概要
volatilityの作法、調べてみた。
winxpsp3のスナップショット、取ってみた。
mtfparser
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2009-02-27 09:12:06 UTC+0000 2009-02-27 09:12:06 UTC+0000 2020-02-03 23:30:02 UTC+0000 2020-02-03 23:30:02 UTC+0000 WINDOWS\Help\ieakmmc.chm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-010000000000
Birth Volume ID: 0a110100-0000-0000-0a11-010000000000
Birth Object ID: 31122e77-0b00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d28400
Attribute: In Use & File
Record Number: 9185
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2009-02-18 15:46:58 UTC+0000 2020-02-03 23:30:40 UTC+0000 2020-02-03 23:30:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2009-02-18 15:46:58 UTC+0000 2009-02-18 15:46:58 UTC+0000 2020-02-03 23:30:02 UTC+0000 2020-02-03 23:30:02 UTC+0000 WINDOWS\Help\ieeula.chm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: a1320000-0000-0000-a132-000000000000
Birth Object ID: 31048ccf-0100-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d28800
Attribute: In Use & File
Record Number: 9186
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2009-02-18 15:46:58 UTC+0000 2020-02-03 23:30:40 UTC+0000 2020-02-03 23:30:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2009-02-18 15:46:58 UTC+0000 2009-02-18 15:46:58 UTC+0000 2020-02-03 23:30:02 UTC+0000 2020-02-03 23:30:02 UTC+0000 WINDOWS\Help\iesupp.chm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: ff370000-0000-0000-ff37-000000000000
Birth Object ID: 31042bdb-0700-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d28c00
Attribute: In Use & File
Record Number: 9187
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:42 UTC+0000 2004-08-03 13:29:32 UTC+0000 2020-02-03 02:56:42 UTC+0000 2020-02-03 02:56:42 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:42 UTC+0000 2004-08-03 13:29:32 UTC+0000 2020-02-03 02:56:42 UTC+0000 2020-02-03 02:56:42 UTC+0000 atinttxx.sys
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 00360000-0000-0000-0036-000000000000
Birth Object ID: 3104d7a1-0700-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d29000
Attribute: In Use & File
Record Number: 18484
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:29 UTC+0000 2008-04-13 22:56:20 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:25 UTC+0000 2008-04-13 22:56:20 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 WINDOWS\system32\msdtc.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d29400
Attribute: In Use & File
Record Number: 18485
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:25 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 WINDOWS\system32\msdmo.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d29800
Attribute: In Use & File
Record Number: 18486
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 13:54:02 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:26 UTC+0000 2008-04-13 13:54:02 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 WINDOWS\system32\msdatsrc.tlb
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 00300000-0000-0000-0030-000000000000
Birth Object ID: 3103498a-0200-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d29c00
Attribute: In Use & File
Record Number: 18487
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:26 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:26 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 WINDOWS\system32\msdart.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-020000000000
Birth Volume ID: 00500200-0000-0000-0050-020000000000
Birth Object ID: 311b646c-0e21-0adc-6100-010000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2a000
Attribute: File
Record Number: 18496
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:16 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:08:38 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 A0003151.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-000000000000
Birth Volume ID: 00e00000-0000-0000-00e0-000000000000
Birth Object ID: 310eb18c-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2a400
Attribute: In Use & File
Record Number: 18497
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:26 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 WINDOWS\system32\msapsspc.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2a800
Attribute: In Use & File
Record Number: 18498
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:54:28 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:26 UTC+0000 2008-04-13 22:54:28 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 WINDOWS\system32\msafd.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2ac00
Attribute: In Use & File
Record Number: 18499
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:54:28 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-04 13:40:46 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:26 UTC+0000 2008-04-13 22:54:28 UTC+0000 2020-02-03 23:22:26 UTC+0000 2020-02-03 23:22:26 UTC+0000 WINDOWS\system32\msadp32.acm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 003a0000-0000-0000-003a-000000000000
Birth Object ID: 3104c4c3-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2b000
Attribute: In Use & File
Record Number: 18512
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\more.com
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2b400
Attribute: In Use & File
Record Number: 18513
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\modemui.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-020000000000
Birth Volume ID: 00460200-0000-0000-0046-020000000000
Birth Object ID: 3108fb14-0b21-1133-0931-0c9613ff00e1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2b800
Attribute: In Use & File
Record Number: 18514
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:18 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:56:18 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\mobsync.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-020000000000
Birth Volume ID: 002a0200-0000-0000-002a-020000000000
Birth Object ID: 3108c51d-0b21-12f9-0021-09848c003be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2bc00
Attribute: In Use & File
Record Number: 18515
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\mobsync.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-030000000000
Birth Volume ID: 00140300-0000-0000-0014-030000000000
Birth Object ID: 310a111d-0b21-0e4f-8e21-1a4613003be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2c000
Attribute: In Use & File
Record Number: 18516
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:00:51 UTC+0000 2008-04-13 22:56:18 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:56:18 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\mnmsrvc.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00800000-0000-0000-0080-000000000000
Birth Object ID: 21085972-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2c400
Attribute: In Use & File
Record Number: 18517
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:32 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\mnmdd.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2c800
Attribute: In Use & File
Record Number: 18518
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\mmsys.cpl
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2cc00
Attribute: In Use & File
Record Number: 18519
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:44:09 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:27 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:27 UTC+0000 2020-02-03 23:22:27 UTC+0000 WINDOWS\system32\mmfutil.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 00440000-0000-0000-0044-000000000000
Birth Object ID: 3105465c-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2d000
Attribute: In Use & File
Record Number: 18560
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2008-04-13 22:55:54 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:30 UTC+0000 WINDOWS\system32\licdll.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-060000000000
Birth Volume ID: 006e0600-0000-0000-006e-060000000000
Birth Object ID: 3167d0b1-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2d400
Attribute: File
Record Number: 18561
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:16 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:20:00 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 A0003204.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-060000000000
Birth Volume ID: 006e0600-0000-0000-006e-060000000000
Birth Object ID: 3167d5b5-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2d800
Attribute: File
Record Number: 18562
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:25:34 UTC+0000 2020-02-03 23:22:31 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:31 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 WINDOWS\system32\laprxy.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2dc00
Attribute: File
Record Number: 18563
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:54:22 UTC+0000 2020-02-03 23:25:34 UTC+0000 2020-02-03 23:22:31 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:31 UTC+0000 2008-04-13 22:54:22 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 WINDOWS\system32\l3codeca.acm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-040000000000
Birth Volume ID: 00700400-0000-0000-0070-040000000000
Birth Object ID: 310b5775-0e21-22db-0821-0bfcf7310f33
Birth Domain ID: f1fb00f8-0768-90f9-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2e000
Attribute: File
Record Number: 18576
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:30:05 UTC+0000 2020-02-03 23:22:31 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:31 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 WINDOWS\system32\jsproxy.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 003e0000-0000-0000-003e-000000000000
Birth Object ID: 3104401c-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2e400
Attribute: File
Record Number: 18577
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:30:05 UTC+0000 2020-02-03 23:29:50 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:31 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:32 UTC+0000 2020-02-03 23:22:32 UTC+0000 WINDOWS\system32\jscript.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00d0-070000000000
Birth Volume ID: 00d00700-0000-0000-00d0-070000000000
Birth Object ID: 3108e871-0e31-3051-8300-2145ab9b00e1
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2e800
Attribute: In Use & File
Record Number: 18578
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:32 UTC+0000 2020-02-03 23:22:32 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:32 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:32 UTC+0000 2020-02-03 23:22:32 UTC+0000 WINDOWS\system32\joy.cpl
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2ec00
Attribute: In Use & File
Record Number: 18579
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:32 UTC+0000 2020-02-03 23:22:32 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:32 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:32 UTC+0000 2020-02-03 23:22:32 UTC+0000 WINDOWS\system32\jgpl400.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 006c0000-0000-0000-006c-000000000000
Birth Object ID: 3107084b-0600-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2f000
Attribute: In Use & File
Record Number: 18604
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:22:33 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:33 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:22:33 UTC+0000 WINDOWS\system32\intl.cpl
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2f400
Attribute: File
Record Number: 18605
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:30:05 UTC+0000 2020-02-03 23:22:33 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:33 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:22:33 UTC+0000 WINDOWS\system32\inseng.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-010000000000
Birth Volume ID: 00780100-0000-0000-0078-010000000000
Birth Object ID: 310c7da2-0e21-0cd3-0f00-3be10849d8f8
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2f800
Attribute: In Use & File
Record Number: 18606
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:28:10 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:33 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:22:33 UTC+0000 WINDOWS\system32\input.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d2fc00
Attribute: In Use & File
Record Number: 18607
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:33 UTC+0000 2008-04-13 22:55:54 UTC+0000 2020-02-03 23:22:33 UTC+0000 2020-02-03 23:22:33 UTC+0000 WINDOWS\system32\initpki.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-020000000000
Birth Volume ID: 00400200-0000-0000-0040-020000000000
Birth Object ID: 31248fba-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d30000
Attribute: In Use & File
Record Number: 18624
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:14 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:34 UTC+0000 2008-04-13 22:56:14 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 WINDOWS\system32\imapi.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d30400
Attribute: In Use & File
Record Number: 18625
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:54:12 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-04 13:40:46 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:34 UTC+0000 2008-04-13 22:54:12 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 WINDOWS\system32\imaadp32.acm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 003e0000-0000-0000-003e-000000000000
Birth Object ID: 3104bc20-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d30800
Attribute: In Use & File
Record Number: 18626
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:34 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 WINDOWS\system32\igmpagnt.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d30c00
Attribute: In Use & File
Record Number: 18627
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:34 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 23:22:34 UTC+0000 WINDOWS\system32\ifmon.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d31000
Attribute: File
Record Number: 18632
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:30:03 UTC+0000 2020-02-03 23:29:50 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:35 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:35 UTC+0000 2020-02-03 23:22:35 UTC+0000 WINDOWS\system32\iedkcs32.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-040000000000
Birth Volume ID: 00f00400-0000-0000-00f0-040000000000
Birth Object ID: 314f91c3-0a00-d3de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d31400
Attribute: File
Record Number: 18633
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:30:03 UTC+0000 2020-02-03 23:22:35 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:35 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:35 UTC+0000 2020-02-03 23:22:35 UTC+0000 WINDOWS\system32\ieaksie.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-030000000000
Birth Volume ID: 00360300-0000-0000-0036-030000000000
Birth Object ID: 3134459b-0300-d3de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d31800
Attribute: File
Record Number: 18634
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:30:03 UTC+0000 2020-02-03 23:22:35 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:35 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:35 UTC+0000 2020-02-03 23:22:35 UTC+0000 WINDOWS\system32\ieakeng.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-020000000000
Birth Volume ID: 00300200-0000-0000-0030-020000000000
Birth Object ID: 31239a37-0a00-d3de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d31c00
Attribute: File
Record Number: 18635
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:14 UTC+0000 2020-02-03 23:30:03 UTC+0000 2020-02-03 23:28:03 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:35 UTC+0000 2008-04-13 22:56:14 UTC+0000 2020-02-03 23:22:35 UTC+0000 2020-02-03 23:22:35 UTC+0000 WINDOWS\system32\ie4uinit.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 00860000-0000-0000-0086-000000000000
Birth Object ID: 3109d237-0a00-d3de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d32000
Attribute: File
Record Number: 18692
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:30:03 UTC+0000 2020-02-03 23:29:50 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:38 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:38 UTC+0000 2020-02-03 23:22:38 UTC+0000 WINDOWS\system32\dxtmsft.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-050000000000
Birth Volume ID: 00760500-0000-0000-0076-050000000000
Birth Object ID: 3129a73b-0a21-2f28-1800-010000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d32400
Attribute: File
Record Number: 18693
