Friday, March 28, 2014

What CIA is trying to achieve

  • Get me married with girl of their choice and then make me move to USA. Even at last hospitalization my doctor was keen to advice me that  I should marry. Why someone should marry if the person has “so called”  schizophrenia.
  • If that is not achieved just get me to USA.
  • Because of this I suspect that they need my Will in favor of my would be wife, or if that is not possible transfer the  asset  to USA government. In USA if you have no WILL asset get transferred to USA government.
  • Reach all people that I know from childhood, It make me feel there is some big asset which I am responsible for.
  • For people they think, person can't be intimidated and can not be bought, the murder and make it look like natural death or suicide.

Wednesday, March 19, 2014

Where was Anjan Bhushan ?

Around  15th of December 2013, I told my father, that I have friends whom CIA doesn’t know who they are and they are powerful on internet. Father wanted to “meet” them, I did reply that’s not possible at this juncture because I don’t know who they are, all I know they are helping me and are very powerful on internet. Also, any attempt to get them recognized will make CIA know about them. And if that happens they will be of no use. because all my communications are bugged.Point to note here was I was taking medication (Risperidone 2mg) provided by father, despite this fact its difficult for father to understand conspiracy angle because close relative and friends are being used. Doctors and medical facilities are being misused because of that. Father taken this as  my being  ill. He with the help of Mr. Jayant ,Brajesh (Bhola) and Kishore took me to CIP (http://cipranchi.nic.in/) on 16th of December 2013. An employee at CIP asked me to sign admission with consent form. I refused to sign consent form but I requested to provide me good ward. She replied if I sign the consent form then she would admit me in good ward. Father also persuaded to provide me  good accommodation. I was admitted to CIP in Berkley Hill Ward. That is best ward in CIP.

Since I was still admitted when I was continuing medication, in protest, I refused medication in CIP after admission. I don’t remember how many days I did not take medication. But father says I had manhandled a medical staff and subsequently I was administered ECT (http://en.wikipedia.org/wiki/Electroconvulsive_therapy)8 or 9 times. There is total memory loss for me during that period. Also, as told by father I was transferred to inferior ward , Conolly ward  during that period. From days of ECT and transferred back from Conolly to Bekley hill ward I don’t remember anything. Also I had forgotten many things of past. I don’t know if aim of doctors were to erase the memory completely. Also, I don’t believe I had manhandled a doctor, I know that would be dangerous.  My doctors were Dr Ramling who reported to Dr. Anjanik and who in turn reported to Dr Sanjay Munda.In one of the regular round in March 2014, Dr Ramling said to Dr Anajanik ETC was administered because I did refuse medication.

In one of the round Dr Anjanik asked If I read newspaper at hospital, I replied in negative that I read news on internet. Then he asked if I know about Snowden.I tried my brain but couldn’t collect data about Snowden, after couple of day when I pushed my brain I could remember about him.Around, 15th of Feb 2014, I was able to recollect stuff going around me.Just before that I used to dream a lot, may be because of medications.

Around 15th Feb 2014, I raised issue that domains at registrar may expire soon so that I should get parole for could of days so that I can renew it. Dr Anjanik said as per provision of CIP I can’t get Parole but leave for couple of days.After That I pushed for leave for couple of days, then Dr Sanjay Munda has said that is not allowed in the facility. I told my father I would lose many domains if I am not discharged before 16th of March 2014. I also communicated to Dr Anjanik and Dr Ramling that if I am not discharged by 16th of March 2014 I will go on hunger strike from 17th of March. I also communicated this to my father. Finally, Father interfered in the issue and I was discharged on 14th of March 2015 by will of father. He had to sign a statement that he is discharging on his own risk.Currently I am on huge dosage of medication which are administrated by father. They are as follow

CIPIN 100 MG (CLOZAPINE) – Morning 1 tablet – Evening –2.5 tablets

Solian 100 mg – Morning 2 tablet – Eveneing 2 tablet

Pacitane 2mg – evening 1 tablet.

This medication are having huge side-effect and risk. But Since I am not in position to convince father, I have to take it.

