windows\System32\midimap.dll 216
0xaa8b30966840 \Windows\CSC 216
0xaa8b309669d0 \Windows\CSC\v2.0.6 216
0xaa8b30966cf0 \$Directory 216
0xaa8b30966e80 \Windows\System32\drprov.dll 216
0xaa8b309671a0 \Windows\System32\en-US\wdmaud.drv.mui 216
0xaa8b30967330 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
LayoutData.dll 216
0xaa8b30967650 \Users\mctf_user\AppData\Local\Microsoft\Windows\Caches\
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db 216
0xaa8b309677e0 \Windows\System32\cdpsvc.dll 216
0xaa8b30967b00 \Windows\System32\en-US\mpr.dll.mui 216
0xaa8b30967e20 \Dev\Query 216
0xaa8b30968140 \Windows\System32\smartscreenps.dll 216
0xaa8b309682d0 \Windows\System32\VBoxMRXNP.dll 216
0xaa8b30968460 \Windows\CSC\v2.0.6\temp 216
Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5} 216
0xaa8b30968910 \Windows\CSC\v2.0.6\pq 216
0xaa8b30968aa0 \Windows\System32\ntlanman.dll 216
0xaa8b30968c30 \Windows\System32\en-US\MMDevAPI.dll.mui 216
0xaa8b30968dc0 \Users\mctf_user\AppData\Local\Packages\
Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8} 216
0xaa8b30969590 \CMApi 216
0xaa8b30969720 \Windows\System32\ExplorerFrame.dll 216
0xaa8b30969a40 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30969d60 \Windows\System32\cldapi.dll 216
0xaa8b30969ef0 \Windows\System32\en-US\shell32.dll.mui 216
216
0xaa8b3096a3a0 \Windows\CSC\v2.0.6\namespace 216
0xaa8b3096a530 \Windows\System32\oleaccrc.dll 216
0xaa8b3096a6c0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
iconcache_idx.db 216
0xaa8b3096a850 \Windows\System32\en-US\oleaccrc.dll.mui 216
0xaa8b3096a9e0 \Windows\System32\NotificationControllerPS.dll 216
0xaa8b3096ab70 \Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll 216
0xaa8b3096ae90 ꯚ# 216
0xaa8b3096b1b0 \Users\mctf_user\AppData\Local\Packages\
Microsoft_Windows_RemoteDesktop 216
0xaa8b3096b340 \Windows\System32\oleacc.dll 216
0xaa8b3096b660 \Windows\System32\ucrtbase_clr0400.dll 216
0xaa8b3096b980 \SwDevice 216
0xaa8b3096bb10 \Users\mctf_user\AppData\Local\Packages\
0xaa8b3096bca0 \Windows\System32\VirtualMonitorManager.dll 216
0xaa8b3096be30 \Users\mctf_user\AppData\Local\Packages\
216
0xaa8b3096c150 \Windows\System32\Windows.Shell.BlueLightReduction.dll 216
0xaa8b3096c2e0 \$Directory 216
http___www_virtualbox_org 216
4E5D-B744-2EB1AE5198B7}_cmd_exe 216
0xaa8b3096c790 \Windows\System32\en-US\windows.storage.dll.mui 216
0xaa8b3096d410 \Windows\System32\cscui.dll 216
0xaa8b3096e090 \Windows\Fonts\verdanab.ttf 216
0xaa8b3096e540 \Windows\System32\AboveLockAppHost.dll 216
0xaa8b3096e6d0 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b3096e9f0 \Users\mctf_user\AppData\Local\Packages\
216
0xaa8b3096eb80 \Windows\assembly\NativeImages_v4.0.30319_64\System.Security\
cdcff8b87350b01fe89ea3419fabccbd\System.Security.ni.dll.aux216
0xaa8b3096ed10 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
0xaa8b3096f1c0 \Windows\System32\EhStorShell.dll 216
0xaa8b3096f350 \Windows\System32\Windows.UI.Core.TextInput.dll 216
0xaa8b3096fcb0 \Dev\Query 216
0xaa8b3096fe40 \Windows\System32\PCShellCommonProxyStub.dll 216
0xaa8b309702f0 \Windows\System32\DictationManager.dll 216