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:25:34 UTC+0000 2020-02-03 23:22:38 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:38 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:38 UTC+0000 2020-02-03 23:22:38 UTC+0000 WINDOWS\system32\dxmasf.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-070000000000
Birth Volume ID: 36920700-0000-0000-3692-070000000000
Birth Object ID: 31201e54-0a21-5ac2-2000-010000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d32800
Attribute: In Use & File
Record Number: 18694
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:38 UTC+0000 2020-02-03 23:22:38 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:38 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:38 UTC+0000 2020-02-03 23:22:38 UTC+0000 WINDOWS\system32\dxdiag.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00d0-130000000000
Birth Volume ID: 00d01300-0000-0000-00d0-130000000000
Birth Object ID: 315e7c04-0b31-7182-8b03-216e313c00e1
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d32c00
Attribute: In Use & File
Record Number: 18695
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:38 UTC+0000 2020-02-03 23:22:38 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:38 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:38 UTC+0000 2020-02-03 23:22:38 UTC+0000 WINDOWS\system32\dx8vb.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d33000
Attribute: In Use & File
Record Number: 18752
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:40 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 WINDOWS\system32\dmband.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 00700000-0000-0000-0070-000000000000
Birth Object ID: 310724c7-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d33400
Attribute: In Use & File
Record Number: 18753
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:40 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 WINDOWS\system32\dmadmin.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-030000000000
Birth Volume ID: 006c0300-0000-0000-006c-030000000000
Birth Object ID: 31378ec2-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d33800
Attribute: In Use & File
Record Number: 18754
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:40 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 WINDOWS\system32\dllhost.exe
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d33c00
Attribute: In Use & File
Record Number: 18755
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:40 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 WINDOWS\system32\dispex.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00800000-0000-0000-0080-000000000000
Birth Object ID: 3108c221-0f00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d34000
Attribute: In Use & File
Record Number: 18760
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:40 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 WINDOWS\system32\digest.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d34400
Attribute: In Use & File
Record Number: 18761
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:40 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:40 UTC+0000 2020-02-03 23:22:40 UTC+0000 WINDOWS\system32\diantz.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-010000000000
Birth Volume ID: 00540100-0000-0000-0054-010000000000
Birth Object ID: 31160a24-0f00-29db-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d34800
Attribute: In Use & File
Record Number: 18762
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dhcpmon.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-080000000000
Birth Volume ID: 007c0800-0000-0000-007c-080000000000
Birth Object ID: 32880022-240f-00db-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d34c00
Attribute: In Use & File
Record Number: 18763
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dgnet.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d35000
Attribute: In Use & File
Record Number: 18768
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dfrgfat.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-010000000000
Birth Volume ID: 00440100-0000-0000-0044-010000000000
Birth Object ID: 3115681a-0f00-29db-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d35400
Attribute: In Use & File
Record Number: 18769
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\devmgr.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-040000000000
Birth Volume ID: 00220400-0000-0000-0022-040000000000
Birth Object ID: 3143801a-0f00-29db-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d35800
Attribute: In Use & File
Record Number: 18770
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\devenum.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-000000000000
Birth Volume ID: 00ea0000-0000-0000-00ea-000000000000
Birth Object ID: 210f3b7f-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d35c00
Attribute: In Use & File
Record Number: 18771
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-04 13:39:43 UTC+0000 2020-02-04 13:39:43 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\defrag.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 00620000-0000-0000-0062-000000000000
Birth Object ID: 3107a8e5-0700-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d36000
Attribute: In Use & File
Record Number: 18772
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-04 13:51:59 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\ddrawex.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 006a0000-0000-0000-006a-000000000000
Birth Object ID: 2107b46f-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d36400
Attribute: In Use & File
Record Number: 18773
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-04 13:51:59 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\ddraw.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d36800
Attribute: In Use & File
Record Number: 18774
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\ddeshare.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00720000-0000-0000-0072-000000000000
Birth Object ID: 3108861b-0f00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d36c00
Attribute: In Use & File
Record Number: 18775
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:22 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:56:10 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dcomcnfg.exe
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d37000
Attribute: In Use & File
Record Number: 18776
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-04 13:51:59 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dciman32.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 00220000-0000-0000-0022-000000000000
Birth Object ID: 2103742d-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d37400
Attribute: In Use & File
Record Number: 18777
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 23:13:24 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 23:13:24 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dcache.bin
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 0c070000-0000-0000-0c07-000000000000
Birth Object ID: 3101fcb6-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d37800
Attribute: In Use & File
Record Number: 18778
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dbnetlib.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-010000000000
Birth Volume ID: 00b00100-0000-0000-00b0-010000000000
Birth Object ID: 311b8e1b-0f00-29db-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d37c00
Attribute: In Use & File
Record Number: 18779
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:41 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:41 UTC+0000 2020-02-03 23:22:41 UTC+0000 WINDOWS\system32\dbmsrpcn.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 00600000-0000-0000-0060-000000000000
Birth Object ID: 3106be83-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d38000
Attribute: In Use & File
Record Number: 18840
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:44 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\clipsrv.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 00820000-0000-0000-0082-000000000000
Birth Object ID: 2109d578-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d38400
Attribute: In Use & File
Record Number: 18841
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:43:32 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\clipbrd.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-010000000000
Birth Volume ID: 00820100-0000-0000-0082-010000000000
Birth Object ID: 310c0f36-0631-0d56-de03-000000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d38800
Attribute: In Use & File
Record Number: 18842
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\cliconfg.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 00500000-0000-0000-0050-000000000000
Birth Object ID: 3105e426-0600-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d38c00
Attribute: In Use & File
Record Number: 18843
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\cliconfg.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d39000
Attribute: In Use & File
Record Number: 18848
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:56:08 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\cisvc.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d39400
Attribute: In Use & File
Record Number: 18849
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\ciodm.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d39800
Attribute: In Use & File
Record Number: 18850
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:54:27 UTC+0000 2008-04-13 22:55:36 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:55:36 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\cintlgnt.ime
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 00540000-0000-0000-0054-000000000000
Birth Object ID: 31060688-0200-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d39c00
Attribute: In Use & File
Record Number: 18851
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:45 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:45 UTC+0000 2020-02-03 23:22:45 UTC+0000 WINDOWS\system32\cic.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-020000000000
Birth Volume ID: 00440200-0000-0000-0044-020000000000
Birth Object ID: 31258544-0600-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3a000
Attribute: In Use & File
Record Number: 18860
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:46 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 WINDOWS\system32\cdfview.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-020000000000
Birth Volume ID: 004e0200-0000-0000-004e-020000000000
Birth Object ID: 3125bbb8-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3a400
Attribute: In Use & File
Record Number: 18861
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:43:10 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:46 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:46 UTC+0000 2008-04-13 22:55:50 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 WINDOWS\system32\catsrvut.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-090000000000
Birth Volume ID: 008c0900-0000-0000-008c-090000000000
Birth Object ID: 311225b4-0e21-06ab-0021-230b54315ccc
Birth Domain ID: 22fb3102-5787-0000-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3a800
Attribute: File
Record Number: 18862
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:43:10 UTC+0000 2004-08-03 15:55:08 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:21:17 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 A0003460.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-090000000000
Birth Volume ID: 00960900-0000-0000-0096-090000000000
Birth Object ID: 329a0088-370f-0000-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3ac00
Attribute: In Use & File
Record Number: 18863
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:17 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:46 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:46 UTC+0000 2020-02-03 23:22:46 UTC+0000 WINDOWS\system32\catsrvps.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3b000
Attribute: In Use & File
Record Number: 18892
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\attrib.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 00300000-0000-0000-0030-000000000000
Birth Object ID: 3103b98e-0200-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3b400
Attribute: In Use & File
Record Number: 18893
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\atmlib.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00760000-0000-0000-0076-000000000000
Birth Object ID: 31080bf5-0e00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3b800
Attribute: In Use & File
Record Number: 18894
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:53:44 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:53:44 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\atmfd.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3bc00
Attribute: In Use & File
Record Number: 18895
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\atmadm.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 003a0000-0000-0000-003a-000000000000
Birth Object ID: 31044752-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3c000
Attribute: In Use & File
Record Number: 18908
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\ahui.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3c400
Attribute: File
Record Number: 18909
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:30:02 UTC+0000 2020-02-03 23:29:45 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\advpack.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-010000000000
Birth Volume ID: 007c0100-0000-0000-007c-010000000000
Birth Object ID: 310b3bbb-0331-0d9a-d605-00e10849d8f8
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3c800
Attribute: File
Record Number: 18910
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:08 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:21:14 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 A0003495.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-010000000000
Birth Volume ID: 007c0100-0000-0000-007c-010000000000
Birth Object ID: 3118801f-0b00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3cc00
Attribute: In Use & File
Record Number: 18911
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:49 UTC+0000 2020-02-03 23:22:48 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:48 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 2020-02-03 23:22:48 UTC+0000 WINDOWS\system32\adsnt.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3d000
Attribute: In Use & File
Record Number: 18940
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 13:14:30 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 13:14:30 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\usmt\iconlib.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 000a0000-0000-0000-000a-000000000000
Birth Object ID: 3101c6ba-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3d400
Attribute: In Use & File
Record Number: 18941
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:55:52 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\usmt\guitrn.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3d800
Attribute: In Use & File
Record Number: 18942
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:01 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\phone.inf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3dc00
Attribute: In Use & File
Record Number: 18943
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:06 UTC+0000 2007-02-21 01:53:30 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:27:42 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2007-02-21 01:53:30 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\oobeinfo.ini
$DATA
0000000000: 5b 53 74 61 72 74 75 70 4f 70 74 69 6f 6e 73 5d [StartupOptions]
0000000010: 0d 0a 53 74 61 72 74 55 72 6c 3d 22 22 0d 0a 0d ..StartUrl=""...
0000000020: 0a 5b 6f 70 74 69 6f 6e 73 5d 0d 0a 4d 6f 75 73 .[options]..Mous
0000000030: 65 54 75 74 6f 72 69 61 6c 3d 30 0d 0a 4a 6f 69 eTutorial=0..Joi
0000000040: 6e 44 6f 6d 61 69 6e 3d 31 0d 0a 41 64 6d 69 6e nDomain=1..Admin
0000000050: 50 77 3d 31 0d 0a 0d 0a 5b 4f 45 4d 52 65 67 69 Pw=1....[OEMRegi
0000000060: 73 74 72 61 74 69 6f 6e 50 61 67 65 5d 0d 0a 4f strationPage]..O
0000000070: 45 4d 41 64 64 52 65 67 50 61 67 65 3d 30 0d 0a EMAddRegPage=0..
0000000080: 50 6f 73 74 54 6f 4f 45 4d 3d 30 0d 0a 52 65 67 PostToOEM=0..Reg
0000000090: 50 6f 73 74 55 52 4c 3d 22 22 0d 0a 0d 0a 5b 53 PostURL=""....[S
00000000a0: 69 67 6e 75 70 5d 0d 0a 49 53 50 53 69 67 6e 75 ignup]..ISPSignu
00000000b0: 70 3d 4d 53 4e 0d 0a 4f 66 66 65 72 43 6f 64 65 p=MSN..OfferCode
00000000c0: 3d 30 0d 0a 4c 6f 63 61 6c 65 73 3d 31 2c 38 31 =0..Locales=1,81
00000000d0: 0d 0a 49 44 4c 6f 63 61 6c 65 73 3d 31 2c 38 31 ..IDLocales=1,81
00000000e0: 2c 33 33 2c 34 39 2c 31 30 37 2c 36 31 2c 34 34 ,33,49,107,61,44
00000000f0: 0d 0a 0d 0a ....