Now, I have appeal from Non-Connected friends, If I don’t update Facebook or Twitter for 3 consecutive days, please take some action. My story is bigger than Snowden and it will change whole world order.You people are my only hope. Thank you for reading it.

Saturday, December 7, 2013

Conspiracy to fabricate me in Hacking and Domain Theft

  • These conspirators(CIA oF USA AND IB/RAW of India) had previously tried to fabricate me in 2006 for possibly domain theft.Read the story. Then again in 2011, they used Chandan M. A and Emudra for that. In 2008, my ex-wife was used for filing a fabricated criminal case against under IPC 498a. And they used Police, Court, Lawyers etc to harass father and me for more than 2.5 years. Divorce with ex-wife happened in April 2011. Around and after divorce, I wanted to start my own company in USA and India and do domaining and blogging. That’s not good for them and they thought to fabricate me in another legal mess. They did choose Chandan and Emudra for that.
  • First I contacted Chandan M. A. in December 2010. He is a domainer, who lives in Bangalore. I have never met him personally but  he is in my Gmail chat list had become friend.
  • On May 11, 2011, he informed me that emudra had made him offer for his domain myinsurance.co.in. Here is chat transcript.
  • On August 8, 2011, Chandan informed me that they (emudra) have contacted him again. Chat transcript
  • On August 9, 2011, In First Chat Transcript, Chandan first wanted to talk using gtalk, then said “i am thinking to change whois with ur name and do a bargain ?”. He also added, “ some idiot from emudhra came to my house,i said the domain is with my friend :D,i need to look and see the domain”. I replied to him he can do so if that would help.
  • On August 9, 2011, In Second Chat Transcript, Chandan informed that he has changed whois of myinsurance.co.in to my contact details.
  • On August 10, 2011, In First Chat Transcript, I was suspicious about Chandan’s intention when he had told me, he wants just 20K INR, and for that he needs such an elaborate setup. At 3:38 PM, I refused to “help” - “chandan a lot of bad things are happening around. I think i won't be able to handle this sorry I have take my word back.”. Chandan became desperate. Between 4:10 PM and 4:12 PM, a female (forgot her name) representing eMudra called on my mobile,while I was chatting with Chandan.There was echo in sound while I was talking to her, So, I assumed she was recording the conversation. I don’t  remember exact talk with her. But she asked if that domain was mine, I told her truth that I am only negotiating. She asked for some authorization on paper, I replied authorization etc will be handled by Chandan.She told she would talk to her manager and would come back to me next day.She never called again.If you see chat transcript, Chandan became desparate and at 5.06 PM he at least wanted me eMudra authorization code for domain transfer and deposit money.
  • On August 10, 2011, In Second Chat Transcript, I requested Chandan to revert back myinsurance.co.in contact details. What he did he changed it to Mahesh Patel.
  • Whois query of myinsurance.co.in March 1,2012.
  • whois query of myinsurance.co.in December 7, 2013
  • All files referred in this post can be downloaded at one place.

Friday, December 6, 2013

Financial angel : Has Google being used to frustrate me ?

In one of the previous story, Sedo was used in 2006-2007 for nangabollywood.com, because I was telling to people that I am earning 100 USD/day but earning will come down. So what they did that they manipulated Sedo and drastically, reduced the EPC (earning per click). Now another story about use of parking revenue by Google.

I did move to Bangalore from Patna in April,After July 2010, or so, I did decide not to look for job anymore. At that time my domain parking revenue was 400 USD-450 USD a month. Domains were mainly parked at Sedo.com and Bodis.com. Around that time, I wanted to pursue domaining, blogging etc as full time business. Conspirators didn’t want that as my online presence make their life difficult. So, they did manipulate domain parking revenue further.

On 8th of August, 2011, I won the auction of expired domain ganaa.com at snapnames.com. I told my cousin that this domain may bring 3 USD a day to me.I parked the domain ganaa.com at Bodis. Now, let me first  write about a few Jargons in domain parking.