0xaa8b30970480 \Windows\System32\cflapi.dll 216
0xaa8b30970ac0 \Windows\System32\windowsudk.shellcommon.dll 216
0xaa8b30970de0 \$Directory 216
0xaa8b309723c0 \Windows\SystemResources\ShellComponents\ShellComponents.pri
216
0xaa8b30972870 \ProgramData\Microsoft\Windows\AppRepository\Packages\
Microsoft.Windows.StartMenuExperienceHost_10.0.19041.1023_neutral_neutral_cw5n1h2tx
yewy\ActivationStore.dat 216
0xaa8b30972eb0 \Windows\System32\LicenseManagerApi.dll 216
0xaa8b30cd5150 \Windows\SystemApps\
Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy 216
0xaa8b30cd5470 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b30cd5600 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Start Menu\
Programs 216
0xaa8b30cd5790 \Windows\System32\usp10.dll 216
0xaa8b30cd5ab0 \ProgramData\Microsoft\Windows\AppRepository\Packages\
yewy\ActivationStore.dat.LOG1 216
0xaa8b30cd5c40 \Windows\System32\dcntel.dll 216
0xaa8b30cd5dd0 \Windows\System32\energy.dll 216
0xaa8b30cd60f0 \ProgramData\Microsoft\Windows\AppRepository\Packages\
yewy\ActivationStore.dat 216
0xaa8b30cd6280 \Windows\System32\en-US\ShutdownUX.dll.mui 216
0xaa8b30cd6410 \Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\
Schedule Scan 216
0xaa8b30cd65a0 \$Directory 216
0xaa8b30cd6730 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30cd6a50 \$Directory 216
0xaa8b30cd6be0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Libraries
216
0xaa8b30cd6d70 \ProgramData\Microsoft\Windows\Start Menu\Programs 216
0xaa8b30cd7090 \ProgramData\Microsoft\Windows\Start Menu 216
0xaa8b30cd7220 \Windows\System32\wosc.dll 216
0xaa8b30cd73b0 \Windows\System32\msls31.dll 216
0xaa8b30cd7540 \ProgramData\Microsoft\Windows\Start Menu\Programs 216
0xaa8b30cd76d0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Libraries
216
0xaa8b30cd7860 \Windows\System32\utcutil.dll 216
0xaa8b30cd79f0 \ProgramData\Microsoft\Windows\AppRepository\Packages\
yewy\ActivationStore.dat.LOG2 216
0xaa8b30cd7b80 \Users\mctf_user\AppData\Roaming\Microsoft\Internet Explorer\
Quick Launch\User Pinned 216
0xaa8b30cd7d10 \Windows\System32\usoapi.dll 216
0xaa8b30cd7ea0 \ProgramData\Microsoft\Windows\Start Menu 216
0xaa8b30cd81c0 \Users\mctf_user\AppData\Roaming\Microsoft\Internet Explorer\
Quick Launch\User Pinned 216
0xaa8b30cd8350 \Windows\System32\RuntimeBroker.exe 216
0xaa8b30cd84e0 \Windows\System32\en-US\windows.ui.xaml.dll.mui 216
0xaa8b30cd8670 \Windows\System32\Windows.Internal.PredictionUnit.dll 216
0xaa8b30cd8800 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Start Menu\
Programs 216
0xaa8b30cd8990 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Start Menu
216
0xaa8b30cd8b20 \$Directory 216
0xaa8b30cd8cb0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Start Menu
216
0xaa8b30cd9160 \Dev\Query 216
0xaa8b30cd92f0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Burn 216
0xaa8b30cd9480 \Windows\System32\Windows.Storage.Compression.dll 216
0xaa8b30cd9610 \Windows\Fonts\segmdl2.ttf 216
0xaa8b30cd97a0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Burn 216
0xaa8b30cd9930 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Printer