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3e000
Attribute: In Use & File
Record Number: 18944
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:03 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\oobebaln.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00d0-000000000000
Birth Volume ID: 00c80000-0000-0000-00c8-000000000000
Birth Object ID: 310d3c85-0900-ecd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3e400
Attribute: In Use & File
Record Number: 18945
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:06 UTC+0000 2008-04-13 22:56:22 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:56:22 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\msoobe.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 00700000-0000-0000-0070-000000000000
Birth Object ID: 2107ec61-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3e800
Attribute: In Use & File
Record Number: 18946
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:07 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\msobweb.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004c0000-0000-0000-004c-000000000000
Birth Object ID: 21058c45-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3ec00
Attribute: In Use & File
Record Number: 18947
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:07 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\msobshel.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00780000-0000-0000-0078-000000000000
Birth Object ID: 21084666-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3f000
Attribute: In Use & File
Record Number: 18948
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:04 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\msobmain.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-080000000000
Birth Volume ID: 009c0800-0000-0000-009c-080000000000
Birth Object ID: 328a0046-b100-0000-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3f400
Attribute: In Use & File
Record Number: 18949
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:08 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\msobdl.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 00400000-0000-0000-0040-000000000000
Birth Object ID: 3104ca5b-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3f800
Attribute: In Use & File
Record Number: 18950
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:03 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\msobcomm.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d3fc00
Attribute: In Use & File
Record Number: 18951
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:58 UTC+0000 2007-02-21 01:53:20 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2007-02-21 01:53:20 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\migrate.js
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: e65c0000-0000-0000-e65c-000000000000
Birth Object ID: 31062ec5-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d40000
Attribute: In Use & File
Record Number: 18176
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-11 12:21:31 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:07 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:07 UTC+0000 2020-02-03 23:22:07 UTC+0000 WINDOWS\system32\sfcfiles.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d40400
Attribute: In Use & File
Record Number: 18177
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-11 12:57:18 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 WINDOWS\system32\sfc_os.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-020000000000
Birth Volume ID: 00120200-0000-0000-0012-020000000000
Birth Object ID: 21222c1b-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d40800
Attribute: File
Record Number: 18178
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:26 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:21:21 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 A0002911.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-020000000000
Birth Volume ID: 00120200-0000-0000-0012-020000000000
Birth Object ID: 3122f01d-0b00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d40c00
Attribute: In Use & File
Record Number: 18179
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-11 12:57:18 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 WINDOWS\system32\sfc.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d41000
Attribute: In Use & File
Record Number: 12836
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\SAMPLE~2\000ED00D\Plylst13.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 1f030000-0000-0000-1f03-000000000000
Birth Object ID: 2101c730-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d41400
Attribute: In Use & File
Record Number: 12837
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\SAMPLE~2\000ED00D\Plylst12.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: bc050000-0000-0000-bc05-000000000000
Birth Object ID: 2101cb2e-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d41800
Attribute: In Use & File
Record Number: 12838
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:47 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\SAMPLE~2\000ED00D\Plylst3.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: c2050000-0000-0000-c205-000000000000
Birth Object ID: 21017132-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d41c00
Attribute: File
Record Number: 12839
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:49:02 UTC+0000 2020-02-03 23:25:17 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:49:02 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Windows NT\Accessories\write.wpc
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d42000
Attribute: File
Record Number: 12840
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:46:34 UTC+0000 2020-02-03 23:25:17 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:46:34 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Windows NT\Accessories\mswrd8.wpc
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-040000000000
Birth Volume ID: 003a0400-0000-0000-003a-040000000000
Birth Object ID: 311086a6-0c21-34b6-2d00-14e1bc07a6f8
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d42400
Attribute: File
Record Number: 12841
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:46:34 UTC+0000 2020-02-03 23:25:17 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:46:34 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Windows NT\Accessories\mswrd6.wpc
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-020000000000
Birth Volume ID: 00d20200-0000-0000-00d2-020000000000
Birth Object ID: 312ee5a0-0100-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d42800
Attribute: File
Record Number: 12842
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-08-03 13:21:46 UTC+0000 2020-02-03 23:25:17 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-08-03 13:21:46 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Common Files\System\ado\msado27.tlb
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-010000000000
Birth Volume ID: 00400100-0000-0000-0040-010000000000
Birth Object ID: 31141da1-0100-a6f8-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d42c00
Attribute: In Use & File
Record Number: 12843
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:39:26 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-11 12:57:19 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:39:26 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 WINDOWS\Fonts\vrinda.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-030000000000
Birth Volume ID: 94db0300-0000-0000-94db-030000000000
Birth Object ID: 313ec2bb-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d43000
Attribute: In Use & File
Record Number: 12844
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:39:24 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-11 12:57:19 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:39:24 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 WINDOWS\Fonts\kartika.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-010000000000
Birth Volume ID: 6cda0100-0000-0000-6cda-010000000000
Birth Object ID: 311e03b4-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d43400
Attribute: File
Record Number: 12845
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:55:48 UTC+0000 2020-02-03 23:25:18 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-08-03 15:55:48 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Internet Explorer\iedw.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d43800
Attribute: In Use & File
Record Number: 12846
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:45:00 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 23:27:42 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:45:00 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 WINDOWS\system32\oobe\images\redshd.gif
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 47080000-0000-0000-4708-000000000000
Birth Object ID: 21014d22-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d43c00
Attribute: In Use & File
Record Number: 12847
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:44:58 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 23:27:42 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:44:58 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 WINDOWS\system32\oobe\images\greenshd.gif
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 57080000-0000-0000-5708-000000000000
Birth Object ID: 21012f22-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d44000
Attribute: In Use & File
Record Number: 12848
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:41:30 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-04 13:55:14 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:41:30 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 WINDOWS\system32\Macromed\Flash\flash.ocx
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d44400
Attribute: In Use & Directory
Record Number: 12849
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Movie Maker\shared
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d44800
Attribute: In Use & File
Record Number: 12850
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:41:26 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:41:26 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Movie Maker\shared\sample2.jpg
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: e6b60000-0000-0000-e6b6-000000000000
Birth Object ID: 310c3855-0300-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d44c00
Attribute: In Use & File
Record Number: 12851
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:41:26 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:53 UTC+0000 2004-07-17 02:41:26 UTC+0000 2020-02-03 02:56:53 UTC+0000 2020-02-03 02:56:53 UTC+0000 Program Files\Movie Maker\shared\sample1.jpg
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-010000000000
Birth Volume ID: 0cf50000-0000-0000-0cf5-000000000000
Birth Object ID: 31104855-0300-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d45000
Attribute: In Use & File
Record Number: 12896
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 23:19:41 UTC+0000 2020-02-03 00:24:09 UTC+0000 2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 Compressed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 ftbp7tnt.zip
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d45400
Attribute: In Use & File
Record Number: 12897
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 23:19:41 UTC+0000 2002-08-31 05:00:00 UTC+0000 2020-02-03 23:19:42 UTC+0000 2020-02-03 23:19:42 UTC+0000 Compressed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 2020-02-03 23:19:41 UTC+0000 j175nbnd.zip
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d45800
Attribute: In Use & File
Record Number: 12898
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:54 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:52 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:54 UTC+0000 2004-07-17 02:38:20 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 WINDOWS\system32\oobe\setup\autoupdt.htm
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d45c00
Attribute: File
Record Number: 12899
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:54 UTC+0000 2004-07-17 02:38:20 UTC+0000 2020-02-03 23:25:20 UTC+0000 2020-02-03 02:56:54 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:54 UTC+0000 2004-07-17 02:38:20 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 WINDOWS\system32\oobe\setup\au_plcy.htm
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d46000
Attribute: In Use & File
Record Number: 12900
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:54 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:52 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:54 UTC+0000 2004-07-17 02:38:38 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 WINDOWS\system32\oobe\updshell.htm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 307d0000-0000-0000-307d-000000000000
Birth Object ID: 2108266a-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d46400
Attribute: In Use & File
Record Number: 12901
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:54 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:54 UTC+0000 2004-07-17 02:38:20 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 WINDOWS\system32\oobe\agtscrp2.js
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: fa0c0000-0000-0000-fa0c-000000000000
Birth Object ID: 21016120-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d46800
Attribute: File
Record Number: 12902
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:48 UTC+0000 2004-08-03 15:55:46 UTC+0000 2020-02-03 23:25:20 UTC+0000 2020-02-03 02:56:54 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:54 UTC+0000 2004-08-03 15:55:46 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 WINDOWS\PCHealth\HelpCtr\Binaries\hscupd.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004a0000-0000-0000-004a-000000000000
Birth Object ID: 3105d7e6-0200-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d46c00
Attribute: File
Record Number: 12903
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:54 UTC+0000 2004-08-03 15:55:32 UTC+0000 2020-02-03 23:25:20 UTC+0000 2020-02-03 02:56:54 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:54 UTC+0000 2004-08-03 15:55:32 UTC+0000 2020-02-03 02:56:54 UTC+0000 2020-02-03 02:56:54 UTC+0000 WINDOWS\system32\xmlprovi.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00d0-000000000000
Birth Volume ID: 00c40000-0000-0000-00c4-000000000000
Birth Object ID: 310d7a7c-0100-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d47000
Attribute: File
Record Number: 14964
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2008-04-13 22:54:20 UTC+0000 2008-04-13 22:54:20 UTC+0000 2020-02-03 23:16:14 UTC+0000 2020-02-03 23:23:25 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:14 UTC+0000 2020-02-03 23:16:14 UTC+0000 2020-02-03 23:16:14 UTC+0000 2020-02-03 23:16:14 UTC+0000 kbd106.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d47400
Attribute: File
Record Number: 14965
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:58 UTC+0000 2004-08-03 15:55:24 UTC+0000 2020-02-03 23:25:24 UTC+0000 2020-02-03 02:56:58 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:58 UTC+0000 2004-08-03 15:55:24 UTC+0000 2020-02-03 02:56:58 UTC+0000 2020-02-03 02:56:58 UTC+0000 WINDOWS\system32\pnrpnsp.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: 00be0000-0000-0000-00be-000000000000
Birth Object ID: 310c6f7d-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d47800
Attribute: In Use & File
Record Number: 14966
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:53:59 UTC+0000 2004-08-03 16:56:44 UTC+0000 2020-02-03 02:53:59 UTC+0000 2020-02-03 02:53:59 UTC+0000 System
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:53:59 UTC+0000 2020-02-03 02:53:59 UTC+0000 2020-02-03 02:53:59 UTC+0000 2020-02-03 02:53:59 UTC+0000 WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\sp2.cat
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-0f0000000000
Birth Volume ID: 48a90f00-0000-0000-48a9-0f0000000000
Birth Object ID: 32fb00a4-0101-0000-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d47c00
Attribute: File
Record Number: 14967
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:58 UTC+0000 2004-08-03 15:55:24 UTC+0000 2020-02-03 23:25:24 UTC+0000 2020-02-03 02:56:58 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:58 UTC+0000 2004-08-03 15:55:24 UTC+0000 2020-02-03 02:56:58 UTC+0000 2020-02-03 02:56:58 UTC+0000 WINDOWS\system32\p2psvc.dll
$DATA
$DATA
0000000000: 80 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0000000010: 00 10 08 00 00 00 00 00 00 0a 08 00 00 00 00 00 ................
0000000020: 00 0a 08 00 00 00 00 00 31 08 7f 7d 0b 21 62 5e ........1..}.!b^
0000000030: 3a 21 17 54 13 00 a6 f8 :!.T....
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d48000
Attribute: File
Record Number: 15204
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:56:06 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:19:49 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:56:06 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:19:49 UTC+0000 A0002798.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-060000000000
Birth Volume ID: 00740600-0000-0000-0074-060000000000
Birth Object ID: 3115fd59-0a21-0368-ff21-3290de211e46
Birth Domain ID: 1e000000-0000-0000-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d48400
Attribute: File
Record Number: 15205
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:56:04 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 02:54:20 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:56:04 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 02:54:20 UTC+0000 A0002799.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-010000000000
Birth Volume ID: 00f40000-0000-0000-00f4-000000000000
Birth Object ID: 31108b60-0a00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d48800
Attribute: File
Record Number: 15206
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:30 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 02:54:20 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:30 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 02:54:20 UTC+0000 A0002800.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d48c00
Attribute: In Use & File
Record Number: 15207
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 02:35:20 UTC+0000 2020-02-03 02:54:20 UTC+0000 2020-02-03 02:54:20 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:54:20 UTC+0000 2004-07-17 02:35:20 UTC+0000 2020-02-03 02:54:20 UTC+0000 2020-02-03 02:54:20 UTC+0000 WINDOWS\system32\webfldrs.msi
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-140000000000
Birth Volume ID: 00ae1400-0000-0000-00ae-140000000000
Birth Object ID: 324b0107-3001-0000-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d49000
Attribute: In Use & File
Record Number: 15736
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:36 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-04 13:51:57 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:31 UTC+0000 2008-04-13 22:56:36 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:22:31 UTC+0000 WINDOWS\system32\kmddsp.tsp
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 00820000-0000-0000-0082-000000000000
Birth Object ID: 21091361-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d49400
Attribute: File
Record Number: 15737
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:56:10 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 02:54:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:56:10 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 02:54:45 UTC+0000 A0003206.tsp
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 00820000-0000-0000-0082-000000000000
Birth Object ID: 310988ba-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d49800
Attribute: File
Record Number: 15738
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:16 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 02:54:45 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:16 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 02:54:45 UTC+0000 A0003207.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-020000000000
Birth Volume ID: 00240200-0000-0000-0024-020000000000
Birth Object ID: 312392ba-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d49c00
Attribute: File
Record Number: 15739
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:16 UTC+0000 2020-02-03 23:22:31 UTC+0000 2020-02-03 23:20:00 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:54:45 UTC+0000 2004-08-03 15:55:16 UTC+0000 2020-02-03 02:54:45 UTC+0000 2020-02-03 02:54:45 UTC+0000 WINDOWS\system32\kerberos.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-040000000000
Birth Volume ID: 007e0400-0000-0000-007e-040000000000
Birth Object ID: 3148caba-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4a000
Attribute: File
Record Number: 15788
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:48 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 02:54:47 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:48 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 02:54:47 UTC+0000 A0003260.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-010000000000
Birth Volume ID: 00c00100-0000-0000-00c0-010000000000
Birth Object ID: 311cc2c6-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4a400
Attribute: File
Record Number: 15789
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:49:48 UTC+0000 2020-02-03 23:30:05 UTC+0000 2020-02-03 02:54:47 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2020-02-03 02:54:47 UTC+0000 2020-02-03 02:54:47 UTC+0000 2020-02-03 02:54:47 UTC+0000 WINDOWS\system32\ieuinit.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: 94b20000-0000-0000-94b2-000000000000
Birth Object ID: 310ceac6-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4a800
Attribute: File
Record Number: 15790
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:14 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 02:54:47 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:14 UTC+0000 2020-02-03 23:22:34 UTC+0000 2020-02-03 02:54:47 UTC+0000 A0003261.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-010000000000
Birth Volume ID: 00f40000-0000-0000-00f4-000000000000
Birth Object ID: 3110fac6-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4ac00
Attribute: File
Record Number: 15791
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:14 UTC+0000 2020-02-03 23:22:35 UTC+0000 2020-02-03 02:54:47 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:14 UTC+0000 2020-02-03 23:22:35 UTC+0000 2020-02-03 02:54:47 UTC+0000 A0003262.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: 00ba0000-0000-0000-00ba-000000000000
Birth Object ID: 310c12c7-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4b000
Attribute: File
Record Number: 16088
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:01 UTC+0000 2004-08-03 15:49:54 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 23:59:01 UTC+0000 2004-08-03 15:49:54 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:02 UTC+0000 A0003524.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: b4b00000-0000-0000-b4b0-000000000000
Birth Object ID: 310c98f0-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4b400
Attribute: In Use & File
Record Number: 16089
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:01:59 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:02 UTC+0000 2004-07-17 02:38:34 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 02:55:02 UTC+0000 WINDOWS\system32\oobe\oobeutil.js
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: b9250000-0000-0000-b925-000000000000
Birth Object ID: 2103d72c-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4b800
Attribute: In Use & File
Record Number: 16090
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:00 UTC+0000 2004-07-17 02:38:34 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 02:55:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:02 UTC+0000 2004-07-17 02:38:34 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 02:55:02 UTC+0000 WINDOWS\system32\oobe\obeip.dun
$DATA
0000000000: 5b 50 68 6f 6e 65 5d 0d 0a 44 69 61 6c 5f 41 73 [Phone]..Dial_As
0000000010: 5f 49 73 3d 4e 4f 0d 0a 43 6f 75 6e 74 72 79 5f _Is=NO..Country_
0000000020: 49 44 3d 31 0d 0a 41 72 65 61 5f 43 6f 64 65 3d ID=1..Area_Code=
0000000030: 34 32 35 0d 0a 0d 0a 5b 45 6e 74 72 79 5d 0d 0a 425....[Entry]..