  • CTR – Click through rate, rate at which visitors click the ads in percentage.
  • Upstream Provider – The organization/corp that have inventory of Pay Per Click Ads, Bodis primary upstream provider is Google/Bing etc. Bodis primary upstream provider is Google. If a domain is banned by Google (upstream provider), Bodis algorithm display ads from secondary provider or ZeroParking.
  • RPM = Revenue per thousand. It is the revenue per 1000 visitors.
  • ZeroParking (taken from Bodis FAQ)- Certain domain names on the Bodis network may be monetized through a means known as "ZeroClick". ZeroClick is a method of advertising where domain visitor traffic is forwarded to an advertiser. Advertisers pay us for the visits that are forwarded to them. This revenue is passed onto the Bodis customer.
  • This typically occurs when a domain is not accepted by our primary upstream advertisements provider or when the primary upstream advertisements provider doesn't have ad coverage for a particular geo or visitor.IN ZeroParking for a domain CTR is not recorded, but domain may have some revenue. That is a proof in domain data that domain is being served by ZeroParking.

  • Bodis Tool to check if ads are being served from primary upstream provider or secondary provider (or ZeroParking) - https://api.bodis.com/domainclassification?domain=ignou.co.in (ignou.co.in is the domain,replace ignou.co.in by domain you want to check). In this case response
<response>
<metadata>
<iserror>false</iserror>
<responsetime>16ms</responsetime>
</metadata>
<classification>
<bodisadvertisements>secondary</bodisadvertisements>
</classification>
</response>


  • In this case, element <bodisadvertisements> says “secondary” – so for this domain Bodis will serve ads from secondary provider or ZeroParking. In case, this element says “primary” advertisement will be served using Google Ads.

  • Above tool by Bodis only returns reliable data if domain name was/is parked at Bodis. Some people have observed that if domain is not parked at Bodis, this tool is unreliable (have read this in few domain names forum). However, one can find out from parking reports if a ban has been imposed by Google by change in CPC (EPC) or CTR (I will elaborate it later).

  • In almost, all circumstances EPC (earning per click) by Google Ads (primary upstream provider) are better than Secondary upstream provider or ZeroParking.

  • Why Google bans a domain – Google never provides exact reason for which they ban a particular domain, however they say, they do it after quality check of traffic.

  • In November 2011, most of my top 20 domains with visitors were banned by Google (primary upstream provider) at Bodis platform and no other domain was banned from my account on Sedo. Unfortunately, I hadn’t saved data at Sedo and at Sedo Parking reports are only saved for a year. I did report this on Namepros . In case, this thread is deleted cached data is available here.

  • After posting this on Namepros observed a few domains at Sedo was also banned by Google (after my post on Namepros), the one I remember was ssc.org.in at Sedo, that was banned by Google, after posting this “All my sedo domains are intact and getting Google feed”.

Now Lets see data for individual domains that were parked at Bodis platform in November, 2011.



Now lets ponder it



  • When Google do anything at large scale (like algorithm update on SERP), its being felt in relevant forum. When I posted on NamePros that most of my domains on Bodis were banned by Google, no one around that time saw this issue. So, most likely the ban is not because of massive cleanup for low quality traffic from by Google.

  • Its hard to believe Google’s random quality check may make, 9 out of top 10 domains from single account to suffer on one Parking company hosted domains.

  • All files used in this post can be downloaded at one place by visiting here.

Added Later



  • I think they assumed that I don’t have concept of what happens when a parked domain gets banned by Google. That’s why initially, domains at Bodis were banned and not at Sedo. Possibly they thought I will assume that domains had started performing badly and I may move affected domains at other Parking provider (like Sedo). In that case, As it would have performed badly on any Parking company and I would have no clue what happened with those domains. This is one explanation why domains were not manipulated at Parking company level and instead at upstream provider itself (Google in this case).

Wednesday, December 4, 2013

Misuse of Psychiatry Facilities and Doctors

1. In 2005, was admitted to Muhlenberg Regional Medical Center, Park avenue & Randolph Road, Plainfield, NJ – 07061. Date of admission was July 17, 2005 and Date of Discharge was July 25, 2005, My Doctor was Dr. Dinesh G. Patel, his phone number was 908-668-2028. Parantap Pandya was a clinician and phone number was 908-668-2205. Pandya got my signature on paper as consent that I had Bipolar Disorder and also told me if I did that, I would be discharged. Later he was trying to sign me Schizophrenia document. I told that I will sign each page of it. He refused and said if I did that, he would be in problem. Rajani Kurukkal, my-ex roommate was also hospitalized there and name on her hand ban was Bhattacharya.

