0.016s - DEBUG: Starting... 0.110s - DEBUG: 2017/7/23, 20:0:33 0.172s - DEBUG: OSForensics 5.1 build 1001 64-bit 0.204s - DEBUG OS: Windows 10 Professional Edition build 15063 (64-bit) 0.329s - DEBUG Path: C:\Program Files\OSForensics 0.422s - Main: Set security OK 0.454s - Main: Creating temp folder C:\ProgramData\PassMark\OSForensics\Temp\16732 0.500s - Main: Regproc check 0.672s - Main: Available phys mem: 9219117056 0.719s - Main: Load OSF config 0.750s - Main: Init OSFMount interface OK 0.797s - Main: Init direct access OK 0.891s - Main: Register disk events 0.954s - Main: init dialog 1.125s - CfgMain: Creating start window 1.266s - CfgMain: Creating hash set window 1.375s - CfgMain: Creating create sig window 1.422s - CfgMain: Creating compare sig window 1.500s - CfgMain: Creating hash window 1.547s - CfgMain: Creating file name search window 1.719s - CfgMain: Creating mismatch search window 1.860s - CfgMain: Creating create index window 1.922s - CfgMain: Creating search index window 2.094s - CfgMain: Creating recent activity window 2.188s - CfgMain: Creating deleted file search window 2.313s - DEBUG: FileCarving: Parsing File Formats (File: C:\ProgramData\PassMark\OSForensics\osf_filecarve.conf) 2.344s - CfgMain: Creating mem viewer window 2.454s - CfgMain: Creating prefetch viewer window 2.516s - CfgMain: Creating raw disk viewer window 2.594s - DEBUG: FileCarving: Parsing File Formats (File: C:\ProgramData\PassMark\OSForensics\osf_filecarve.conf) 2.766s - CfgMain: Creating sys info window 2.875s - CfgMain: Creating drive prep window 3.016s - CfgMain: Creating password window 3.094s - Pswd: Creating Passwords & keys tab 3.235s - Pswd: Creating Windows Login tab 3.422s - Pswd: Initializing rainbow 3.641s - Rainbow: Loading charsets from C:\ProgramData\PassMark\OSForensics\RainbowTables\charset.txt 3.719s - Rainbow: Initializing SSL 3.782s - Rainbow: Initializing SSL 3.797s - Rainbow: Initializing Rainbow Table 3.844s - Rainbow: Initializing RainbowTable 3.875s - Pswd: Creating Rainbow Generate tab 4.000s - Pswd: Creating Rainbow Retrieval tab 4.047s - Pswd: Creating Decryption tab 4.110s - CfgMain: Creating forensic imaging window 4.266s - CfgMain: Creating SQLite browser window 4.313s - CfgMain: Creating manage case window 4.344s - CaseManagementInitWindow: start 4.407s - initCaseSelectionListWnd: start 4.485s - initCaseSelectionListWnd: add mydocs 4.532s - initCaseSelectionListWnd: add cases 4.579s - initCaseSelectionListWnd: end 4.641s - initCaseManagementListWnd: start 4.672s - initCaseManagementListWnd: end 4.719s - CaseManagementInitWindow: end 12.641s - Recent Activity Scan: Begin 12.688s - Activity Monitor: Task Started (Recent Activity) 12.719s - Recent Activity Scan: Available phys mem: 9161187328 12.782s - Recent Activity Scan: Available phys mem: 9161203712 12.797s - Recent Activity Scan: Allocating ChatList 12.829s - Recent Activity Scan: Allocating MRUList 12.875s - Recent Activity Scan: Allocating EventList 12.907s - Recent Activity Scan: Allocating UsbList 12.938s - Recent Activity Scan: Allocating wlanList 13.000s - Recent Activity Scan: Allocating cookieList 13.032s - Recent Activity Scan: Allocating downloadList 13.047s - Recent Activity Scan: Allocating urlList 13.079s - Recent Activity Scan: Allocating shellBagList 13.094s - Recent Activity Scan: Available phys mem: 9160937472 13.125s - Recent