0000000040: 45 6e 74 72 79 5f 4e 61 6d 65 3d 83 82 83 66 83 Entry_Name=...f.
0000000050: 80 20 83 5f 83 43 83 84 83 8b 83 41 83 62 83 76 ..._.C.....A.b.v
0000000060: 0d 0a 0d 0a 5b 53 65 72 76 65 72 5d 0d 0a 54 79 ....[Server]..Ty
0000000070: 70 65 3d 50 50 50 0d 0a 53 57 5f 43 6f 6d 70 72 pe=PPP..SW_Compr
0000000080: 65 73 73 3d 59 45 53 0d 0a 4e 65 67 6f 74 69 61 ess=YES..Negotia
0000000090: 74 65 5f 54 43 50 2f 49 50 3d 59 45 53 0d 0a 44 te_TCP/IP=YES..D
00000000a0: 69 73 61 62 6c 65 5f 4c 43 50 3d 79 65 73 0d 0a isable_LCP=yes..
00000000b0: 0d 0a 5b 54 43 50 2f 49 50 5d 0d 0a 53 70 65 63 ..[TCP/IP]..Spec
00000000c0: 69 66 79 5f 49 50 5f 41 64 64 72 65 73 73 3d 4e ify_IP_Address=N
00000000d0: 4f 0d 0a 53 70 65 63 69 66 79 5f 53 65 72 76 65 O..Specify_Serve
00000000e0: 72 5f 41 64 64 72 65 73 73 3d 4e 4f 0d 0a 49 50 r_Address=NO..IP
00000000f0: 5f 48 65 61 64 65 72 5f 43 6f 6d 70 72 65 73 73 _Header_Compress
0000000100: 3d 59 45 53 0d 0a 47 61 74 65 77 61 79 5f 4f 6e =YES..Gateway_On
0000000110: 5f 52 65 6d 6f 74 65 3d 59 45 53 0d 0a 0d 0a 5b _Remote=YES....[
0000000120: 55 73 65 72 5d 0d 0a 4e 61 6d 65 3d 57 69 6e 64 User]..Name=Wind
0000000130: 6f 77 73 53 50 32 40 67 6e 2e 6d 69 63 72 6f 73 owsSP2@gn.micros
0000000140: 6f 66 74 2e 63 6f 6d 0d 0a 50 61 73 73 77 6f 72 oft.com..Passwor
0000000150: 64 3d 48 30 67 52 75 21 7a 0d 0a 0d 0a 5b 55 73 d=H0gRu!z....[Us
0000000160: 65 72 31 5d 0d 0a 4e 61 6d 65 3d 57 69 6e 64 6f er1]..Name=Windo
0000000170: 77 73 53 50 32 61 40 67 6e 2e 6d 69 63 72 6f 73 wsSP2a@gn.micros
0000000180: 6f 66 74 2e 63 6f 6d 0d 0a 50 61 73 73 77 6f 72 oft.com..Passwor
0000000190: 64 3d 48 30 67 52 75 21 7a 0d 0a d=H0gRu!z..
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4bc00
Attribute: File
Record Number: 16091
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:07 UTC+0000 2004-08-03 15:55:22 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 00:02:07 UTC+0000 2004-08-03 15:55:22 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:02 UTC+0000 A0003528.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004a0000-0000-0000-004a-000000000000
Birth Object ID: 31052443-0a00-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4c000
Attribute: In Use & File
Record Number: 16092
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:59 UTC+0000 2004-07-17 13:55:50 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 23:27:39 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:02 UTC+0000 2004-07-17 13:55:50 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 02:55:02 UTC+0000 WINDOWS\system32\oobe\msobshel.htm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-020000000000
Birth Volume ID: 37a60200-0000-0000-37a6-020000000000
Birth Object ID: 312bf3ac-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4c400
Attribute: File
Record Number: 16093
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:04 UTC+0000 2004-08-03 15:55:20 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:20:09 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 23:59:04 UTC+0000 2004-08-03 15:55:20 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:20:09 UTC+0000 A0003530.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-080000000000
Birth Volume ID: 00900800-0000-0000-0090-080000000000
Birth Object ID: 328900fa-f00b-00f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4c800
Attribute: In Use & File
Record Number: 16094
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:02:04 UTC+0000 2004-07-17 02:44:52 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 02:55:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:02 UTC+0000 2004-07-17 02:44:52 UTC+0000 2020-02-03 02:55:02 UTC+0000 2020-02-03 02:55:02 UTC+0000 WINDOWS\system32\oobe\msobe.isp
$DATA
0000000000: 5b 49 53 50 20 49 4e 46 4f 5d 0d 0a 50 68 6f 6e [ISP.INFO]..Phon
0000000010: 65 42 6f 6f 6b 46 69 6c 65 20 3d 20 50 48 4f 4e eBookFile.=.PHON
0000000020: 45 2e 6f 62 65 0d 0a 44 55 4e 46 69 6c 65 20 3d E.obe..DUNFile.=
0000000030: 20 6f 62 65 69 70 2e 64 75 6e 0d 0a 0d 0a 5b 55 .obeip.dun....[U
0000000040: 52 4c 5d 0d 0a 53 69 67 6e 75 70 3d 68 74 74 70 RL]..Signup=http
0000000050: 73 3a 2f 2f 49 63 65 72 65 67 32 2e 6d 73 6e 2e s://Icereg2.msn.
0000000060: 63 6f 6d 2f 6f 66 66 65 72 73 74 2f 64 65 66 61 com/offerst/defa
0000000070: 75 6c 74 32 2e 61 73 70 3f 43 61 6d 70 61 69 67 ult2.asp?Campaig
0000000080: 6e 3d 57 49 4e 58 50 53 50 32 26 52 75 6e 4f 6e n=WINXPSP2&RunOn
0000000090: 63 65 3d 30 26 0d 0a 52 65 63 6f 6e 6e 65 63 74 ce=0&..Reconnect
00000000a0: 3d 68 74 74 70 73 3a 2f 2f 49 63 65 72 65 67 32 =https://Icereg2
00000000b0: 2e 6d 73 6e 2e 63 6f 6d 2f 6f 66 66 65 72 73 74 .msn.com/offerst
00000000c0: 2f 64 65 66 61 75 6c 74 32 2e 61 73 70 3f 43 61 /default2.asp?Ca
00000000d0: 6d 70 61 69 67 6e 3d 57 49 4e 58 50 53 50 32 26 mpaign=WINXPSP2&
00000000e0: 52 75 6e 4f 6e 63 65 3d 30 26 0d 0a 0d 0a 5b 43 RunOnce=0&....[C
00000000f0: 6f 6e 6e 65 63 74 69 6f 6e 5d 0d 0a 53 74 61 79 onnection]..Stay
0000000100: 43 6f 6e 6e 65 63 74 65 64 20 3d 20 31 Connected.=.1
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4cc00
Attribute: File
Record Number: 16095
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:03 UTC+0000 2004-08-03 15:55:20 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:02 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 23:59:03 UTC+0000 2004-08-03 15:55:20 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:02 UTC+0000 A0003532.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-010000000000
Birth Volume ID: 00da0100-0000-0000-00da-010000000000
Birth Object ID: 311efaf1-0b00-a6f8-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4d000
Attribute: In Use & File
Record Number: 16096
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:01:55 UTC+0000 2008-02-29 23:45:52 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:27:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:51 UTC+0000 2008-02-29 23:45:52 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:22:51 UTC+0000 WINDOWS\system32\oobe\error.js
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4d400
Attribute: File
Record Number: 16097
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:28 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:03 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:28 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:03 UTC+0000 A0003534.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4d800
Attribute: File
Record Number: 16098
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:58 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:03 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:58 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 02:55:03 UTC+0000 A0003535.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-020000000000
Birth Volume ID: 001a0200-0000-0000-001a-020000000000
Birth Object ID: 3122b785-0b00-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4dc00
Attribute: File
Record Number: 16099
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:52:43 UTC+0000 2004-08-03 15:55:54 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:09:05 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 22:52:43 UTC+0000 2004-08-03 15:55:54 UTC+0000 2020-02-03 23:22:51 UTC+0000 2020-02-03 23:09:05 UTC+0000 A0003536.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4e000
Attribute: In Use & File
Record Number: 16144
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 16:10:02 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 WINDOWS\inf\fxsocm.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-010000000000
Birth Volume ID: 6c890100-0000-0000-6c89-010000000000
Birth Object ID: 310c4c4c-0a31-0c62-1501-2101acfa00f8
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4e400
Attribute: File
Record Number: 16145
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2008-04-13 12:40:56 UTC+0000 2008-04-13 12:40:56 UTC+0000 2020-02-03 23:16:15 UTC+0000 2008-04-13 12:40:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:15 UTC+0000 2020-02-03 23:16:15 UTC+0000 2020-02-03 23:16:15 UTC+0000 2020-02-03 23:16:15 UTC+0000 MSCORR~3.DLL
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:15 UTC+0000 2020-02-03 23:16:15 UTC+0000 2020-02-03 23:16:15 UTC+0000 2020-02-03 23:16:15 UTC+0000 mscorrc.es.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-020000000000
Birth Volume ID: 00a00200-0000-0000-00a0-020000000000
Birth Object ID: 312a3ac9-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4e800
Attribute: File
Record Number: 16146
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:49:50 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 02:55:03 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:49:50 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 02:55:03 UTC+0000 A0003543.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 863d0000-0000-0000-863d-000000000000
Birth Object ID: 31040e59-0a00-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4ec00
Attribute: In Use & File
Record Number: 16147
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 02:39:26 UTC+0000 2020-02-03 02:59:04 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:03 UTC+0000 2004-07-17 02:39:26 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 WINDOWS\Fonts\timesbd.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-060000000000
Birth Volume ID: 24140600-0000-0000-2414-060000000000
Birth Object ID: 316256a7-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4f000
Attribute: In Use & File
Record Number: 16148
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 02:39:26 UTC+0000 2020-02-03 02:59:04 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:03 UTC+0000 2004-07-17 02:39:26 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 WINDOWS\Fonts\times.ttf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4f400
Attribute: File
Record Number: 16149
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 13:55:00 UTC+0000 2020-02-03 23:22:53 UTC+0000 2020-02-03 23:20:10 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:03 UTC+0000 2004-07-17 13:55:00 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 WINDOWS\Fonts\tahomabd.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-050000000000
Birth Volume ID: 6c6c0500-0000-0000-6c6c-050000000000
Birth Object ID: 210ce02e-310d-e72c-0b21-24742f211a1f
Birth Domain ID: da000000-0000-0000-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4f800
Attribute: File
Record Number: 16150
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 13:55:00 UTC+0000 2020-02-03 23:22:53 UTC+0000 2020-02-03 23:20:10 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:03 UTC+0000 2004-07-17 13:55:00 UTC+0000 2020-02-03 02:55:03 UTC+0000 2020-02-03 02:55:03 UTC+0000 WINDOWS\Fonts\tahoma.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-050000000000
Birth Volume ID: a4d80500-0000-0000-a4d8-050000000000
Birth Object ID: 310d9565-0b21-0e93-f621-250f3a211eec
Birth Domain ID: 01000000-0000-0000-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d4fc00
Attribute: File
Record Number: 16151
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 13:55:00 UTC+0000 2020-02-03 23:22:54 UTC+0000 2020-02-03 23:20:11 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:03 UTC+0000 2004-07-17 13:55:00 UTC+0000 2020-02-03 02:55:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 WINDOWS\Fonts\micross.ttf
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d50000
Attribute: In Use & File
Record Number: 16152
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 02:39:12 UTC+0000 2020-02-03 02:59:04 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:04 UTC+0000 2004-07-17 02:39:12 UTC+0000 2020-02-03 02:55:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 WINDOWS\Fonts\comic.ttf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d50400
Attribute: In Use & File
Record Number: 16153
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 02:39:04 UTC+0000 2020-02-03 02:59:04 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:04 UTC+0000 2004-07-17 02:39:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 WINDOWS\Fonts\arialbd.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-050000000000
Birth Volume ID: e05f0500-0000-0000-e05f-050000000000
Birth Object ID: 31566486-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d50800
Attribute: In Use & File
Record Number: 16154
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-07-17 02:39:04 UTC+0000 2020-02-03 02:59:04 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:04 UTC+0000 2004-07-17 02:39:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 WINDOWS\Fonts\arial.ttf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d50c00
Attribute: In Use & File
Record Number: 16155
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:59:48 UTC+0000 2004-07-17 02:32:22 UTC+0000 2020-02-03 02:59:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:55:04 UTC+0000 2004-07-17 02:32:22 UTC+0000 2020-02-03 02:55:04 UTC+0000 2020-02-03 02:55:04 UTC+0000 Program Files\Common Files\System\Ole DB\sqlxmlx.rll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 00700000-0000-0000-0070-000000000000
Birth Object ID: 31075afa-0900-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d51000
Attribute: In Use & File
Record Number: 16488
Link count: 0
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-010000000000
Birth Volume ID: 00100100-0000-0000-0004-000000000000
Birth Object ID: 31145bd8-0100-0000-ffff-ffff00000000
Birth Domain ID: ffffffff-0000-0000-ffff-ffff00000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d51400
Attribute: File
Record Number: 16489
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2008-04-14 00:20:40 UTC+0000 2008-04-14 00:20:40 UTC+0000 2020-02-03 23:16:19 UTC+0000 2008-04-14 00:20:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 win51ip.SP3
$DATA
0000000000: 0d 0a ..
