Root Kit Reveal

HKU\S-1-5-21-1614895754-2077806209-725345543-1003\Software\SecuROM\License information* 15. 4. 2009 18:20 0 bytes Key name contains embedded nulls (*) HKLM\SECURITY\Policy\Secrets\SAC* 12. 1. 2009 19:02 0 bytes Key name contains embedded nulls (*) HKLM\SECURITY\Policy\Secrets\SAI* 12. 1. 2009 19:02 0 bytes Key name contains embedded nulls (*) HKLM\SOFTWARE\ASUS\AI Gear3\EPU\MB\CurrentPower17. 4. 2009 14:04 8 bytes Data mismatch between Windows API and raw hive data. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036065.exe 24. 3. 2008 13:48 28.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036066.exe 25. 9. 2002 20:28 40.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036067.exe 30. 9. 2002 14:56 20.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036068.exe 7. 10. 2002 1:27 104.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036069.exe 18. 10. 2002 6:37 328.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036070.exe 6. 1. 2003 17:28 20.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036071.exe 1. 8. 2002 13:03 32.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036072.exe 1. 8. 2002 13:03 36.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036073.exe 25. 6. 2003 12:24 68.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036074.exe 25. 6. 2003 12:24 64.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036075.exe 25. 6. 2003 12:24 40.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036076.exe 1. 9. 2003 13:10 260.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036077.exe 1. 9. 2003 13:11 168.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036078.exe 16. 10. 2002 16:39 64.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036079.exe 10. 1. 2000 15:52 136.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036080.exe 5. 10. 2000 18:05 162.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-

3454D942533D}\RP150\A0036081.exe 7. 3. 2008 3:46 209.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036082.exe 7. 3. 2008 3:46 84.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036083.exe 7. 3. 2008 3:46 24.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036084.exe 4. 8. 2004 3:07 72.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036085.exe 7. 3. 2008 3:46 20.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036086.exe 7. 3. 2008 3:46 18.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036087.exe 7. 3. 2008 3:46 91.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036088.exe 12. 1. 2009 19:25 29.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036089.exe 12. 1. 2009 19:26 145.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036090.exe 12. 1. 2009 19:25 84.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036091.exe 3. 7. 1997 10:35 106.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036092.exe 7. 3. 2008 3:46 288.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036093.exe 7. 3. 2008 3:46 756.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036094.exe 7. 3. 2008 3:46 209.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036095.exe 7. 3. 2008 3:46 526.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036096.exe 4. 8. 2004 3:07 27.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036097.exe 7. 3. 2008 3:46 274.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036098.exe 17. 4. 2009 14:16 425.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036099.exe 17. 4. 2009 14:17 48.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036100.exe 17. 4. 2009 14:17 720.00 KB

Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from

Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036101.exe 17. 4. 2009 14:17 36.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036102.exe 17. 4. 2009 14:17 13.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036103.exe 17. 4. 2009 14:17 104.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036104.exe 17. 4. 2009 14:17 104.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036105.exe 17. 4. 2009 14:17 88.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036106.exe 17. 4. 2009 14:17 751.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036107.exe 17. 4. 2009 14:17 97.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036108.exe 17. 4. 2009 14:17 727.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036109.exe 17. 4. 2009 14:17 18.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036110.exe 17. 4. 2009 14:17 166.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036111.exe 17. 4. 2009 14:17 34.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036112.exe 17. 4. 2009 14:18 32.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036113.exe 17. 4. 2009 14:18 11.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036114.exe 17. 4. 2009 14:18 12.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036115.exe 17. 4. 2009 14:18 14.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036116.exe 17. 4. 2009 14:18 16.05 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036117.exe 17. 4. 2009 14:18 70.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036118.exe 17. 4. 2009 14:18 139.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036119.exe 17. 4. 2009 14:18 19.50 KB Windows API.

Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from

C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036120.exe 17. 4. 2009 14:18 92.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036121.exe 17. 4. 2009 14:18 5.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036122.exe 17. 4. 2009 14:18 380.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036123.exe 17. 4. 2009 14:18 25.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036124.exe 17. 4. 2009 14:18 39.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036125.exe 17. 4. 2009 14:18 62.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036126.exe 17. 4. 2009 14:18 209.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036127.exe 17. 4. 2009 14:18 84.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036128.exe 17. 4. 2009 14:18 24.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036129.exe 17. 4. 2009 14:18 18.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036130.exe 17. 4. 2009 14:18 8.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036131.exe 17. 4. 2009 14:18 91.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036132.exe 17. 4. 2009 14:18 180.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036133.exe 17. 4. 2009 14:19 43.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036134.exe 17. 4. 2009 14:19 101.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036135.exe 17. 4. 2009 14:19 1.35 MB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036136.exe 17. 4. 2009 14:19 120.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036137.exe 17. 4. 2009 14:19 30.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036138.scr 17. 4. 2009 14:19 20.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-

Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from

3454D942533D}\RP150\A0036139.scr 17. 4. 2009 14:19 18.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036140.scr 17. 4. 2009 14:19 664.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036141.exe 17. 4. 2009 14:19 60.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036142.exe 17. 4. 2009 14:19 76.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036143.exe 17. 4. 2009 14:19 253.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036144.exe 17. 4. 2009 14:20 63.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036145.exe 17. 4. 2009 14:20 545.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036146.exe 17. 4. 2009 14:20 78.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036147.exe 17. 4. 2009 14:20 13.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036148.exe 17. 4. 2009 14:20 15.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036149.exe 17. 4. 2009 14:20 14.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036150.exe 17. 4. 2009 14:20 13.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036151.exe 17. 4. 2009 14:20 56.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036152.exe 17. 4. 2009 14:20 7.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036153.exe 17. 4. 2009 14:20 192.06 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036154.exe 17. 4. 2009 14:20 204.05 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036155.exe 17. 4. 2009 14:20 256.05 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036156.exe 17. 4. 2009 14:20 58.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036157.exe 17. 4. 2009 14:20 15.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036158.exe 17. 4. 2009 14:20 8.00 KB

Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from

Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036159.exe 17. 4. 2009 14:20 48.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036160.exe 17. 4. 2009 14:20 24.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036161.exe 17. 4. 2009 14:20 61.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036162.exe 17. 4. 2009 14:20 129.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036163.exe 17. 4. 2009 14:20 55.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036164.exe 17. 4. 2009 14:20 50.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036165.exe 17. 4. 2009 14:20 36.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036166.exe 17. 4. 2009 14:20 15.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036167.exe 17. 4. 2009 14:20 19.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036168.exe 17. 4. 2009 14:20 14.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036169.exe 17. 4. 2009 14:20 16.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036170.exe 17. 4. 2009 14:20 14.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036171.exe 17. 4. 2009 14:20 16.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036172.exe 17. 4. 2009 14:20 4.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036173.exe 17. 4. 2009 14:20 204.00 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036174.exe 17. 4. 2009 14:20 16.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036175.exe 17. 4. 2009 14:21 28.50 KB Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036176.exe 1. 9. 2003 13:35 420.00 KB directory index, but not Windows API or MFT. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036177.scr 7. 3. 2008 3:46 46.00 KB directory index, but not Windows API or MFT.

Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Hidden from Visible in Visible in

C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036178.scr 17. 4. 2009 14:21 596.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036179.scr 17. 4. 2009 14:21 14.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036180.scr 17. 4. 2009 14:21 664.00 KB Hidden from Windows API. C:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036181.exe 17. 4. 2009 14:21 235.50 KB Hidden from Windows API. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-3454D942533D}\RP0 12. 1. 2009 18:25 0 bytes Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP0\change.log.1 12. 1. 2009 18:25 758 bytes Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-3454D942533D}\RP150 17. 4. 2009 14:03 0 bytes Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0033984.ini 14. 4. 2009 14:24 2.29 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0033985.ini 14. 4. 2009 14:24 0 bytes Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0034889.ini 16. 4. 2009 19:19 2.29 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0034890.ini 16. 4. 2009 19:19 0 bytes Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0034955.ini 15. 4. 2009 19:29 65 bytes Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035017.exe 16. 2. 2007 10:54 296.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035901.exe 29. 6. 2004 17:23 2.14 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035902.exe 17. 9. 2006 11:32 1.31 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035903.exe 11. 5. 2004 19:28 848.08 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035904.exe 30. 6. 2004 17:48 13.41 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035905.exe 27. 4. 2004 15:33 164.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035906.exe 23. 6. 2004 20:26 1.92 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-

3454D942533D}\RP150\A0035907.exe 16. 6. 2004 20:47 5.37 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035908.exe 16. 6. 2004 20:48 1.80 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035909.exe 16. 6. 2004 20:48 1.06 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035910.exe 16. 6. 2004 21:00 1.70 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035911.exe 28. 6. 2004 21:27 2.59 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035912.exe 9. 5. 2003 1:24 2.96 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035913.exe 15. 7. 2007 13:10 1.00 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035914.exe 9. 5. 2003 3:24 2.95 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035915.exe 21. 5. 2002 9:05 2.29 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035916.exe 26. 10. 2004 2:40 348.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035917.exe 10. 11. 2004 14:37 4.59 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035918.exe 29. 9. 2004 4:55 568.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035919.exe 15. 10. 2004 6:59 332.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035920.exe 29. 9. 2004 4:55 604.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035921.exe 10. 10. 2007 17:53 116.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035922.exe 22. 11. 2008 14:19 106.03 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035923.exe 14. 1. 1999 16:47 97.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035924.exe 14. 1. 1999 16:53 462.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035925.exe 14. 1. 1999 16:48 99.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035926.exe 14. 1. 1999 16:48 98.50 KB Visible in Windows