2. In 2005,UMDNJ, University of Medicine and Dentistry of New Jersey, Department of crisis services, 671 Hoes Lane, P. O. Box 1392, Piscataway, NJ-08855. Doctor’s name was not provided. Case id was 2030528. Date of admission was July 27, 2005. They kept me there half day.

3. In 2005, went to Princeton House Behavioral Health, North Brunswick NJ for assessment.

4. In 2005, I had OPD doctor, Dr Vasudev N. Makhija, 812 N. Wood Ave, Ste 112, Linden, New Jersey-07036. Phone-908-486-6666, Fax – 908-486-6088. He continued to be my OPD doctor till I stayed in USA.

5. In 2005, my employer Evident Software has done its examination by Dr. Roberto S. Sozzi, before I returned to work. His address was 1117, Main Avenue, Suite 203, Clifton, NJ-07011.

6. In 2006, Raritan Bay Medical Center, Crisis Management Unit, Perth Amboy Division, 530 New Brunswick Avenue, Perth Amboy, New Jersey – 08861. 732-442-3700. I was kept there for 2 days and then was admitted to Carrier Clinic.

7. In 2006, Carrier Clinic, P.O. Box 147, Route 601,Belle Mead, New Jersey-08502. Admission Date – June 28, 2006 and Discharge Date – July 5, 2006. My doctor was Dr Asad Islam.

8. 19th July 2006, I boarded a Continental Airlines plane from Newark to Delhi (First Illinois -ORD to Newark).

9.

In 2006, Admitted to VIMHANS New Delhi. Admission date July 24th, 2006 Discharge Date 2nd August 2006.My Doctor was Dr. Anandi Lal. Subsequently, visited Dr. Anandi Lal in OPD on 12th, August 2006 and 19th, August 2006. Address is VIMHANS Hospital, No. 1, Institutional Area, Nehru Nagar, New Delhi-110065.Ph-29849010-20. Fax-298490-28&31. Diagonosis – Bipolar affective disorder in mania with psychotic symptoms.

10. In 2006, subsequently moved to Patna and my OPD doctor was Narendra Pratap Singh, visit details available for for 25th September, 2006, 19th October 2006, 21st October 2006, 4th November 2006, 9th December 2006, 10th Feb 2007, 6th April 2007.

11. In 2007, Admitted to Davis Institute of Neuropsychiatry, Ranchi, India. Date of admission was 16th April, 2007 and Date of Discharge was 6th May, 2007. My doctor was Dr. Milan Borde. First time ECT treatment was given. 2 ECT treatment on 17th and 18th April and third ECT was given either on 1st May or 2nd May .After last ECT treatment I was unconscious for 45 minutes or so. OPD visit details was 6th May, 2007 and 13th May, 2007.

12. In 2007, came back to Delhi, were subsequently again hospitalized to VIMHANS under Dr. Anandi Lal. Admission date 16 August 2007 and Discharge date 04 September 2007. Diagnosis was change to schizoaffective disorder. OPD visit to Dr Anandi Lal.

13. In 2007, OPD dates for Dr. Sanjay Chugh visit were 19th July 2007 and 25th July 2007.

14. In 2008, admitted to VIMHANS on 2nd July 2008 and discharge date were 17th of July 2008. My doctor was Dr Sanjay Pattanayak.

15. In 2008, from VIMHANS was admitted to The Hope Foundation on 17th of July 2008 and discharge date was 5th September 2008. My doctor was Dr Deepak Raheja. Diagnosis was changed to F20 (Paranoid Schizophrenia). Dr Anandi Lal visited Hope Foundation on 20th August, 2008.

16. In 2012, Admitted to Davis Institute of Neurophychiatry, Ranchi. Admission date was 7th May, 2012 and Discharge date was 24th June, 2012. Like previous occasion in Davis Institute of Neurophychiatry 4 or more ECT was given. Doctor was Dr. Milan Borde.