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d51800
Attribute: File
Record Number: 16490
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-02-21 01:36:36 UTC+0000 2007-02-21 01:36:36 UTC+0000 2020-02-03 23:16:19 UTC+0000 2007-02-21 01:36:36 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 setupxp.htm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-010000000000
Birth Volume ID: 005a0100-0000-0000-005a-010000000000
Birth Object ID: 3116c8d9-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d51c00
Attribute: File
Record Number: 16491
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-12-17 08:29:56 UTC+0000 2007-12-17 08:29:56 UTC+0000 2020-02-03 23:16:19 UTC+0000 2007-12-17 08:29:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 setregni.exe
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d52000
Attribute: In Use & File
Record Number: 16492
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:30 UTC+0000 2020-02-03 23:28:12 UTC+0000 2020-02-03 23:28:12 UTC+0000 2020-02-03 23:28:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 WINDOWS\WMSysPr9.prx
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-040000000000
Birth Volume ID: e0d40400-0000-0000-e0d4-040000000000
Birth Object ID: 314e42c7-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d52400
Attribute: In Use & Directory
Record Number: 16493
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2020-02-03 23:28:01 UTC+0000 2020-02-03 23:28:01 UTC+0000 2020-02-04 13:20:56 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\SAMPLE~2
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d52800
Attribute: File
Record Number: 16494
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2008-04-13 15:02:16 UTC+0000 2008-04-13 15:02:16 UTC+0000 2020-02-03 23:16:19 UTC+0000 2008-04-13 15:02:16 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 setupldr.bin
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-040000000000
Birth Volume ID: c0f80300-0000-0000-c0f8-030000000000
Birth Object ID: 3140efd9-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d52c00
Attribute: Directory
Record Number: 16495
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:26:54 UTC+0000 2020-02-03 23:26:54 UTC+0000 2020-02-03 23:26:54 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 setuptxt
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d53000
Attribute: File
Record Number: 16500
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-06-27 09:27:50 UTC+0000 2007-06-27 09:27:50 UTC+0000 2020-02-03 23:16:19 UTC+0000 2007-06-27 09:27:50 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 smartnav.htm
$DATA
0000000000: 3c 68 74 6d 6c 3e 0d 0a 3c 2f 68 74 6d 6c 3e <html>..</html>
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d53400
Attribute: File
Record Number: 16501
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-06-27 09:27:50 UTC+0000 2007-06-27 09:27:50 UTC+0000 2020-02-03 23:16:19 UTC+0000 2007-06-27 09:27:50 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 smartnav.js
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 18220000-0000-0000-1822-000000000000
Birth Object ID: 31033cda-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d53800
Attribute: In Use & Directory
Record Number: 16502
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 23:30:32 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 Documents and Settings\testuser\Local Settings\Application Data\Microsoft\WINDOW~1
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows Media
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d53c00
Attribute: In Use & Directory
Record Number: 16503
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 23:30:32 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows Media\9.0
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d54000
Attribute: In Use & File
Record Number: 16504
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:30 UTC+0000 2020-02-03 23:27:59 UTC+0000 2020-02-03 23:27:59 UTC+0000 2020-02-03 23:27:59 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: f0310000-0000-0000-f031-000000000000
Birth Object ID: 2104d243-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d54400
Attribute: In Use & File
Record Number: 16505
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:30 UTC+0000 2020-02-03 23:27:59 UTC+0000 2020-02-03 23:27:59 UTC+0000 2020-02-03 23:27:59 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 2020-02-03 02:57:30 UTC+0000 Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD
$DATA
0000000000: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 <?xml.version="1
0000000010: 2e 30 22 20 73 74 61 6e 64 61 6c 6f 6e 65 3d 22 .0".standalone="
0000000020: 79 65 73 22 3f 3e 0d 0a 3c 21 44 4f 43 54 59 50 yes"?>..<!DOCTYP
0000000030: 45 20 64 6f 63 75 6d 65 6e 74 20 5b 0d 0a 3c 21 E.document.[..<!
0000000040: 45 4c 45 4d 45 4e 54 20 64 6f 63 75 6d 65 6e 74 ELEMENT.document
0000000050: 20 28 6e 6f 64 65 2a 29 3e 0d 0a 20 20 20 20 3c .(node*)>......<
0000000060: 21 41 54 54 4c 49 53 54 20 64 6f 63 75 6d 65 6e !ATTLIST.documen
0000000070: 74 20 57 4d 53 4e 61 6d 65 53 70 61 63 65 56 65 t.WMSNameSpaceVe
0000000080: 72 73 69 6f 6e 20 43 44 41 54 41 20 22 32 2e 30 rsion.CDATA."2.0
0000000090: 22 3e 0d 0a 0d 0a 3c 21 45 4c 45 4d 45 4e 54 20 ">....<!ELEMENT.
00000000a0: 6e 6f 64 65 20 28 6e 6f 64 65 2a 29 3e 0d 0a 20 node.(node*)>...
00000000b0: 20 20 20 3c 21 41 54 54 4c 49 53 54 20 6e 6f 64 ...<!ATTLIST.nod
00000000c0: 65 20 6e 61 6d 65 20 43 44 41 54 41 20 23 52 45 e.name.CDATA.#RE
00000000d0: 51 55 49 52 45 44 3e 0d 0a 20 20 20 20 3c 21 41 QUIRED>......<!A
00000000e0: 54 54 4c 49 53 54 20 6e 6f 64 65 20 6f 70 63 6f TTLIST.node.opco
00000000f0: 64 65 20 28 20 63 72 65 61 74 65 20 7c 20 72 65 de.(.create.|.re
0000000100: 6d 6f 76 65 20 7c 20 73 65 74 76 61 6c 20 7c 20 move.|.setval.|.
0000000110: 63 6c 65 61 72 76 61 6c 20 7c 20 72 65 6e 61 6d clearval.|.renam
0000000120: 65 20 7c 20 6d 6f 76 65 62 65 66 6f 72 65 20 29 e.|.movebefore.)
0000000130: 20 23 52 45 51 55 49 52 45 44 3e 0d 0a 20 20 20 .#REQUIRED>.....
0000000140: 20 3c 21 41 54 54 4c 49 53 54 20 6e 6f 64 65 20 .<!ATTLIST.node.
0000000150: 73 65 63 75 72 65 20 28 20 74 72 75 65 20 7c 20 secure.(.true.|.
0000000160: 66 61 6c 73 65 20 29 20 23 49 4d 50 4c 49 45 44 false.).#IMPLIED
0000000170: 3e 0d 0a 20 20 20 20 3c 21 41 54 54 4c 49 53 54 >......<!ATTLIST
0000000180: 20 6e 6f 64 65 20 74 79 70 65 20 28 20 73 74 72 .node.type.(.str
0000000190: 69 6e 67 20 7c 20 62 6f 6f 6c 65 61 6e 20 7c 20 ing.|.boolean.|.
00000001a0: 69 6e 74 33 32 20 7c 20 62 69 6e 61 72 79 20 7c int32.|.binary.|
00000001b0: 20 69 6e 74 36 34 20 29 20 23 49 4d 50 4c 49 45 .int64.).#IMPLIE
00000001c0: 44 3e 0d 0a 20 20 20 20 3c 21 41 54 54 4c 49 53 D>......<!ATTLIS
00000001d0: 54 20 6e 6f 64 65 20 76 61 6c 75 65 20 43 44 41 T.node.value.CDA
00000001e0: 54 41 20 23 49 4d 50 4c 49 45 44 3e 0d 0a 5d 3e TA.#IMPLIED>..]>
00000001f0: 0d 0a ..
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d54800
Attribute: In Use & File
Record Number: 16506
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 009B44~1.QUE
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 0000025c.query
$DATA
0000000000: 51 52 42 02 01 00 00 00 38 00 00 00 55 00 6e 00 QRB.....8...U.n.
0000000010: 6d 00 61 00 70 00 70 00 65 00 64 00 2f 00 4e 00 m.a.p.p.e.d./.N.
0000000020: 65 00 74 00 77 00 6f 00 72 00 6b 00 5f 00 43 00 e.t.w.o.r.k._.C.
0000000030: 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 o.n.n.e.c.t.i.o.
0000000040: 6e 00 73 00 2e 00 00 00 50 00 68 00 6f 00 6e 00 n.s.....P.h.o.n.
0000000050: 65 00 5f 00 61 00 6e 00 64 00 5f 00 6d 00 6f 00 e._.a.n.d._.m.o.
0000000060: 64 00 65 00 6d 00 5f 00 6f 00 70 00 74 00 69 00 d.e.m._.o.p.t.i.
0000000070: 6f 00 6e 00 73 00 00 00 00 00 00 00 00 00 18 00 o.n.s...........
0000000080: 00 00 fb 96 71 8a 68 30 e2 30 c7 30 e0 30 6e 30 ....q.h0.0.0.0n0
0000000090: aa 30 d7 30 b7 30 e7 30 f3 30 00 00 00 00 00 00 .0.0.0.0.0......