Shortcuts 216
0xaa8b30cd9ac0 \Windows\Fonts\segoeuib.ttf 216
0xaa8b30cd9c50 \Windows\Fonts\segoeuib.ttf 216
0xaa8b30cd9de0 \$Directory 216
0xaa8b30cda290 \$Directory 216
0xaa8b30cda420 \$Directory 216
0xaa8b30cda8d0 \Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\pris\
resources.en-US.pri 216
0xaa8b30cdaa60 \ProgramData\Microsoft\Windows\Models\SBCModel.json 216
0xaa8b30cdad80 \Windows\System32\UIAutomationCore.dll 216
0xaa8b30cdb0a0 \ProgramData\Microsoft\Windows\Models\SBCModel.txt 216
0xaa8b30cdb550 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30cdb6e0 \Windows\apppatch\sysmain.sdb 216
0xaa8b30cdba00 \$Directory 216
0xaa8b30cdbb90 \Users\mctf_user\Desktop 216
0xaa8b30cdbd20 \Program Files\Common Files\microsoft shared\ink\tiptsf.dll216
0xaa8b30cdc1d0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Printer
Shortcuts 216
0xaa8b30cdc360 \$Directory 216
0xaa8b30cdc4f0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Network
Shortcuts 216
0xaa8b30cdc810 \Users\mctf_user\AppData\Roaming\KeePass\KeePass.config.xml216
0xaa8b30cdc9a0 \Windows\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll
216
0xaa8b30cdcb30 \Program Files (x86)\KeePass Password Safe 2\unins000.exe 216
0xaa8b30cdccc0 \Windows\assembly\NativeImages_v4.0.30319_64\System.Security\
cdcff8b87350b01fe89ea3419fabccbd\System.Security.ni.dll 216
0xaa8b30cdce50 \Windows\System32\ktmw32.dll 216
0xaa8b30cdd170 \Users\mctf_user\Desktop 216
0xaa8b30cdd620 \Windows\System32\pcaevts.dll 216
0xaa8b30cdd7b0 \Users\mctf_user\Documents\Database.kdbx 216
0xaa8b30cdd940 \Windows\WinSxS\
amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2130_none_91a21aa0cc89fa
21 216
0xaa8b30cddad0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
iconcache_16.db 216
0xaa8b30cddc60 \$Directory 216
0xaa8b30cde110 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30cde2a0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Network
Shortcuts 216
0xaa8b30cde430 \Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll 216
0xaa8b30cde5c0 \Program Files (x86)\KeePass Password Safe 2\
KeePass.XmlSerializers.dll 216
0xaa8b30cde750 \Windows\System32\Chakra.dll 216
0xaa8b30cdfa10 \Users\Public\Desktop 216
0xaa8b30cdfd30 \Users\Public\Desktop 216
0xaa8b30cdfec0 \$Directory 216
0xaa8b30ce0370 \Windows\System32\SleepStudy\ScreenOn\
ScreenOnPowerStudyTraceSession-2024-11-08-12-51-43.etl 216
0xaa8b30ce0b40 \Windows\System32\en-US\winnlsres.dll.mui 216
0xaa8b30ce17c0 \Windows\Fonts\StaticCache.dat 216
0xaa8b30ce1ae0 \CMNotify 216
0xaa8b30ce1c70 \$Directory 216
0xaa8b30ce1e00 \CMNotify 216
0xaa8b30ce2120 \Windows\Prefetch\PfPre_3dfdd6ab.mkd 216
0xaa8b30ce3570 \CMNotify 216
0xaa8b30ce4b50 \$Directory 216
0xaa8b30ce4e70 \$Directory 216
0xaa8b30ce5af0 \$Directory 216
0xaa8b30ce6130 \Windows\System32\WindowsCodecsRaw.dll 216
0xaa8b30dcd150 \Windows\System32\dmiso8601utils.dll 216
0xaa8b30dcd2e0 \Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-
00C04FC295EE}\catdb.jfm 216
0xaa8b30dcd470 \ProgramData\Microsoft\Windows\OneSettings\config.json 216
0xaa8b30dcd600 \Windows\System32\svchost.exe 216