17. In 2012, Admitted to Central Institute of Psychiatry, Ranchi. I was admitted to CIP ranchi, emergency wing in evening and was kept in there till 15th August 2012.15th of August was a Holiday. So, On 16th August 2012 I was admitted to CIC ranchi. I was discharged on 11th September 2012 - Dr C.R.J Khess.

18. Currently,I am visiting OPD of Dr. B. P. Sinha, ranchi.

Financial Angel : Possibly Sedo.com was used

  • I was sedo.com domain parking customer at least since Dec,2003.
  • I bought domain name nangabollywood.com on snapnames.com auction after the domain name expired.Previously,the domain had an adult website.I paid 22,750 USD for the domain. I paid the amount based on estimate derived from similar traffic name already in my account (although, low traffic). Date of auction was 31st May, 2006. At that time, I was in USA. I parked the domain on Sedo.com, My account was handled by Sedo, USA.
  • On 6th July 2006, I reported huge decrease in CTR (Click Through Rate) of nangabollywood.com (read from bottom up) from 56-58% to 45% for a week or so to my account manager Eben G. Smith. Eben replied that CTR rates fluctuate because of seasonality, holidays etc. Most of the traffic of nangabollywood.com was from India and Pakistan, and as far as I know, there was no holiday season in India, at that time.To "compensate" my loss in CTR, Eben agreed to give me 5% bonus.
  • From saved email this was earning for July 2006. It was primarily from nangabollywood.com
    > > Revenue July 2006: $3062.14
    > > Earnings from previous months: $3364.38
    > >
    > > Total amount: $6426.52
  • As I had moved to India way back in July 2006, on 8th November 2006, Eben informed me that she had requested a new account manager to me as my new account would be handled from Germany.
  •  8th November, 2006 I received new account that was moved to Sedo Germany and hence my userid was changed (new account). As previous (Sedo usa) account was closed so I haven’t have access to old account control panel anymore.
  • In the new account, earning from November 2006 (partial as account was created on 8th Nov) was 2135 Euro, while December 2006 was 3637.24 Euro, January 2007 revenue plumpted to 1208.20 Euro and February 2007 to 514.45 Euro.Please refer the screenshot
  • I reported to Brad on 8th January 2007 CPC (please read as EPC), that it has decreased from 22nd december 2006 onwards drastically. Brad gave an absurd reason that in September 2006, Sedo developed dynamic pricing system for specific countries and market,and in December 2006 dynamic pricing was applied to most other countries.(Read the mail from bottom-up)
  • Now we need to understand, how domain parking works. In past, Google had a product called Adsense for Domains. Where adsense(adwords) ads are being displayed on an undeveloped domain and publisher (domain owner), in this case, gets earning per click for every click and advertiser is charged some value that is known as cost per click. Google used to pass a portion of CPC to advertisers as EPC and keep the difference to itself. My point is, settlement is done on per click basis. Google shutdown AdSense For Domains on April 18, 2012.http://www.seroundtable.com/google-adsense-for-domains-shutting-down-14761.html
  • In second model, Domain parking works where there is an intermediary between Google and publishers. They are known as Domain Parking company. In this case, Google is called upstream provider and a portion of CPC is being distributed among Google and domain parking companies and rest is passed to the publisher as EPC (Earning per click).
    Now,as per my saved email, Sedo was in domain parking business at least since December 2003(I have referred a file) and does it make sense that they were paying to publisher till Septmber 2006 a fixed rate per click.And they were even making losses. In worst case what other companies do that they don't credit the account for 48 hours or so for a click till they get exact CPC for a click. Any domainer will laugh at Sedo's explanation.
  • All the files mentioned here can be downloaded from the link.

Added Later – December 6, 2013

To find the fact I did write Bodis (another domain parking company), how EPC is derived and answer is inline with my statement.

 

Hi Anjan, 

Yes, our primary upstream advertiser determines the earnings per click based on the traffic, keywords, etc. then it is passed along to us.

Please let me know if you have any other questions!