00000000a0: 00 00 0a 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d54c00
Attribute: File
Record Number: 16507
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-06-27 09:27:54 UTC+0000 2007-06-27 09:27:54 UTC+0000 2020-02-03 23:16:19 UTC+0000 2007-06-27 09:27:54 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 SMARTN~1.JS
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 2020-02-03 23:16:19 UTC+0000 smartnavie5.js
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d55000
Attribute: In Use & File
Record Number: 16508
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 009B40~2.QUE
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 2020-02-03 02:58:01 UTC+0000 0000025e.query
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d55400
Attribute: In Use & File
Record Number: 16509
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists\000ED00D\Plylst10.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 2a030000-0000-0000-2a03-000000000000
Birth Object ID: 2101212d-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d55800
Attribute: In Use & Directory
Record Number: 16510
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 23:30:32 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists\000ED00D
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d55c00
Attribute: In Use & File
Record Number: 16511
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists\000ED00D\Plylst1.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: eb040000-0000-0000-eb04-000000000000
Birth Object ID: 2101122d-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d56000
Attribute: In Use & File
Record Number: 16600
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:58:03 UTC+0000 2020-02-03 23:26:22 UTC+0000 2020-02-03 23:26:22 UTC+0000 2020-02-03 23:28:09 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\システム ツール\セキュ~1.LNK
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\システム ツール\セキュリティ センター.lnk
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 03060000-0000-0000-0306-000000000000
Birth Object ID: 31014cec-0100-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d56400
Attribute: In Use & File
Record Number: 16601
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:58:03 UTC+0000 2020-02-03 23:26:22 UTC+0000 2020-02-03 23:26:22 UTC+0000 2020-02-03 23:28:09 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\通信\ワイヤ~1.LNK
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 2020-02-03 02:58:03 UTC+0000 Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\通信\ワイヤレス ネットワーク セットアップ ウィザード.lnk
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 78060000-0000-0000-7806-000000000000
Birth Object ID: 3101b360-0200-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d56800
Attribute: File
Record Number: 16602
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-08-10 11:50:56 UTC+0000 2007-08-10 11:50:56 UTC+0000 2020-02-03 23:16:21 UTC+0000 2007-08-10 11:50:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:21 UTC+0000 2020-02-03 23:16:21 UTC+0000 2020-02-03 23:16:21 UTC+0000 2020-02-03 23:16:21 UTC+0000 sprecovr.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 78830000-0000-0000-7883-000000000000
Birth Object ID: 3109f3da-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d56c00
Attribute: File
Record Number: 16603
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2007-08-10 11:50:56 UTC+0000 2007-08-10 11:50:56 UTC+0000 2020-02-03 23:16:21 UTC+0000 2007-08-10 11:50:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:16:21 UTC+0000 2020-02-03 23:16:21 UTC+0000 2020-02-03 23:16:21 UTC+0000 2020-02-03 23:16:21 UTC+0000 spuninst.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-030000000000
Birth Volume ID: 78790300-0000-0000-7879-030000000000
Birth Object ID: 3138fcda-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d57000
Attribute: File
Record Number: 16764
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:49:53 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 22:49:53 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 WINDOWS\system32\CatRoot2\edb00035.log
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-020000000000
Birth Volume ID: 00000200-0000-0000-0000-020000000000
Birth Object ID: 31202703-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d57400
Attribute: File
Record Number: 16765
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:49:53 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 22:49:53 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:35 UTC+0000 WINDOWS\system32\CatRoot2\edb00036.log
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-020000000000
Birth Volume ID: 00000200-0000-0000-0000-020000000000
Birth Object ID: 31204f0b-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d57800
Attribute: In Use & File
Record Number: 16766
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 23:21:34 UTC+0000 2008-04-14 00:09:42 UTC+0000 2020-02-03 23:21:34 UTC+0000 2020-02-03 23:21:34 UTC+0000 System
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:34 UTC+0000 2020-02-03 23:21:34 UTC+0000 2020-02-03 23:21:34 UTC+0000 2020-02-03 23:21:34 UTC+0000 WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\sp3.cat
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-130000000000
Birth Volume ID: 42071300-0000-0000-4207-130000000000
Birth Object ID: 3231012b-fe00-0000-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d57c00
Attribute: File
Record Number: 16767
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 23:21:34 UTC+0000 2008-04-14 00:03:02 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:34 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:34 UTC+0000 2008-04-14 00:03:02 UTC+0000 2020-02-03 23:21:35 UTC+0000 2020-02-03 23:21:34 UTC+0000 A0002445.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-020000000000
Birth Volume ID: 449e0200-0000-0000-449e-020000000000
Birth Object ID: 310837c1-0021-1004-0331-12615d0900e1
Birth Domain ID: ffffffff-8279-4711-1001-5f0030003000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d58000
Attribute: In Use & File
Record Number: 17936
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:57:19 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:50 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 Program Files\Common Files\System\msadc\msadce.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d58400
Attribute: In Use & File
Record Number: 17937
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:50 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 WINDOWS\system32\zipfldr.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-050000000000
Birth Volume ID: 00120500-0000-0000-0012-050000000000
Birth Object ID: 3152f6da-0b00-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d58800
Attribute: In Use & File
Record Number: 17938
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:31 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:50 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 WINDOWS\system32\xolehlp.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 002e0000-0000-0000-002e-000000000000
Birth Object ID: 21036547-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d58c00
Attribute: In Use & File
Record Number: 17939
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:50 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:21:50 UTC+0000 2020-02-03 23:21:50 UTC+0000 WINDOWS\system32\xcopy.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00780000-0000-0000-0078-000000000000
Birth Object ID: 3108492f-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d59000
Attribute: File
Record Number: 18012
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:30 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:08:56 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 A0002787.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 00800000-0000-0000-0080-000000000000
Birth Object ID: 310835bf-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d59400
Attribute: File
Record Number: 18013
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:30:06 UTC+0000 2020-02-03 23:29:51 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:55 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 WINDOWS\system32\wininet.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d59800
Attribute: File
Record Number: 18014
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:30 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:19:48 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 A0002788.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-090000000000
Birth Volume ID: 00de0900-0000-0000-00de-090000000000
Birth Object ID: 329e0023-220a-0000-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d59c00
Attribute: In Use & File
Record Number: 18015
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:54:21 UTC+0000 2008-04-13 22:55:36 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:55 UTC+0000 2008-04-13 22:55:36 UTC+0000 2020-02-03 23:21:55 UTC+0000 2020-02-03 23:21:55 UTC+0000 WINDOWS\system32\winime.ime
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-010000000000
Birth Volume ID: 00000100-0000-0000-0000-010000000000
Birth Object ID: 311070c9-0a00-01dc-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5a000
Attribute: File
Record Number: 18028
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:30 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:08:56 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:56 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:21:56 UTC+0000 A0002801.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5a400
Attribute: File
Record Number: 18029
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:30:06 UTC+0000 2020-02-03 23:29:51 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:56 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:21:57 UTC+0000 2020-02-03 23:21:56 UTC+0000 WINDOWS\system32\webcheck.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-040000000000
Birth Volume ID: 00260400-0000-0000-0026-040000000000
Birth Object ID: 311583cb-0a21-035d-1131-28cc39ff2103
Birth Domain ID: 3a7d00f8-0768-90f9-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5a800
Attribute: File
Record Number: 18030
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:30 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:19:49 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:56 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:21:56 UTC+0000 2020-02-03 23:21:56 UTC+0000 A0002802.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-040000000000
Birth Volume ID: 00260400-0000-0000-0026-040000000000
Birth Object ID: 31432a8a-0e00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5ac00
Attribute: In Use & File
Record Number: 18031
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2001-08-24 12:40:28 UTC+0000 2008-04-13 22:56:36 UTC+0000 2020-02-03 23:21:57 UTC+0000 2020-02-03 23:21:57 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:57 UTC+0000 2008-04-13 22:56:36 UTC+0000 2020-02-03 23:21:57 UTC+0000 2020-02-03 23:21:57 UTC+0000 WINDOWS\system32\wdmaud.drv
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 005c0000-0000-0000-005c-000000000000
Birth Object ID: 31060fb6-0900-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5b000
Attribute: File
Record Number: 18060
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:28 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:17 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 A0002822.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-090000000000
Birth Volume ID: 001c0900-0000-0000-001c-090000000000
Birth Object ID: 32920026-5b0a-0000-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5b400
Attribute: File
Record Number: 18061
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:30:06 UTC+0000 2020-02-03 23:27:29 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:58 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 WINDOWS\system32\url.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-000000000000
Birth Volume ID: 00940000-0000-0000-0094-000000000000
Birth Object ID: 3108457e-0a21-022d-fb00-010000303be1
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5b800
Attribute: File
Record Number: 18062
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:28 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:08:38 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 A0002823.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-000000000000
Birth Volume ID: 00940000-0000-0000-0094-000000000000
Birth Object ID: 210a9476-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5bc00
Attribute: In Use & File
Record Number: 18063
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:32 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:58 UTC+0000 2008-04-13 22:56:32 UTC+0000 2020-02-03 23:21:58 UTC+0000 2020-02-03 23:21:58 UTC+0000 WINDOWS\system32\ups.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 00480000-0000-0000-0048-000000000000
Birth Object ID: 21054e66-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5c000
Attribute: File
Record Number: 18068
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:28 UTC+0000 2020-02-03 23:21:59 UTC+0000 2020-02-03 23:09:02 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:59 UTC+0000 2020-02-03 23:21:59 UTC+0000 2020-02-03 23:21:59 UTC+0000 2020-02-03 23:21:59 UTC+0000 A0002828.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5c400
Attribute: In Use & File
Record Number: 18069
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-04 13:51:57 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:59 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:21:59 UTC+0000 2020-02-03 23:21:59 UTC+0000 WINDOWS\system32\uniplat.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 00360000-0000-0000-0036-000000000000
Birth Object ID: 21045d2d-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5c800
Attribute: In Use & File
Record Number: 18070
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:21:59 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:59 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:21:59 UTC+0000 2020-02-03 23:21:59 UTC+0000 WINDOWS\system32\unimdmat.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5cc00
Attribute: In Use & File
Record Number: 18071
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:36 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-04 13:51:57 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:21:59 UTC+0000 2008-04-13 22:56:36 UTC+0000 2020-02-03 23:21:59 UTC+0000 2020-02-03 23:21:59 UTC+0000 WINDOWS\system32\unimdm.tsp
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-030000000000
Birth Volume ID: 00240300-0000-0000-0024-030000000000
Birth Object ID: 2133567c-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5d000
Attribute: In Use & File
Record Number: 18148
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:47:02 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:04 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 WINDOWS\system32\sndrec32.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5d400
Attribute: In Use & File
Record Number: 18149
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:04 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 WINDOWS\system32\smlogsvc.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5d800
Attribute: In Use & File
Record Number: 18150
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:04 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 WINDOWS\system32\smlogcfg.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-050000000000
Birth Volume ID: 00640500-0000-0000-0064-050000000000
Birth Object ID: 310a9e9a-0a21-0e69-cd21-26ebb5311961
Birth Domain ID: 990000f8-0768-90f9-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5dc00
Attribute: In Use & File
Record Number: 18151
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:04 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:04 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:04 UTC+0000 2020-02-03 23:22:04 UTC+0000 WINDOWS\system32\slbiop.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-010000000000
Birth Volume ID: 00800100-0000-0000-0080-010000000000
Birth Object ID: 310aaf8a-0b31-0e08-d3fe-00e10849d8f8
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5e000
Attribute: In Use & File
Record Number: 18160
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:05 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:05 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:05 UTC+0000 WINDOWS\system32\shscrap.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 00680000-0000-0000-0068-000000000000
Birth Object ID: 310704a6-0300-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5e400
Attribute: In Use & File
Record Number: 18161
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:05 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:05 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:05 UTC+0000 WINDOWS\system32\shrpubw.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-010000000000
Birth Volume ID: 002a0100-0000-0000-002a-010000000000
Birth Object ID: 310a1de3-0e21-09d0-f900-010000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5e800
Attribute: In Use & File
Record Number: 18162
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:28:06 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:05 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:05 UTC+0000 WINDOWS\system32\shmgrate.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5ec00
Attribute: File
Record Number: 18163
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:25:35 UTC+0000 2020-02-03 23:22:05 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:05 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:05 UTC+0000 2020-02-03 23:22:05 UTC+0000 WINDOWS\system32\shmedia.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-020000000000
Birth Volume ID: 00480200-0000-0000-0048-020000000000
Birth Object ID: 310b520d-0a21-0de6-0b31-0d64b70400e1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5f000
Attribute: In Use & File
Record Number: 18196
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:27:52 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 WINDOWS\system32\scrrun.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-020000000000
Birth Volume ID: 00a00200-0000-0000-00a0-020000000000
Birth Object ID: 312a6eb3-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5f400
Attribute: In Use & File
Record Number: 18197
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:28:10 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 WINDOWS\system32\scrobj.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-020000000000
Birth Volume ID: 00c00200-0000-0000-00c0-020000000000
Birth Object ID: 312ca7c5-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5f800
Attribute: In Use & File
Record Number: 18198
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2008-04-13 22:56:34 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 WINDOWS\system32\scrnsave.scr
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 00240000-0000-0000-0024-000000000000
Birth Object ID: 3103e5b8-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d5fc00
Attribute: In Use & File
Record Number: 18199
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-06 20:35:10 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:08 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:08 UTC+0000 2020-02-03 23:22:08 UTC+0000 WINDOWS\system32\sclgntfy.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004e0000-0000-0000-004e-000000000000
Birth Object ID: 31050a54-0700-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d60000
Attribute: In Use & File
Record Number: 18244
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:43:15 UTC+0000 2008-04-13 22:56:26 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:11 UTC+0000 2008-04-13 22:56:26 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 WINDOWS\system32\rdpclip.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0000-010000000000
Birth Volume ID: 00f60000-0000-0000-00f6-000000000000
Birth Object ID: 3110da40-0a00-b1cd-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d60400
Attribute: In Use & File
Record Number: 18245
