Evidence hash manifest
Case: RH-2026-7430-001
Generated by Red Herrings
Files: 19
========================================================================

C/$MFT_timeline.csv
    size   : 39653 (38.7 KB)
    MD5    : 7e5e66d121191a33e6a5e7e94fc01080
    SHA-256: cb8d61d45866fab5d93b4900ddd25d2ab3a5b36ae75428535fd87000cbeb4da6

C/Users/caguilar/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/f01b4d95cf55d32a.automaticDestinations-ms
    size   : 3072 (3.0 KB)
    MD5    : 0168fadafb299f7b2ee72b2a28c01c9c
    SHA-256: 8850ac69757c48a44185a276e1a0a227772bd2a2883fe66789bc5762db4402b1

C/Users/caguilar/AppData/Roaming/Microsoft/Windows/Recent/Rotor Assembly Spec.docx.lnk
    size   : 770 (770 B)
    MD5    : e4c2781e7c941fcac2be46970204fe93
    SHA-256: 0d8873e14977356503a41048feff902c539163d721bb700578e1c371f789f74b

C/Users/caguilar/AppData/Roaming/Microsoft/Windows/Recent/project_files.7z.lnk
    size   : 415 (415 B)
    MD5    : 62558c571ecc35d869d380b59979b300
    SHA-256: 1decdba9ecef46bf9045ccf8a969b73a201a6d3bdc2a976b5f23f494a9867bd0

C/Users/caguilar/NTUSER.DAT
    size   : 24576 (24.0 KB)
    MD5    : 8fa65ac35311c33ff5520ce89c396aee
    SHA-256: ab342fbb4b1cbdc7a6eb361356e97cbc3aef2f331107c10efd3398c83dd09dfe

C/Windows/Prefetch/7ZFM.EXE-56DE4F9A.pf
    size   : 4396 (4.3 KB)
    MD5    : d7e819935e8e756c48035557d201232f
    SHA-256: c06105aed93d1bae1447d8b9520de0e72a78f0cd2a2af17f7f293ee9016099d1

C/Windows/Prefetch/CHROME.EXE-AED7BA3C.pf
    size   : 4766 (4.7 KB)
    MD5    : 8b1648f188eef0d59f3f12b936fcfa50
    SHA-256: 123a071871286e13b6bdb578b92fda2d1643114970a9cec967a089e8fc3007cc

C/Windows/Prefetch/CONHOST.EXE-0C6456FB.pf
    size   : 4660 (4.6 KB)
    MD5    : 131d5e9cc98ec545e4b8d58f61448801
    SHA-256: f24a2f838f1eb75dc0e9b7362365d7624f4a3d4f812c299c866d402b850d726d

C/Windows/Prefetch/EXPLORER.EXE-D5E97654.pf
    size   : 4152 (4.1 KB)
    MD5    : 7e063e3a5ae311479b37e69f3f1215c6
    SHA-256: 76e750c8b2538eb3ac9d390f5703f7af3fa70e98576b2080fe039a28f38d3ab8

C/Windows/Prefetch/NOTEPAD.EXE-C5670914.pf
    size   : 4664 (4.6 KB)
    MD5    : 563568a04c220594a23120ac408706e7
    SHA-256: b5a69bfab9860bd3bf157898eb1793b9ef09ee9ce9c97e97067db46728522562

C/Windows/Prefetch/RUNDLL32.EXE-B0CF1E13.pf
    size   : 4186 (4.1 KB)
    MD5    : 80a74486176e9b5c3a963eead4f08a12
    SHA-256: 655ab5dcf5cf723777a509dbff044fa79fbb48fe917ca5f2229371fb0a17bbaa

C/Windows/Prefetch/SEARCHPROTOCOLHOST.EXE-69C456C3.pf
    size   : 4854 (4.7 KB)
    MD5    : 6efd5cae63e4957cdb8382c2c8747713
    SHA-256: bccc69edd414f96169e9501436632e07c7f166c255ae90089de069f3b2b0fe9f

C/Windows/Prefetch/SVCHOST.EXE-D02762BF.pf
    size   : 4494 (4.4 KB)
    MD5    : 5238ba737e2237ccc58f90000f425e07
    SHA-256: 21e02c0f49282afa63e9cda15e558b898119a9b45ab62e3884d19c79badf51e0

C/Windows/Prefetch/TASKHOSTW.EXE-2E5D4B75.pf
    size   : 4354 (4.3 KB)
    MD5    : 200dc71b19cf70b140d14a14b4774bcd
    SHA-256: e29ef13c7268481d807e336ec5c45084df2d2f77c5e9e06e65dccbd120c71f33

C/Windows/System32/config/SOFTWARE
    size   : 12288 (12.0 KB)
    MD5    : 767a5e836136b37287c3436c561282f1
    SHA-256: fb66091f56e3ff98794f95a330eb47801f2a330ff5737e2aec7cf25a4a012cbd

C/Windows/System32/config/SYSTEM
    size   : 24576 (24.0 KB)
    MD5    : bd970d7fee76ee75a8b5ca9bb4ac0521
    SHA-256: a0cba8684ef88f0b89c2fc654ef0b80acee4ca0e73b7df950298ca489efd7585

C/Windows/System32/winevt/Logs/Security.evtx
    size   : 135168 (132.0 KB)
    MD5    : ece343342b7afde4a1bc708282f1395d
    SHA-256: e75be8e312705284181bc7b5240c6e096feb255fae2a118bdeeb639ecc1db9a6

C/Windows/System32/winevt/Logs/System.evtx
    size   : 69632 (68.0 KB)
    MD5    : 526a9f846c4f6c90b1bfe0c5c52fe8e9
    SHA-256: d777e2653fde74fb273b53eecb188f16895eb50f049e350ecbd6844473eb9b93

disk/evidence.dd
    size   : 67108864 (64.0 MB)
    MD5    : fc60d17a006c57efd9fbd9e71e4bb9a0
    SHA-256: 715ccf6a8970d6c08d4d43dfd7f867edbbde515757fbea5b5f64da177646d2c3