Regards,
Jackie Parkinson
Bodis – Our domain is your domains

Does my laptop Windows XP have rootkit installed?

I did run RootKitRevealer from http://technet.microsoft.com/en-in/sysinternals/bb545027.aspx and it bring back following data. I don’t have time to understand it for now, Can someone shed some light to it?

HKU\S-1-5-21-1645522239-1592454029-1801674531-1003\Software\ThinPrint\Lang    3/8/2012 1:22 AM    3 bytes    Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1645522239-1592454029-1801674531-1004\Software\ThinPrint\Lang 4/6/2012 2:08 PM 3 bytes Data mismatch between Windows API and raw hive data.
HKLM\SECURITY\Policy\Secrets\SAC* 5/5/2010 12:34 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 5/5/2010 12:34 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\.wid\bin 11/10/2013 1:30 PM 176 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ 1/11/2012 9:37 PM 19 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\ANJANI BHUSHAN\Local Settings\Application Data\Box Sync\Logs\BoxSyncLog__3.4.25.0_11_10_2013.log 11/10/2013 2:17 PM 56 bytes Hidden from Windows API.
C:\Documents and Settings\ANJANI BHUSHAN\Local Settings\Temporary Internet Files\Content.IE5\NDN956ZP\views[1] 11/10/2013 2:17 PM 5.46 KB Hidden from Windows API.
C:\Documents and Settings\arjun\Local Settings\Application Data\Google\Google Desktop\e63d4d8f0508\filequeue.dat 9/28/2013 7:49 PM 22.44 KB Hidden from Windows API.
C:\Documents and Settings\arjun\Local Settings\Temporary Internet Files\Content.IE5\5EJZRIKK\views[1] 11/10/2013 2:17 PM 5.46 KB Hidden from Windows API.
C:\Documents and Settings\arjun\Recent\chrome-downloads.lnk 11/6/2013 12:31 PM 385 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\arjun\Recent\email-address-of-media.txt (2).lnk 11/5/2013 11:58 AM 508 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\arjun\Recent\June-28-Anjan-writes-about-vultures.pdf.lnk 9/26/2013 12:16 PM 549 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\arjun\Recent\part200.rtf (2).lnk 9/25/2013 8:00 PM 767 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\arjun\Recent\readme.txt.lnk 11/10/2013 2:14 PM 614 bytes Hidden from Windows API.
C:\Documents and Settings\arjun\Recent\RootkitRevealer.chm.lnk 11/10/2013 2:10 PM 643 bytes Hidden from Windows API.
C:\Documents and Settings\arjun\Recent\SysinternalsSuite.lnk 11/10/2013 2:14 PM 465 bytes Hidden from Windows API.
C:\System Volume Information\_restore{B9B2B540-34D8-4370-B6B5-3DE1159FBF3F}\RP977\A0189557.lnk 9/25/2013 8:00 PM 767 bytes Hidden from Windows API.
C:\System Volume Information\_restore{B9B2B540-34D8-4370-B6B5-3DE1159FBF3F}\RP977\A0189558.lnk 9/26/2013 12:16 PM 549 bytes Hidden from Windows API.
C:\System Volume Information\_restore{B9B2B540-34D8-4370-B6B5-3DE1159FBF3F}\RP977\A0189559.lnk 11/6/2013 12:31 PM 385 bytes Hidden from Windows API.
C:\System Volume Information\_restore{B9B2B540-34D8-4370-B6B5-3DE1159FBF3F}\RP977\A0189560.lnk 11/10/2013 2:14 PM 508 bytes Hidden from Windows API.
C:\WINDOWS\Prefetch\MMC.EXE-398DCF39.pf 11/10/2013 2:17 PM 76.08 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\REGDELNULL.EXE-301C6017.pf 11/10/2013 2:14 PM 16.79 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf 11/10/2013 2:15 PM 18.25 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-155CD7BB.pf 11/10/2013 2:19 PM 19.88 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-47122EC4.pf 11/10/2013 2:19 PM 31.41 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf 11/10/2013 2:21 PM 21.67 KB Hidden from Windows API.
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 11/10/2013 2:19 PM 64.00 KB Visible in Windows API, but not in MFT or directory index.