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:43:19 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:11 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 WINDOWS\system32\rdchost.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-020000000000
Birth Volume ID: 00420200-0000-0000-0042-020000000000
Birth Object ID: 3116e24e-0a21-024a-0821-0d5a41003be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d60800
Attribute: In Use & File
Record Number: 18246
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:26 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:11 UTC+0000 2008-04-13 22:56:26 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 WINDOWS\system32\rcp.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 00540000-0000-0000-0054-000000000000
Birth Object ID: 310691c8-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d60c00
Attribute: In Use & File
Record Number: 18247
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:26 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:11 UTC+0000 2008-04-13 22:56:26 UTC+0000 2020-02-03 23:22:11 UTC+0000 2020-02-03 23:22:11 UTC+0000 WINDOWS\system32\rcimlby.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 008c0000-0000-0000-008c-000000000000
Birth Object ID: 3109a698-0a00-b1cd-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d61000
Attribute: In Use & File
Record Number: 18260
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:54:22 UTC+0000 2008-04-13 22:55:34 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:12 UTC+0000 2008-04-13 22:55:34 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 WINDOWS\system32\quick.ime
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d61400
Attribute: In Use & File
Record Number: 18261
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:12 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 WINDOWS\system32\query.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d61800
Attribute: In Use & File
Record Number: 18262
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:12 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 WINDOWS\system32\quartz.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-130000000000
Birth Volume ID: 007a1300-0000-0000-007a-130000000000
Birth Object ID: 323801f9-f400-0000-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d61c00
Attribute: In Use & File
Record Number: 18263
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:37 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:12 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:22:12 UTC+0000 2020-02-03 23:22:12 UTC+0000 WINDOWS\system32\qprocess.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 00580000-0000-0000-0058-000000000000
Birth Object ID: 310685c2-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d62000
Attribute: In Use & File
Record Number: 18304
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:14 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 WINDOWS\system32\osk.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-030000000000
Birth Volume ID: 00440300-0000-0000-0044-030000000000
Birth Object ID: 311635eb-0a21-023c-ff21-1d3f07003be1
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d62400
Attribute: In Use & File
Record Number: 18305
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:14 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 WINDOWS\system32\opengl32.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d62800
Attribute: In Use & File
Record Number: 18306
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:14 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 WINDOWS\system32\olepro32.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-010000000000
Birth Volume ID: 004c0100-0000-0000-004c-010000000000
Birth Object ID: 3115809d-0e00-b2cd-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d62c00
Attribute: In Use & File
Record Number: 18307
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:14 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:22:14 UTC+0000 2020-02-03 23:22:14 UTC+0000 WINDOWS\system32\oleprn.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-010000000000
Birth Volume ID: 00960100-0000-0000-0096-010000000000
Birth Object ID: 31161ab0-0e21-02e5-0721-025cfe003be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d63000
Attribute: In Use & File
Record Number: 18356
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:22 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:17 UTC+0000 2008-04-13 22:56:22 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 WINDOWS\system32\notepad.exe
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d63400
Attribute: In Use & File
Record Number: 18357
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:31 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:17 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 WINDOWS\system32\nmmkcert.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-000000000000
Birth Volume ID: 00700000-0000-0000-0070-000000000000
Birth Object ID: 31071a25-0600-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d63800
Attribute: In Use & File
Record Number: 18358
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:17 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 WINDOWS\system32\nlhtml.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-010000000000
Birth Volume ID: 00800100-0000-0000-0080-010000000000
Birth Object ID: 3110674b-0621-08d7-0400-3be10849d8f8
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d63c00
Attribute: In Use & File
Record Number: 18359
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:17 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:17 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:22:17 UTC+0000 2020-02-03 23:22:17 UTC+0000 WINDOWS\system32\newdev.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-030000000000
Birth Volume ID: 00b60300-0000-0000-00b6-030000000000
Birth Object ID: 313c41d6-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d64000
Attribute: In Use & File
Record Number: 18408
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:20 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 WINDOWS\system32\mswebdvd.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d64400
Attribute: In Use & File
Record Number: 18409
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-04-02 09:21:48 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:20 UTC+0000 2007-04-02 09:21:48 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 WINDOWS\system32\mswdat10.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00d0-0c0000000000
Birth Volume ID: 20cb0c00-0000-0000-20cb-0c0000000000
Birth Object ID: 31192ba0-0931-1f7b-1c01-314f47ce0331
Birth Domain ID: 464b6afc-0068-90f9-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d64800
Attribute: In Use & File
Record Number: 18410
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:20 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 WINDOWS\system32\msw3prt.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-010000000000
Birth Volume ID: 001a0100-0000-0000-001a-010000000000
Birth Object ID: 3112cf07-0a00-b3cd-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d64c00
Attribute: In Use & File
Record Number: 18411
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:20 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:20 UTC+0000 2020-02-03 23:22:20 UTC+0000 WINDOWS\system32\msvidctl.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d65000
Attribute: In Use & File
Record Number: 18444
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-03-28 09:22:34 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:22 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:22 UTC+0000 2007-03-28 09:22:34 UTC+0000 2020-02-03 23:22:22 UTC+0000 2020-02-03 23:22:22 UTC+0000 WINDOWS\system32\msorc32r.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 00500000-0000-0000-0050-000000000000
Birth Object ID: 3105c559-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d65400
Attribute: In Use & File
Record Number: 18445
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:17 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:22 UTC+0000 2020-02-03 23:22:22 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:22 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:22 UTC+0000 2020-02-03 23:22:22 UTC+0000 WINDOWS\system32\msoert2.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-010000000000
Birth Volume ID: 009e0100-0000-0000-009e-010000000000
Birth Object ID: 310997da-0e31-11e3-81fb-000000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d65800
Attribute: In Use & File
Record Number: 18446
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:16 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:23 UTC+0000 2020-02-03 23:22:22 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:22 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:22 UTC+0000 2020-02-03 23:22:22 UTC+0000 WINDOWS\system32\msoeacct.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d65c00
Attribute: In Use & File
Record Number: 18447
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:23 UTC+0000 2020-02-03 23:22:23 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:23 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:23 UTC+0000 2020-02-03 23:22:23 UTC+0000 WINDOWS\system32\msnsspc.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-040000000000
Birth Volume ID: 00700400-0000-0000-0070-040000000000
Birth Object ID: 3147abb0-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d66000
Attribute: File
Record Number: 18460
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:55:18 UTC+0000 2020-02-03 23:22:23 UTC+0000 2020-02-03 23:09:42 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:23 UTC+0000 2020-02-03 23:22:23 UTC+0000 2020-02-03 23:22:23 UTC+0000 2020-02-03 23:22:23 UTC+0000 A0003126.dll
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d66400
Attribute: In Use & File
Record Number: 18461
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:23 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:23 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:23 UTC+0000 WINDOWS\system32\msihnd.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-040000000000
Birth Volume ID: 00240400-0000-0000-0024-040000000000
Birth Object ID: 311bb29d-0331-1d20-1c07-310be147ff00
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d66800
Attribute: In Use & File
Record Number: 18462
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:20 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:24 UTC+0000 2008-04-13 22:56:20 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 WINDOWS\system32\msiexec.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-010000000000
Birth Volume ID: 00340100-0000-0000-0034-010000000000
Birth Object ID: 3114f9a7-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d66c00
Attribute: In Use & File
Record Number: 18463
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:24 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 WINDOWS\system32\msieftp.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-030000000000
Birth Volume ID: 00b80300-0000-0000-00b8-030000000000
Birth Object ID: 311b229f-0931-1d34-2c01-3104b17aff00
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d67000
Attribute: File
Record Number: 18468
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:25:42 UTC+0000 2020-02-03 23:30:06 UTC+0000 2020-02-03 23:22:24 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:24 UTC+0000 2008-04-13 22:25:42 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 WINDOWS\system32\mshtmler.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-000000000000
Birth Volume ID: 00de0000-0000-0000-00de-000000000000
Birth Object ID: 310e4c74-0e00-d0de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d67400
Attribute: File
Record Number: 18469
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:30:06 UTC+0000 2020-02-03 23:29:50 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:24 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 WINDOWS\system32\mshtmled.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-060000000000
Birth Volume ID: 00da0600-0000-0000-00da-060000000000
Birth Object ID: 31106977-0e21-143c-0121-15cdf8313505
Birth Domain ID: dffb00f8-0768-90f9-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d67800
Attribute: File
Record Number: 18470
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 12:56:28 UTC+0000 2020-02-03 23:30:06 UTC+0000 2020-02-03 23:29:50 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:24 UTC+0000 2008-04-13 12:56:28 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 WINDOWS\system32\mshtml.tlb
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-140000000000
Birth Volume ID: 009e1400-0000-0000-009e-140000000000
Birth Object ID: 3115b650-0a21-03d0-fe31-226d5cff3154
Birth Domain ID: 076f0132-bc00-42e5-0300-d8f83898d0de
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d67c00
Attribute: File
Record Number: 18471
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:30:05 UTC+0000 2020-02-03 23:29:50 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:24 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:24 UTC+0000 2020-02-03 23:22:24 UTC+0000 WINDOWS\system32\mshtml.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00d0-2e0000000000
Birth Volume ID: 00cc2e00-0000-0000-00cc-2e0000000000
Birth Object ID: 3116ee70-0e21-02c5-1031-252e39fb3154
Birth Domain ID: a0f30421-6f42-5832-dc01-de03f231116a
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d68000
Attribute: In Use & File
Record Number: 18480
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:34 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:25 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 WINDOWS\system32\msdtcuiu.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d68400
Attribute: In Use & File
Record Number: 18481
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:32 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:25 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 WINDOWS\system32\msdtctm.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-0e0000000000
Birth Volume ID: 009a0e00-0000-0000-009a-0e0000000000
Birth Object ID: 32ea00e6-0801-0000-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-ffff-ffff82794711
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d68800
Attribute: In Use & File
Record Number: 18482
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:43:12 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:25 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 WINDOWS\system32\msdtcprx.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d68c00
Attribute: In Use & File
Record Number: 18483
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:45:29 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:25 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:22:25 UTC+0000 2020-02-03 23:22:25 UTC+0000 WINDOWS\system32\msdtclog.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-000000000000
Birth Volume ID: 00e60000-0000-0000-00e6-000000000000
Birth Object ID: 310f6585-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d80000
Attribute: In Use & File
Record Number: 18664
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:54:02 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-11 12:21:31 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:36 UTC+0000 2008-04-13 22:54:02 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 WINDOWS\system32\framebuf.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 80240000-0000-0000-8024-000000000000
Birth Object ID: 2103f613-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d80400
Attribute: File
Record Number: 18665
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2004-08-03 15:53:00 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:08:40 UTC+0000 Archive & Content not indexed
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 A0003293.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 80240000-0000-0000-8024-000000000000
Birth Object ID: 3103f1bd-0300-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d80800
Attribute: In Use & File
Record Number: 18666
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:36 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 WINDOWS\system32\forcedos.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: 00260000-0000-0000-0026-000000000000
Birth Object ID: 31032ebe-0300-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d80c00
Attribute: In Use & File
Record Number: 18667
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:36 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:22:36 UTC+0000 2020-02-03 23:22:36 UTC+0000 WINDOWS\system32\fontview.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 00600000-0000-0000-0060-000000000000
Birth Object ID: 31065a15-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d81000
Attribute: In Use & File
Record Number: 18968
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-01-01 15:44:06 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:54 UTC+0000 2007-01-01 15:44:06 UTC+0000 2020-02-03 23:22:54 UTC+0000 2020-02-03 23:22:54 UTC+0000 WINDOWS\Fonts\impact.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-020000000000
Birth Volume ID: e8180200-0000-0000-e818-020000000000
Birth Object ID: 31226782-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d81400
Attribute: In Use & File
Record Number: 18969
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-01-01 15:28:56 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:54 UTC+0000 2007-01-01 15:28:56 UTC+0000 2020-02-03 23:22:54 UTC+0000 2020-02-03 23:22:54 UTC+0000 WINDOWS\Fonts\ariblk.ttf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-010000000000
Birth Volume ID: 30d00100-0000-0000-30d0-010000000000
Birth Object ID: 211e8f7e-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d81800
Attribute: In Use & File
Record Number: 18970
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:57:42 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:54 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:54 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:22:55 UTC+0000 2020-02-03 23:22:54 UTC+0000 Program Files\Common Files\System\Ole DB\sqlxmlx.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-030000000000
Birth Volume ID: 00500300-0000-0000-0050-030000000000
Birth Object ID: 311a67ad-0931-1ba1-9e05-000000303be1
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d81c00
Attribute: In Use & File
Record Number: 18971
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:57:41 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-03 23:22:55 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:55 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:22:55 UTC+0000 2020-02-03 23:22:55 UTC+0000 Program Files\Common Files\System\Ole DB\sqloledb.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d82000
Attribute: In Use & File
Record Number: 19024
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:42:58 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:56 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 WINDOWS\system32\wbem\wmipcima.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0070-020000000000
Birth Volume ID: 00640200-0000-0000-0064-020000000000
Birth Object ID: 31275d54-0f00-edd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d82400
Attribute: In Use & File
Record Number: 19025
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:42:57 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:56 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 WINDOWS\system32\wbem\wmidcprv.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-020000000000
Birth Volume ID: 00260200-0000-0000-0026-020000000000
Birth Object ID: 31239554-0f00-edd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d82800
Attribute: In Use & File
Record Number: 19026
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:42:57 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:56 UTC+0000 2008-04-13 22:56:04 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 WINDOWS\system32\wbem\wmicookr.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-000000000000
Birth Volume ID: 00ee0000-0000-0000-00ee-000000000000
Birth Object ID: 310fcd54-0f00-edd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d82c00
Attribute: In Use & File
Record Number: 19027