API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035927.exe 14. 1. 1999 16:48 96.50 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035928.exe 14. 1. 1999 16:44 57.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035929.exe 22. 3. 2005 3:41 19.07 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035930.exe 22. 3. 2005 4:29 18.65 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035931.exe 22. 3. 2005 5:03 76.50 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035932.exe 11. 6. 2003 16:24 85.55 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035933.exe 11. 6. 2003 16:25 85.27 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035934.exe 11. 6. 2003 16:25 85.27 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035935.exe 16. 4. 2008 20:39 188.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035936.exe 20. 4. 2008 11:55 2.95 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035937.exe 20. 4. 2008 11:59 678.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035938.exe 9. 6. 2005 14:01 104.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035939.exe 10. 5. 2004 3:25 100.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035940.exe 10. 5. 2004 3:25 236.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035941.exe 21. 7. 2005 14:16 380.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035942.exe 1. 8. 2004 12:22 5.20 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035943.exe 8. 8. 2003 20:30 1.48 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035944.exe 8. 8. 2003 20:30 1.20 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035945.exe 7. 7. 2003 12:21 176.00 KB API, but not in MFT or directory index.

Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows

D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035946.exe 14. 12. 2004 16:37 104.07 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035948.exe 16. 11. 2004 14:27 144.07 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035949.exe 9. 10. 2005 15:27 238.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035950.exe 9. 10. 2005 15:27 399.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035951.exe 9. 10. 2005 15:27 17.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035952.EXE 29. 10. 2000 22:03 4.20 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035953.exe 18. 3. 2000 2:29 68.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035954.exe 30. 10. 2000 18:32 46.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035955.EXE 28. 9. 2000 13:02 1.38 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035956.exe 29. 10. 2000 0:36 123.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035957.exe 24. 10. 2000 23:11 146.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035958.exe 24. 10. 2000 15:27 60.37 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035959.EXE 24. 10. 2000 23:39 145.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035960.EXE 14. 8. 2000 19:52 84.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035961.exe 22. 9. 2000 13:36 124.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035963.exe 21. 7. 2008 16:14 128.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035964.exe 21. 7. 2008 16:14 474.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035965.EXE 21. 7. 2008 16:14 178.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035966.exe 21. 7. 2008 16:14 1020.06 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-

3454D942533D}\RP150\A0035967.exe 21. 7. 2008 16:14 1.24 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035968.EXE 5. 5. 2003 0:04 916.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035969.EXE 4. 6. 2003 18:47 2.14 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035970.EXE 3. 8. 2008 19:28 2.14 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035971.exe 3. 8. 2008 19:28 2.14 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035972.exe 17. 6. 2002 8:25 44.98 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035973.exe 18. 7. 2002 16:45 896.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035974.exe 11. 7. 2002 13:32 48.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035975.exe 14. 8. 2002 13:49 398.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035976.exe 15. 3. 2000 11:44 384.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035977.EXE 27. 7. 2000 14:49 1.47 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035978.EXE 7. 2. 2001 20:47 120.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035979.exe 21. 8. 2003 16:37 425.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035980.EXE 12. 7. 1996 17:31 327.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035981.exe 14. 2. 2008 17:26 2.14 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035982.exe 4. 1. 2009 23:40 48.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035983.exe 9. 8. 2004 12:28 872.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035984.exe 4. 11. 2003 17:52 465.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035985.exe 5. 11. 2003 16:11 851.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035986.exe 18. 11. 2003 21:32 5.26 MB Visible in

Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035987.exe 4. 11. 2003 18:04 1.52 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035988.exe 16. 9. 2003 16:40 44.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035989.exe 2. 6. 2006 9:25 1.09 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035990.exe 13. 1. 2005 21:05 466.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035991.exe 19. 2. 2005 12:31 166.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035992.exe 6. 6. 2006 9:08 552.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035993.exe 13. 1. 2005 21:05 875.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035994.exe 10. 2. 2005 3:26 4.39 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035995.exe 13. 1. 2005 21:05 1.45 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035996.exe 29. 4. 2003 18:12 412.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035997.exe 27. 10. 2004 10:41 1.89 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035998.exe 5. 6. 2002 18:35 944.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0035999.exe 5. 6. 2002 18:35 96.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036000.exe 8. 6. 2002 3:15 308.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036001.exe 27. 3. 2002 15:05 476.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036002.EXE 25. 6. 1999 10:55 165.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036003.exe 27. 3. 2002 15:05 172.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036005.exe 20. 8. 1998 17:07 909.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036006.exe 23. 6. 1998 15:47 714.50 KB Visible in Windows API, but not in MFT or directory index.