0xaa8b30dcd790 \Windows\System32\en-US\ESENT.dll.mui 216
0xaa8b30dcd920 \Windows\System32\vbsapi.dll 216
0xaa8b30dcdab0 \$Directory 216
0xaa8b30dcdc40 \Sessions\1\AppContainerNamedObjects\S-1-15-2-283421221-
3183566570-1718213290-751554359-3541592344-2312209569-3374928651 216
0xaa8b30dcddd0 \Windows\System32\en-US\ESENT.dll.mui 216
0xaa8b30dce0f0 \Windows\System32 216
0xaa8b30dce280 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b30dce410 \Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-
0xaa8b30dce8c0 \Windows\System32\en-US\windows.storage.dll.mui 216
0xaa8b30dcebe0 \Windows\System32\VBoxHook.dll 216
0xaa8b30dcf090 \Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-
00C04FC295EE}\catdb.jfm 216
0xaa8b30dcf220 \Program Files (x86)\KeePass Password Safe 2\KeePass.exe 216
0xaa8b30dcf540 \Windows\System32 216
0xaa8b30dcf6d0 \Windows\System32\ole32.dll 216
0xaa8b30dcf860 \Windows\System32\SettingSyncCore.dll 216
0xaa8b30dcf9f0 \Users\mctf_user\AppData\Local\Microsoft\Internet Explorer\
0xaa8b30dcfb80 \Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-
0xaa8b30dcfea0 \Windows\Fonts\seguisb.ttf 216
0xaa8b30dd01c0 \Windows\System32\en-US\shell32.dll.mui 216
0xaa8b30dd04e0 \$Directory 216
0xaa8b30dd0670 \Users\mctf_user\AppData\Local\Packages\
Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT 216
0xaa8b30dd0800 \Windows\System32\wscapi.dll 216
0xaa8b30dd0990 \$Directory 216
0xaa8b30dd0b20 \Windows\Microsoft.NET\assembly\GAC_MSIL\
System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\
System.Runtime.InteropServices.WindowsRuntime.dll 216
0xaa8b30dd0cb0 \Windows\System32\en-US\wscui.cpl.mui 216
0xaa8b30dd0e40 \Windows\System32\sfc.dll 216
0xaa8b30dd1160 \Windows\System32\SecurityCenterBroker.dll 216
0xaa8b30dd12f0 \$Directory 216
0xaa8b30dd1480 \Windows\System32\wscinterop.dll 216
0xaa8b30dd1610 \Windows\WinSxS\
21 216
0xaa8b30dd17a0 \Program Files (x86)\KeePass Password Safe 2 216
0xaa8b30dd1ac0 \Windows\System32\en-US\datamap.0409.dat 216
0xaa8b30dd1c50 \Windows\System32\rpcss.dll 216
0xaa8b30dd1de0 \$Directory 216
0xaa8b30dd2290 \Windows\System32 216
0xaa8b30dd25b0 \Windows\System32\en-US\datamap.0409.dat 216
0xaa8b30dd28d0 \$Directory 216
0xaa8b30dd2a60 \Windows\System32\WordBreakers.dll 216
0xaa8b30dd2bf0 \Windows\System32\wbem\wbemprox.dll 216
0xaa8b30dd2d80 \Windows\System32\wscui.cpl 216
0xaa8b30dd30a0 \Windows\System32\wscui.cpl 216
0xaa8b30dd3230 \Windows\System32\davclnt.dll 216
0xaa8b30dd33c0 \Windows\WinSxS\
21\GdiPlus.dll 216
0xaa8b30dd3550 \Windows\System32\hcproviders.dll 216
0xaa8b30dd36e0 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
0xaa8b30dd3870 \Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\
v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll 216
0xaa8b30dd3a00 \$Directory 216
0xaa8b30dd3b90 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
0xaa8b30dd3d20 \Users\mctf_user\AppData\Local\Packages\
0xaa8b30dd41d0 \Windows\System32\framedynos.dll 216
0xaa8b30dd44f0 \Windows\Fonts\simsun.ttc 216
0xaa8b30dd4680 \ProgramData\Microsoft\Windows\AppRepository\StateRepository-
Machine.srd-shm 216