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:44:33 UTC+0000 2008-04-13 22:56:32 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:56 UTC+0000 2008-04-13 22:56:32 UTC+0000 2020-02-03 23:22:56 UTC+0000 2020-02-03 23:22:56 UTC+0000 WINDOWS\system32\wbem\wmiapsrv.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-010000000000
Birth Volume ID: 00ee0100-0000-0000-00ee-010000000000
Birth Object ID: 311f3cbf-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d83000
Attribute: In Use & File
Record Number: 19160
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:00:42 UTC+0000 2008-04-13 22:56:32 UTC+0000 2020-02-03 23:28:09 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:56:32 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\wab.exe
$OBJECT_ID
Object ID: a6da6b1f-2046-ea11-94d6-8061fa895cd2
Birth Volume ID: 80000000-4800-0000-0100-000000000300
Birth Object ID: 00000000-0000-0000-0b00-000000000000
Birth Domain ID: 40000000-0000-0000-00c0-000000000000
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: 00b40000-0000-0000-00b4-000000000000
Birth Object ID: 310c0b88-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d83400
Attribute: In Use & File
Record Number: 19161
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:09 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:28:05 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:56:28 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\setup50.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0020-010000000000
Birth Volume ID: 00180100-0000-0000-0018-010000000000
Birth Object ID: 31121d8d-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d83800
Attribute: In Use & File
Record Number: 19162
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:00:10 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\oemiglib.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 00880000-0000-0000-0088-000000000000
Birth Object ID: 3109296c-0f00-efd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d83c00
Attribute: In Use & File
Record Number: 19163
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:00:09 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:56:24 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\oemig50.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-000000000000
Birth Volume ID: 00e80000-0000-0000-00e8-000000000000
Birth Object ID: 310f336c-0f00-efd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d84000
Attribute: In Use & File
Record Number: 19164
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:00:15 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:55:58 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\oeimport.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-010000000000
Birth Volume ID: 00980100-0000-0000-0098-010000000000
Birth Object ID: 311a496c-0f00-efd4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d84400
Attribute: In Use & File
Record Number: 19165
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 00:00:12 UTC+0000 2008-04-13 22:31:02 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:31:02 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\msoeres.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-240000000000
Birth Volume ID: 00482400-0000-0000-0048-240000000000
Birth Object ID: 32450269-6c0f-00d4-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d84800
Attribute: In Use & File
Record Number: 19166
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:10 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:55:56 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\msoe.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d84c00
Attribute: In Use & File
Record Number: 19167
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:58:12 UTC+0000 2008-04-13 22:56:20 UTC+0000 2020-02-03 23:28:09 UTC+0000 2020-02-03 23:23:07 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:07 UTC+0000 2008-04-13 22:56:20 UTC+0000 2020-02-03 23:23:07 UTC+0000 2020-02-03 23:23:07 UTC+0000 Program Files\Outlook Express\msimn.exe
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d85000
Attribute: In Use & File
Record Number: 19256
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:23:11 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:11 UTC+0000 2008-04-13 22:56:06 UTC+0000 2020-02-03 23:23:11 UTC+0000 2020-02-03 23:23:11 UTC+0000 WINDOWS\msagent\agentsvr.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00f0-030000000000
Birth Volume ID: 00ea0300-0000-0000-00ea-030000000000
Birth Object ID: 313f07b6-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d85400
Attribute: In Use & File
Record Number: 19257
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:11 UTC+0000 2020-02-03 23:23:11 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:11 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:11 UTC+0000 2020-02-03 23:23:11 UTC+0000 WINDOWS\msagent\agentsr.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-000000000000
Birth Volume ID: 00ac0000-0000-0000-00ac-000000000000
Birth Object ID: 310b8c9a-0f00-d0de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d85800
Attribute: In Use & File
Record Number: 19258
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:11 UTC+0000 2020-02-03 23:23:11 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:11 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:11 UTC+0000 2020-02-03 23:23:11 UTC+0000 WINDOWS\msagent\agentpsh.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 005e0000-0000-0000-005e-000000000000
Birth Object ID: 31064550-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d85c00
Attribute: In Use & File
Record Number: 19259
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\agentmpx.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: 00c00000-0000-0000-00c0-000000000000
Birth Object ID: 210c3379-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d86000
Attribute: In Use & File
Record Number: 19260
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\agentdpv.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-000000000000
Birth Volume ID: 00e00000-0000-0000-00e0-000000000000
Birth Object ID: 210eb97d-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d86400
Attribute: In Use & File
Record Number: 19261
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\agentdp2.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-000000000000
Birth Volume ID: 00a60000-0000-0000-00a6-000000000000
Birth Object ID: 210b4b7d-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d86800
Attribute: In Use & File
Record Number: 19262
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:30:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\agentctl.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-030000000000
Birth Volume ID: 00440300-0000-0000-0044-030000000000
Birth Object ID: 3135b1b3-0000-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d86c00
Attribute: In Use & File
Record Number: 19263
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2008-04-13 22:55:48 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\agentanm.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 005e0000-0000-0000-005e-000000000000
Birth Object ID: 3106288f-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d87000
Attribute: In Use & File
Record Number: 19272
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\intl\agt0414.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004c0000-0000-0000-004c-000000000000
Birth Object ID: 3105266a-0e00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d87400
Attribute: In Use & File
Record Number: 19273
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\intl\agt0413.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0060-000000000000
Birth Volume ID: 00520000-0000-0000-0052-000000000000
Birth Object ID: 3106a296-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d87800
Attribute: In Use & File
Record Number: 19274
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:55:19 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\intl\agt0412.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004c0000-0000-0000-004c-000000000000
Birth Object ID: 3105776d-0e00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d87c00
Attribute: In Use & File
Record Number: 19275
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:54:42 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:27:41 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:12 UTC+0000 2007-04-02 14:56:02 UTC+0000 2020-02-03 23:23:12 UTC+0000 2020-02-03 23:23:12 UTC+0000 WINDOWS\msagent\intl\agt0411.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0050-000000000000
Birth Volume ID: 004c0000-0000-0000-004c-000000000000
Birth Object ID: 21050266-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d88000
Attribute: In Use & File
Record Number: 19316
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\tape.inf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d88400
Attribute: In Use & File
Record Number: 19317
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\swflash.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 900e0000-0000-0000-900e-000000000000
Birth Object ID: 21013f44-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d88800
Attribute: In Use & File
Record Number: 19318
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\streamip.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0030-000000000000
Birth Volume ID: fe2d0000-0000-0000-fe2d-000000000000
Birth Object ID: 310388ea-0600-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d88c00
Attribute: In Use & File
Record Number: 19319
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:52 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\smartcrd.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00c0-000000000000
Birth Volume ID: 34b90000-0000-0000-34b9-000000000000
Birth Object ID: 310c2aaf-0f00-d1de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d89000
Attribute: In Use & File
Record Number: 19324
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\sceregvl.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0080-000000000000
Birth Volume ID: 627c0000-0000-0000-627c-000000000000
Birth Object ID: 21080a75-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d89400
Attribute: In Use & File
Record Number: 19325
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\pnpscsi.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-010000000000
Birth Volume ID: e49f0100-0000-0000-e49f-010000000000
Birth Object ID: 311a54af-0f00-d1de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d89800
Attribute: In Use & File
Record Number: 19326
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2004-08-03 13:28:48 UTC+0000 2008-04-13 13:43:22 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2008-04-13 13:43:22 UTC+0000 2008-04-13 13:43:22 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\ntprint.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00e0-220000000000
Birth Volume ID: b0d52200-0000-0000-b0d5-220000000000
Birth Object ID: 322e0274-af0f-0000-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d89c00
Attribute: In Use & File
Record Number: 19327
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\netwzc.inf
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d8a000
Attribute: In Use & File
Record Number: 19336
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\mstape.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 1e840000-0000-0000-1e84-000000000000
Birth Object ID: 3109cab1-0f00-d2de-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d8a400
Attribute: In Use & File
Record Number: 19337
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\msoe50.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00a0-000000000000
Birth Volume ID: fa960000-0000-0000-fa96-000000000000
Birth Object ID: 310aa785-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d8a800
Attribute: In Use & File
Record Number: 19338
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:15 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:15 UTC+0000 2020-02-03 23:23:15 UTC+0000 WINDOWS\inf\mshdc.inf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2d8ac00
Attribute: In Use & File
Record Number: 19339
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:16 UTC+0000 2020-02-03 23:23:16 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:23:16 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:23:16 UTC+0000 2020-02-03 23:23:16 UTC+0000 WINDOWS\inf\mpe.inf
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e40000
Attribute: In Use & File
Record Number: 4464
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:27 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:24:52 UTC+0000 2020-02-03 23:24:52 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:24:52 UTC+0000 2008-04-13 22:56:12 UTC+0000 2020-02-03 23:24:52 UTC+0000 2020-02-03 23:24:52 UTC+0000 dmremote.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 003e0000-0000-0000-003e-000000000000
Birth Object ID: 31045bc2-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e40400
Attribute: In Use & File
Record Number: 4465
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:27 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:24:53 UTC+0000 2020-02-03 23:24:53 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:24:53 UTC+0000 2008-04-13 22:56:00 UTC+0000 2020-02-03 23:24:53 UTC+0000 2020-02-03 23:24:53 UTC+0000 osuninst.dll
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e40800
Attribute: In Use & File
Record Number: 4466
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:08:40 UTC+0000 2002-08-31 05:00:00 UTC+0000 2020-02-02 23:09:55 UTC+0000 2020-02-03 00:42:53 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 23:08:40 UTC+0000 2002-08-31 05:00:00 UTC+0000 2020-02-02 23:08:40 UTC+0000 2020-02-02 23:08:40 UTC+0000 Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0090-000000000000
Birth Volume ID: 00900000-0000-0000-0090-000000000000
Birth Object ID: 3108eca1-0721-01db-ee00-5de1dc07bef9
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e40c00
Attribute: In Use & Directory
Record Number: 4467
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 2020-02-02 23:09:55 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 Program Files\Common Files\SPEECH~1
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 2020-02-02 23:08:41 UTC+0000 Program Files\Common Files\SpeechEngines
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e80000
Attribute: In Use & File
Record Number: 7916
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:09 UTC+0000 2004-07-17 02:33:34 UTC+0000 2020-02-03 02:56:09 UTC+0000 2020-02-03 02:56:09 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:56:09 UTC+0000 2004-07-17 02:33:34 UTC+0000 2020-02-03 02:56:09 UTC+0000 2020-02-03 02:56:09 UTC+0000 plylst1.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: eb040000-0000-0000-eb04-000000000000
Birth Object ID: 31013be4-0100-7881-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e80400
Attribute: In Use & File
Record Number: 7917
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:56:54 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:40 UTC+0000 2020-02-03 23:27:40 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:25:20 UTC+0000 2008-02-01 12:42:56 UTC+0000 2020-02-03 23:25:20 UTC+0000 2020-02-03 23:25:20 UTC+0000 WINDOWS\system32\oobe\setup\au_plcy.htm
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 6b330000-0000-0000-6b33-000000000000
Birth Object ID: 2104de3c-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e80800
Attribute: In Use & File
Record Number: 7918
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-02 22:55:21 UTC+0000 2002-08-31 05:00:00 UTC+0000 2020-02-03 00:37:04 UTC+0000 2020-02-03 00:37:04 UTC+0000 Compressed & Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-02 22:55:21 UTC+0000 2002-08-31 05:00:00 UTC+0000 2020-02-02 23:09:59 UTC+0000 2020-02-03 00:37:04 UTC+0000 WINDOWS\system32\dllcache\imkrinst.exe
$DATA
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2e80c00
Attribute: In Use & File
Record Number: 7919
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 23:25:20 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:25:20 UTC+0000 2020-02-03 23:25:20 UTC+0000 Unknown Type
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:25:20 UTC+0000 2008-04-13 22:56:02 UTC+0000 2020-02-03 23:25:20 UTC+0000 2020-02-03 23:25:20 UTC+0000 WINDOWS\system32\usmt\sysmoda.dll
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-00b0-020000000000
Birth Volume ID: 00a60200-0000-0000-00a6-020000000000
Birth Object ID: 312b5832-0300-0100-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2ec0000
Attribute: In Use & File
Record Number: 12832
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2020-02-03 23:28:13 UTC+0000 2020-02-03 23:28:13 UTC+0000 2020-02-03 23:28:13 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 WINDOWS\wmsetup.log
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: d3060000-0000-0000-d306-000000000000
Birth Object ID: 2101dd2c-0000-0100-ffff-ffff82794711
Birth Domain ID: 2e20204f-5356-6572-2069-7320352e312e
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2ec0400
Attribute: In Use & File
Record Number: 12833
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists\000ED00D\Plylst2.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 20040000-0000-0000-2004-000000000000
Birth Object ID: 21017032-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2ec0800
Attribute: In Use & File
Record Number: 12834
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists\000ED00D\Plylst15.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: ef020000-0000-0000-ef02-000000000000
Birth Object ID: 21016f32-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2ec0c00
Attribute: In Use & File
Record Number: 12835
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2020-02-03 02:57:31 UTC+0000 2007-02-21 01:27:06 UTC+0000 2020-02-03 23:25:46 UTC+0000 2020-02-03 23:28:01 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 2020-02-03 02:57:31 UTC+0000 Documents and Settings\All Users\Documents\My Music\Sample Playlists\000ED00D\Plylst14.wpl
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 12030000-0000-0000-1203-000000000000
Birth Object ID: 21016632-0000-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2f00000
Attribute: In Use & File
Record Number: 18960
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 23:22:52 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:52 UTC+0000 2008-04-13 22:37:50 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 23:22:52 UTC+0000 WINDOWS\inf\qmgr.inf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2f00400
Attribute: In Use & File
Record Number: 18961
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:48 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 23:22:52 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:52 UTC+0000 2008-04-13 22:37:48 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 23:22:52 UTC+0000 WINDOWS\inf\mdmirmdm.inf
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2f00800
Attribute: In Use & File
Record Number: 18962
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2008-04-13 22:37:48 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 23:22:52 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:52 UTC+0000 2008-04-13 22:37:48 UTC+0000 2020-02-03 23:22:52 UTC+0000 2020-02-03 23:22:52 UTC+0000 WINDOWS\inf\fp40ext.inf
$DATA
$OBJECT_ID
Object ID: 40000000-0000-0000-0040-000000000000
Birth Volume ID: 863d0000-0000-0000-863d-000000000000
Birth Object ID: 31044562-0a00-0100-ffff-ffff82794711
Birth Domain ID: 00000000-0000-0000-0000-000000000000
***************************************************************************
***************************************************************************
MFT entry found at offset 0x2f00c00
Attribute: In Use & File
Record Number: 18963
Link count: 1
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2002-08-31 05:00:00 UTC+0000 2007-01-01 15:54:42 UTC+0000 2020-02-03 23:27:29 UTC+0000 2020-02-11 12:57:19 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2020-02-03 23:22:53 UTC+0000 2007-01-01 15:54:42 UTC+0000 2020-02-03 23:22:53 UTC+0000 2020-02-03 23:22:53 UTC+0000 WINDOWS\Fonts\tunga.ttf
***************************************************************************
[
以上。