Windows 디렉토리/파일 검색

Windows 아티팩트 검색

MD5SHA1경로(파일명)
4812bef0de880baccccd75900d4c0f2f 93bf543ce9bb6512f89c294f49a4ee03a71aacbf [NTFS]\[root]\Users\defaultuser0\AppData\Local\IconCache.db
f69adbd9432ccd42f3633dd876f5c398 d23ce86c0217f3bf74c1b5e0f540def33d2cb89d [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\$I30
9c13b9133b058a4e74cff6848dcfe8c1 f47cb021362324f0dca1119ac86ee72dbfab497b [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_ED24A87624B24E59B4360DC4810C2649.dat
d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead
d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk
2a4085c34427462f9b963a78ac04b83b f8c28245659c41334596089bdb6b7e7fe66300f5 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_c0849ae1-3e4e-4e45-b764-eea6b231d369
13d73daf0c5b01493ce5129ce3b4412c cfda78768d91e875c3788bf152b43d5ceb83ad4f [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Protect\CREDHIST
f85b3538b9dd1ad95a5081f9f7598eff e14191478c972d3f73a110c56fc10fe90fac2b66 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Protect\S-1-5-21-3200443915-452840459-1364588682-1000\Preferred
efa9aad1df559476dfef00681c35fa1e 7a478e0f6b2554fafcd2d5a48be68e2495a870ff [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Protect\S-1-5-21-3200443915-452840459-1364588682-1000\15478b72-1fae-4e1a-b7db-8a9c6f3d4c73
8ebfb1f46283ef0fdf2c58ffe62e6159 29d77f335c473e0e2fc745b73d9ace0e8132ac35 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\$I30
623a388da0f5a5c9892d3eabf1bbd52a 1e2f6397843c518728affeb462127d70eab34e91 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
325b790bc93ad8d27655c44365b485c0 50b633a4ca28210ca882467cbc0d717d3283ac75 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
dd26c664f5264c672b6c4c260ed79c73 b118670620d7214224c7ed2dc14ee67d7a49c044 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
0d22b6034a59ef76442a49a51d27c9cf 9027525e75d4df05cc54ffdbfd64beee9c42088b [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\$I30
e06a1b49224f7a342f25f38ee89f9a8d 2f1523c747773b5ab97c91ba5ea48173b7627609 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg
9e5b04766a4fcdff205bef06feefd574 9cac0bc98a4608524f7d8a328009594f03ec1a56 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
d6c1e4ebb71dd2e16d2ab1d4add02114 de36435bf1258753db34024fc2bcc8a07e893268 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\$I30
72f5c05b7ea8dd6059bf59f50b22df33 d5af52e129e15e3a34772806f6c5fbf132e7408e [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
ed39a498f52d45a942c3c7f2167fe0ce 10bcc3b4bb67385c941b27c8558496db058dec3e [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
a9dd5d8e35dfd25d0cf408f3cff327a9 907e473a20e40310eadecd29d0c7a4cee34bb388 [NTFS]\[root]\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\SendTo\$I30