0xaa8b30dd4810 \Windows\System32\en-US\StartTileData.dll.mui 216
0xaa8b30dd49a0 \Windows\System32\davhlpr.dll 216
0xaa8b30dd4b30 \Windows\System32\dllhost.exe 216
0xaa8b30dd4cc0 \Users\mctf_user\AppData\Local\Microsoft\Internet Explorer\
0xaa8b30dd5170 \Windows\Fonts\seguiemj.ttf 216
0xaa8b30dd5300 \Windows\System32\werconcpl.dll 216
0xaa8b30dd5490 \Windows\Fonts\symbol.ttf 216
0xaa8b30dd57b0 \Users\mctf_user\Desktop\KeePass 2.lnk 216
0xaa8b30dd5ad0 \Users\mctf_user\Desktop\DumpIt.exe 216
0xaa8b30dd5c60 \Users\mctf_user\AppData\Local\Packages\
0xaa8b30dd5df0 \ProgramData\Microsoft\Windows\AppRepository\StateRepository-
Machine.srd 216
0xaa8b30dd6110 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Themes\
CachedFiles\CachedImage_1024_768_POS4.jpg 216
0xaa8b30dd62a0 \Windows\System32\usocoreps.dll 216
0xaa8b30dd6430 \ProgramData\Microsoft\Windows\AppRepository\StateRepository-
Machine.srd-wal 216
0xaa8b30dd65c0 \Program Files (x86)\desktop.ini 216
0xaa8b30dd68e0 \Windows\System32\dlnashext.dll 216
0xaa8b30dd6a70 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
TextInputHost.exe 216
0xaa8b30dd6c00 \Windows\System32\EhStorAPI.dll 216
0xaa8b30dd6d90 \Windows\assembly\NativeImages_v4.0.30319_64\System\
808887ebadf1a37835b907c866cede3c\System.ni.dll 216
0xaa8b30dd70b0 \$Directory 216
0xaa8b30dd7240 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30dd73d0 \$Directory 216
0xaa8b30dd76f0 \Windows\System32\wpdshext.dll 216
0xaa8b30dd7ba0 \Windows\System32\PlayToDevice.dll 216
0xaa8b30dd7d30 \Windows\assembly\NativeImages_v4.0.30319_64\KeePass\
04393833df653751a2a5d14820edf4bc\KeePass.ni.exe 216
0xaa8b30dd7ec0 \Program Files (x86)\KeePass Password Safe 2\KeePass.exe 216
0xaa8b30dd81e0 \$Directory 216
0xaa8b30dd8370 \Windows\assembly\NativeImages_v4.0.30319_64\
System.Windows.Forms\ad4e1b74ffb168b93b882f4f96a3acc4\System.Windows.Forms.ni.dll
216
Microsoft_Windows_AdministrativeTools 216
0xaa8b30dd8820 \Windows\System32 216
0xaa8b30dd89b0 \Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\
daba68776a7c26bc8eee56f012716bce\System.Drawing.ni.dll 216
0xaa8b30dd8cd0 \Windows\System32\en-US\shell32.dll.mui 216
0xaa8b30dd94a0 \$Directory 216
0xaa8b30dd9950 \Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\
238862161c05eb67325815002be6719c\System.Xml.ni.dll 216
0xaa8b30dd9ae0 \Windows\WinSxS\amd64_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll 216
0xaa8b30dd9c70 \Windows\Fonts\segoeui.ttf 216
0xaa8b30dd9e00 \Windows\System32\pcacli.dll 216
0xaa8b30dda2b0 \Windows\Fonts\tahoma.ttf 216
0xaa8b30dda5d0 \Windows\ShellComponents\
WindowsInternal.ComposableShell.Experiences.Switcher.dll 216
0xaa8b30dda760 \Windows\ShellExperiences\TileControl.dll 216
0xaa8b30ddaa80 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b30ddac10 \Windows\WindowsShell.Manifest 216
0xaa8b30ddada0 \Windows\SystemResources\imageres.dll.mun 216
0xaa8b30ddb0c0 \Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll 216
0xaa8b30ddb570 \$Directory 216
0xaa8b30ddb700 \Windows\System32\en-US\AppResolver.dll.mui 216
0xaa8b30ddbbb0 \Windows\System32\riched20.dll 216
0xaa8b30ddbd40 \Windows\assembly\NativeImages_v4.0.30319_64\