Activity Scan: Allocating bookmarkList 13.172s - Recent Activity Scan: Allocating installList 13.204s - Recent Activity Scan: Allocating autoRunList 13.219s - Recent Activity Scan: Allocating mountedVolList 13.250s - Recent Activity Scan: Available phys mem: 9160548352 13.266s - Recent Activity Scan: Allocating userAssistList 13.297s - Recent Activity Scan: Allocating jumpListList 13.329s - Recent Activity Scan: Allocating formList 13.344s - Recent Activity Scan: Allocating winsearchList 13.375s - Recent Activity Scan: Allocating prefetchList 13.422s - Recent Activity Scan: Allocating MobileBackupList 13.454s - Recent Activity Scan: Allocating P2PList 13.516s - GetLocalFolderNames: DocumentsAndSettingsLocalName: Registry Info drive: C 13.532s - CreateTempRegFileIfNeeded: A 13.579s - CreateTempRegFileIfNeeded: B 13.594s - CreateTempRegFileIfNeeded: C 13.625s - CreateTempRegFileIfNeeded: DA 13.641s - CreateTempRegFileIfNeeded: DB 13.688s - CreateTempRegFileIfNeeded: DC 13.750s - ShadowCopyFiles entry 13.813s - ShadowCopyFiles: Trying to create shadow volume 13.875s - CreateShadowVolumeForFC entry 13.954s - CreateShadowVolumeForFC Initialize VSS client 13.985s - CreateShadowVolumeForFC Get unique vol name for: C:\ 14.047s - unique vol name: \\?\Volume{d0800516-fa9a-4c53-8a90-8250d0a23b9b}\ 14.141s - CreateShadowVolumeForFC create snapshot set 19.594s - CreateShadowVolumeForFC getLatestSnapshotIdListt 19.750s - CreateShadowVolumeForFC GetSnapshotDeviceName 19.782s - CreateShadowVolumeForFC exit 19.797s - ShadowCopyFiles: created shadow volume 19.829s - ShadowCopyFiles: 1 files to copy 19.860s - ShadowCopyFiles: curent file: C:\Windows\System32\Config\SOFTWARE 19.875s - ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy22\Windows\System32\Config\SOFTWARE 19.907s - ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16732\C5C5DF0374B591538BDD691D36926784 21.172s - ShadowCopyFiles done 21.500s - Classes BlockType invalid: \x72\x69 21.985s - Microsoft\Enrollments BlockType invalid: \x72\x69 22.704s - Microsoft\Office\ClickToRun\AppVMachineRegistryStore\Integration\Ownership\SOFTWARE\Classes\Interface BlockType invalid: \x72\x69 23.063s - Microsoft\Office\ClickToRun\AppVMachineRegistryStore\Integration\Ownership\SOFTWARE\Classes\Wow6432Node\Interface BlockType invalid: \x72\x69 23.391s - Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Record BlockType invalid: \x72\x69 23.766s - Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface BlockType invalid: \x72\x69 23.954s - Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components BlockType invalid: \x72\x69 24.360s - Microsoft\SystemSettings\SettingId BlockType invalid: \x72\x69 24.532s - Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect BlockType invalid: \x72\x69 24.563s - Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect BlockType invalid: \x72\x69 24.594s - Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageIndex BlockType invalid: \x72\x69 24.610s - Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages BlockType invalid: \x72\x69 24.782s - Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components BlockType invalid: \x72\x69 25.235s - Microsoft\Windows\CurrentVersion\SideBySide\Winners BlockType invalid: \x72\x69 25.297s - Microsoft\Windows\CurrentVersion\WINEVT\Channels BlockType invalid: \x72\x69 25.641s - Microsoft\WindowsRuntime\ActivatableClassId