6
Shared Docs
6
Same-Page
6 / 6
Mentions
bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\aespivack\AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program File
ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.d11 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28 31e641
bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\aespivack\AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program File
ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.d11 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28 31e641
bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\aespivack\AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program File
ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.d11 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28 31e641
bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\aespivack\AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program File
ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.d11 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28 31e641
bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\aespivack\AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program File
ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.d11 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28 31e641
bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\aespivack\AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program File
ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.d11 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28 31e641
Entities connected to both ALLUSERSPROFILE and SMDiagnostics.ni.d11

Jeffrey Epstein
PERSONCOMPUTERNAME
ORGANIZATIONProgramFiles
ORGANIZATIONPSModulePath
ORGANIZATIONSystemDrive
ORGANIZATIONUSERDOMAIN
ORGANIZATIONUSERPROFILE
ORGANIZATIONC:\Windows\SYSTEM32\ntdll.dll
ORGANIZATIONC:\Windows\system32\USP10.d11
ORGANIZATIONC:\Windows\system32\OLEALIT32.d11
ORGANIZATIONConfiguration.ni.dll
ORGANIZATIONC:\Windows\system32\mfc140u.d11
ORGANIZATIONProcessing Engine\10.16\DALWrapper.d11
ORGANIZATIONGenuinelntel
PERSONDrawing.ni.dll
PERSONPM Tu
PERSONPostldentifyRefinement
ORGANIZATIONPhotoDna
ORGANIZATIONMem Cap
PERSONindex_args.cpp:163
LOCATION