System.Configuration\05fe5db1ffb6ae997c427dbd45c1dd98\System.Configuration.ni.dll
216
0xaa8b30ddbed0 \Windows\ShellComponents\TaskFlowUI.dll 216
0xaa8b30ddc380 \Windows\System32\en-US\explorerframe.dll.mui 216
0xaa8b30ddc510 \Windows\System32\en-US\StartTileData.dll.mui 216
0xaa8b30ddc830 \Windows\assembly\NativeImages_v4.0.30319_64\System.Core\
11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll 216
0xaa8b30ddc9c0 \Windows\Fonts\StaticCache.dat 216
0xaa8b30ddcb50 \Windows\System32\en-US\dui70.dll.mui 216
0xaa8b30ddcce0 \Windows\System32\en-US\ntshrui.dll.mui 216
0xaa8b30ddd320 \Windows\SystemResources\ExplorerFrame.dll.mun 216
0xaa8b30ddd4b0 \Windows\Fonts\msgothic.ttc 216
0xaa8b30ddd640 \Windows\System32\Windows.Perception.Stub.dll 216
0xaa8b30ddd7d0 \CMNotify 216
0xaa8b30dddaf0 \$Directory 216
0xaa8b30dde5e0 \$Directory 216
0xaa8b30ddea90 \Windows\Fonts\YuGothM.ttc 216
0xaa8b30ddec20 \Windows\Fonts\msyh.ttc 216
0xaa8b30ddedb0 \ProgramData\Microsoft\Windows\AppRepository\Packages\
MicrosoftWindows.Client.CBS_120.2212.4180.0_x64__cw5n1h2txyewy\ActivationStore.dat
216
0xaa8b30ddf260 \Windows\Fonts\msjh.ttc 216
0xaa8b30ddf8a0 \$Directory 216
0xaa8b30ddfd50 \Windows\Fonts\seguisym.ttf 216
0xaa8b30ddfee0 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
vcruntime140_app.dll 216
0xaa8b30de0390 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
vccorlib140_app.dll 216
0xaa8b30de06b0 \Windows\SystemResources\ExplorerFrame.dll.mun 216
0xaa8b30de09d0 \Windows\System32\C_1255.NLS 216
0xaa8b30de0e80 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
216
0xaa8b30de11a0 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
vcruntime140_1_app.dll 216
0xaa8b30de1970 \Windows\Fonts\sserife.fon 216
0xaa8b30de1c90 \CMApi 216
0xaa8b30de1e20 \ProgramData\Microsoft\Windows\AppRepository\Packages\
MicrosoftWindows.Client.CBS_120.2212.4180.0_x64__cw5n1h2txyewy\ActivationStore.dat
216
0xaa8b30de2140 \Windows\Fonts\malgun.ttf 216
0xaa8b30de2aa0 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
InputApp.dll 216
0xaa8b30de2c30 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
msvcp140_app.dll 216
0xaa8b30de3400 \Windows\Fonts\segoeui.ttf 216
0xaa8b30de3590 \Windows\Fonts\tahomabd.ttf 216
0xaa8b30de3d60 \ProgramData\Microsoft\Windows\AppRepository\Packages\
MicrosoftWindows.Client.CBS_120.2212.4180.0_x64__cw5n1h2txyewy\
0xaa8b30de4210 \Users\mctf_user\AppData\Local\Packages\
4E5D-B744-2EB1AE5198B7}_comexp_msc 216
0xaa8b30de43a0 \ProgramData\Microsoft\Windows\AppRepository\Packages\
MicrosoftWindows.Client.CBS_120.2212.4180.0_x64__cw5n1h2txyewy\
0xaa8b30de5340 \Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
resources.pri 216
MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG1 216
0xaa8b30de6600 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
iconcache_256.db 216
0xaa8b30de6790 \Windows\System32\en-US\KernelBase.dll.mui 216
0xaa8b30de7280 \$Directory 216
MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2 216
0xaa8b30de78c0 \Windows\System32\WinMetadata\Windows.UI.winmd 216
0xaa8b30de7a50 \$Directory 216