D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036007.exe 7. 6. 2005 17:59 13.74 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036008.exe 30. 8. 2007 2:28 63.15 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036009.exe 27. 5. 2007 19:56 34.50 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036010.exe 14. 4. 2007 20:23 319.50 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036011.exe 30. 8. 2007 0:24 728.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036012.exe 18. 3. 2006 2:15 44.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036013.exe 15. 3. 2006 22:25 26.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036014.exe 12. 3. 2006 17:39 188.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036015.exe 14. 3. 2006 20:06 56.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036016.exe 15. 3. 2006 0:17 84.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036017.exe 14. 3. 2006 21:21 80.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036018.exe 16. 6. 2007 3:43 36.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036019.exe 11. 8. 2007 18:14 375.50 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036020.exe 5. 4. 2006 15:55 144.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036021.exe 20. 7. 2001 11:46 247.00 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036022.exe 21. 9. 2001 12:21 2.00 MB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036023.exe 24. 4. 1998 1:00 36.27 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036024.exe 26. 1. 2001 22:35 232.06 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036025.exe 22. 9. 1998 18:23 228.50 KB API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD4-

Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows Visible in Windows

3454D942533D}\RP150\A0036026.exe 19. 8. 1999 12:38 220.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036027.exe 4. 5. 1999 14:33 106.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036028.EXE 21. 6. 1998 19:26 176.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036029.exe 22. 3. 2000 21:46 232.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036030.exe 27. 4. 1999 16:28 107.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036031.exe 27. 4. 1999 14:02 53.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036032.exe 26. 10. 2008 18:15 8.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036033.exe 26. 10. 2008 18:15 9.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036034.exe 26. 10. 2008 18:15 15.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036035.exe 24. 5. 2006 14:36 108.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036036.exe 14. 11. 2008 9:36 196.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036037.exe 14. 6. 2002 0:00 115.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036038.exe 14. 11. 2008 9:35 56.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036039.exe 16. 2. 2007 10:54 472.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036040.exe 12. 1. 1999 12:42 72.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036041.exe 27. 10. 1998 13:06 27.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036042.exe 18. 12. 2002 8:45 1020.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036043.EXE 4. 10. 2000 14:08 68.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036044.exe 18. 12. 2002 9:42 504.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036045.exe 28. 3. 2002 11:45 732.00 KB Visible in Windows

API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036046.exe 17. 12. 2002 23:42 252.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036047.exe 17. 12. 2002 23:40 44.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036048.exe 17. 12. 2002 23:39 2.65 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036049.exe 17. 12. 2002 23:40 56.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036050.exe 17. 12. 2002 23:53 560.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036051.exe 24. 10. 2002 10:07 88.07 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036052.exe 17. 12. 2002 22:39 1.10 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036053.EXE 4. 10. 2000 14:08 68.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036054.exe 30. 11. 2002 20:16 736.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036055.exe 17. 7. 2002 17:20 240.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036056.exe 7. 3. 2005 2:51 32.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036057.exe 14. 12. 2004 12:40 31.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036058.exe 22. 11. 2004 18:18 300.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036059.exe 14. 12. 2004 14:44 29.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036060.exe 7. 3. 2005 2:01 92.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036061.exe 26. 4. 2005 12:16 220.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036062.exe 24. 3. 2005 15:39 7.95 MB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036063.exe 7. 10. 2005 15:05 861.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036064.exe 16. 10. 2006 16:22 1.12 MB Visible in Windows API, but not in MFT or directory index.

D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036182.exe 15. 10. 2004 6:59 72.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036183.exe 11. 6. 2003 16:25 65.13 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036184.exe 11. 6. 2003 16:24 65.13 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036185.exe 11. 6. 2003 16:25 66.89 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036186.exe 11. 6. 2003 16:25 65.48 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036187.exe 11. 6. 2003 16:25 65.41 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036188.exe 11. 6. 2003 16:25 65.47 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036189.exe 11. 6. 2003 16:25 65.27 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036190.exe 11. 6. 2003 16:24 67.17 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036191.exe 11. 6. 2003 16:24 65.16 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036192.exe 10. 5. 2004 3:25 384.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036193.exe 13. 1. 2005 21:06 32.50 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\A0036194.exe 21. 10. 2004 4:11 80.00 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\change.log 17. 4. 2009 14:30 125.21 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\change.log.1 16. 4. 2009 19:19 2.42 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\change.log.2 16. 4. 2009 21:17 3.22 KB Visible in Windows API, but not in MFT or directory index. D:\System Volume Information\_restore{EC4C8984-A8C4-433B-9CD43454D942533D}\RP150\RestorePointSize 17. 4. 2009 13:13 8 bytes Visible in Windows API, but not in MFT or directory index.