0xaa8b30de8ea0 \Users\mctf_user\AppData\Local\Packages\
MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat 216
0xaa8b31402150 \Windows\System32\sru\SRU0001C.l 216
0xaa8b314022e0 \Windows\System32\riched20.dll 216
0xaa8b31402470 \Program Files\Internet Explorer\iexplore.exe 216
0xaa8b31402600 \Users\mctf_user\Documents\Database.kdbx 216
0xaa8b31402920 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Recent\
AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 216
0xaa8b31402ab0 \Windows\System32\tzres.dll 216
0xaa8b31402c40 \Windows\System32\rundll32.exe 216
0xaa8b31402dd0 \Program Files\Internet Explorer\en-US\iexplore.exe.mui 216
0xaa8b314030f0 \Windows\System32\C_932.NLS 216
0xaa8b314035a0 \Windows\Prefetch\KEEPASS.EXE-1D4B5135.pf 216
0xaa8b31403730 \Windows\System32\
Windows.Internal.Graphics.Display.DisplayColorManagement.dll 216
0xaa8b314038c0 \Windows\System32\en-US\tzres.dll.mui 216
0xaa8b31403a50 \Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\
Schedule Maintenance Work 216
0xaa8b31403be0 \Users\mctf_user\Desktop\desktop.ini 216
0xaa8b31403d70 \Windows\System32\en-US\microsoft-windows-kernel-power-
events.dll.mui 216
0xaa8b31404090 \Users\mctf_user\AppData\Local\Microsoft\Windows\Caches\
{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000017.db 216
0xaa8b31404220 \Windows\System32\tzres.dll 216
0xaa8b314043b0 \Windows\System32\sru\SRU0001D.l 216
0xaa8b31404540 \Windows\System32\microsoft-windows-kernel-power-events.dll216
0xaa8b314046d0 \Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\
Schedule Work 216
0xaa8b31404860 \Windows\System32\imageres.dll 216
0xaa8b314049f0 \Windows\System32\en-US\imageres.dll.mui 216
0xaa8b31404b80 \Users\desktop.ini 216
0xaa8b31404d10 \$RECYCLE.BIN\S-1-5-21-1732203096-1246889736-2804438105-1002\
desktop.ini 216
0xaa8b31404ea0 \Program Files (x86)\KeePass Password Safe 2\KeePass.exe 216
0xaa8b314051c0 \Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\
Schedule Wake To Work 216
0xaa8b31405350 \Program Files (x86)\KeePass Password Safe 2\
0xaa8b314054e0 \Windows\System32\sru\SRU0001E.l 216
0xaa8b31405670 \Reference 216
0xaa8b31405800 \Windows\Fonts\segoeuii.ttf 216
0xaa8b31405990 \Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll 216
0xaa8b31405b20 \Users\Public\desktop.ini 216
0xaa8b31405cb0 \Windows 216
0xaa8b31405e40 \Windows\System32\conhost.exe 216
0xaa8b31406160 \Users\mctf_user\Desktop\DumpIt.exe 216
0xaa8b314062f0 \Connect 216
0xaa8b31406480 \Windows\System32\en-US\duser.dll.mui 216
0xaa8b31406610 \Users\mctf_user\AppData\Local\Microsoft\Windows\Explorer\
iconcache_48.db 216
0xaa8b314067a0 \Program Files (x86)\KeePass Password Safe 2\KeePassLibC64.dll
216
0xaa8b31406930 \Windows\System32\mscoree.dll 216
0xaa8b31406ac0 \Users\mctf_user\Desktop 216
0xaa8b31406c50 \Windows\System32\microsoft-windows-kernel-power-events.dll216
0xaa8b31406de0 \Windows\Microsoft.NET\Framework64\v4.0.30319\XPThemes.manifest
216
0xaa8b31407100 \Server 216
0xaa8b31407290 \Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf 216
0xaa8b31407420 \Users\Public\Desktop\desktop.ini 216
0xaa8b31407740 \Windows\System32\usp10.dll 216
0xaa8b314078d0 \Users\mctf_user\AppData\Roaming\Microsoft\Windows\Recent\
AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 216
0xaa8b31407a60 \Users\mctf_user\AppData\Roaming\Microsoft\Internet Explorer\
Quick Launch\desktop.ini 216
0xaa8b31407bf0 \Program Files (x86)\KeePass Password Safe 2\
0xaa8b31407d80 \Windows\System32\msls31.dll 216
0xaa8b314080a0 \Windows\Prefetch\DUMPIT.EXE-23F3EB1E.pf 216
0xaa8b314083c0 \Windows\WinSxS\amd64_microsoft.windows.c..-
controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9\
comctl32.dll.mui 216
0xaa8b31408550 \Windows\Fonts\StaticCache.dat 216
0xaa8b31408870 \Windows\assembly\NativeImages_v4.0.30319_64\KeePass\
04393833df653751a2a5d14820edf4bc\KeePass.ni.exe 216
0xaa8b31408a00 \Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\
daba68776a7c26bc8eee56f012716bce\System.Drawing.ni.dll.aux 216
0xaa8b31408b90 \Windows\assembly\NativeImages_v4.0.30319_64\
System.Windows.Forms\ad4e1b74ffb168b93b882f4f96a3acc4\System.Windows.Forms.ni.dll
216
0xaa8b31408eb0 \Users\mctf_user\Desktop\KeePass 2.lnk 216
0xaa8b314091d0 \Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf 216
0xaa8b31409360 \Windows\System32\en-US\user32.dll.mui 216
0xaa8b314094f0 \Windows\assembly\NativeImages_v4.0.30319_64\System\
808887ebadf1a37835b907c866cede3c\System.ni.dll 216
0xaa8b31409b30 \Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\
v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll 216
0xaa8b31409cc0 \Windows\WinSxS\amd64_microsoft.windows.common-
0xaa8b3140a170 \Windows\System32\en-US\Conhost.exe.mui 216
0xaa8b3140a300 \Windows\Microsoft.NET\Framework64\v4.0.30319\Config\
machine.config 216
0xaa8b3140a490 \Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\
de013c985ad100d05dc94ec118f77b92\mscorlib.ni.dll 216
0xaa8b3140a620 \Windows 216
0xaa8b3140a7b0 \Windows\System32\ucrtbase_clr0400.dll 216
0xaa8b3140a940 \Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll 216
0xaa8b3140aad0 \Windows\System32\vcruntime140_clr0400.dll 216
0xaa8b3140ac60 \Windows\SysWOW64\apphelp.dll 216
0xaa8b3140b110 \Windows\assembly\NativeImages_v4.0.30319_64\KeePass\
04393833df653751a2a5d14820edf4bc\KeePass.ni.exe.aux 216
0xaa8b3140b430 \Windows\Fonts\micross.ttf 216
0xaa8b3140c560 \Program Files\Oracle\VirtualBox Guest Additions\VBoxDrvInst.exe
216
0xaa8b3140c6f0 \Windows\assembly\NativeImages_v4.0.30319_64\System.Core\
11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll 216
0xaa8b3140c880 \Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\
238862161c05eb67325815002be6719c\System.Xml.ni.dll.aux 216
0xaa8b3140cd30 \Windows\assembly\NativeImages_v4.0.30319_64\
System.Configuration\05fe5db1ffb6ae997c427dbd45c1dd98\
System.Configuration.ni.dll.aux 216
0xaa8b3140d690 \Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\
238862161c05eb67325815002be6719c\System.Xml.ni.dll 216

File

Uploaded by

Copyright:

Available Formats

File

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

File

Uploaded by

Copyright:

Available Formats

Volatility 3 Framework 2.7.

Offset Name Size

0xaa8b2a8a8ed0 \Windows\System32\wlanapi.dll 216

You might also like