BlockType invalid: \x72\x69 25.672s - Microsoft\WindowsRuntime\CLSID BlockType invalid: \x72\x69 26.266s - WOW6432Node\Microsoft\WindowsRuntime\ActivatableClassId BlockType invalid: \x72\x69 26.344s - WOW6432Node\Microsoft\WindowsRuntime\CLSID BlockType invalid: \x72\x69 26.454s - GetLocalFolderNames: C:\Windows\System32\Config\SOFTWARE loaded successfully. Opening key: Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 26.485s - GetLocalFolderNames: Key Microsoft\Windows\CurrentVersion\Explorer\Shell Folders found. Number of values: 12 26.500s - GetLocalFolderNames: Found value: "Common Administrative Tools"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools" 26.532s - GetLocalFolderNames: Found value: "Common AppData"="C:\ProgramData" 26.547s - GetLocaFolderNames: Common AppData C:\ProgramData 26.579s - GetLocaFolderNames: CommonAppDataLocalName ProgramData 26.657s - GetLocalFolderNames: Found value: "Common Desktop"="C:\Users\Public\Desktop" 26.688s - GetLocalFolderNames: Found value: "Common Documents"="C:\Users\Public\Documents" 26.735s - GetLocaFolderNames: Common Documents C:\Users\Public\Documents 26.766s - GetLocaFolderNames: DocumentsAndSettingsLocalName Users 26.813s - GetLocalFolderNames: Found value: "Common Programs"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs" 26.844s - GetLocalFolderNames: Found value: "Common Start Menu"="C:\ProgramData\Microsoft\Windows\Start Menu" 26.875s - GetLocalFolderNames: Found value: "Common Startup"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" 26.891s - GetLocalFolderNames: Found value: "Common Templates"="C:\ProgramData\Microsoft\Windows\Templates" 26.922s - GetLocalFolderNames: Found value: "CommonMusic"="C:\Users\Public\Music" 26.938s - GetLocalFolderNames: Found value: "CommonPictures"="C:\Users\Public\Pictures" 26.969s - GetLocalFolderNames: Found value: "CommonVideo"="C:\Users\Public\Videos" 26.985s - GetLocalFolderNames: Found value: "OEM Links"="C:\ProgramData\OEM\Links" 27.016s - GetLocalFolderNames: Registry Info drive: C 27.047s - LocalOSEnv::GetNextUser start 27.063s - LocalOSEnv::GetNextUser xp check 27.094s - LocalOSEnv::GetNextUser cleanup profile path 27.172s - LocalOSEnv::GetNextUser win7/mac check 27.188s - LocalOSEnv::GetNextUser cleanup profile path 27.219s - . 27.235s - .. 27.266s - All Users 27.297s - LocalOSEnv::GetNextUser finish 27.313s - GetLocalFolderNames: registryFile: C:\Users\All Users\NTUSER.DAT 27.344s - CreateTempRegFileIfNeeded: A 27.375s - CreateTempRegFileIfNeeded: B 27.391s - CreateTempRegFileIfNeeded: E 28.563s - GetLocaFolderNames: Registry Info: Could not load C:\Users\All Users\NTUSER.DAT 28.610s - Could not open file, error: 2 28.625s - LocalOSEnv::GetNextUser start 28.657s - Default 28.688s - LocalOSEnv::GetNextUser finish 28.766s - GetLocalFolderNames: registryFile: C:\Users\Default\NTUSER.DAT 28.797s - CreateTempRegFileIfNeeded: A 28.844s - CreateTempRegFileIfNeeded: B 28.860s - CreateTempRegFileIfNeeded: E 28.922s - LocalOSEnv::GetNextUser start 28.954s - Default User 29.000s - LocalOSEnv::GetNextUser finish 29.094s - GetLocalFolderNames: registryFile: C:\Users\Default User\NTUSER.DAT 29.172s - CreateTempRegFileIfNeeded: A 29.204s - CreateTempRegFileIfNeeded: B 29.235s - CreateTempRegFileIfNeeded: E 29.282s - LocalOSEnv::GetNextUser start 29.313s - Default.migrated 29.329s - LocalOSEnv::GetNextUser finish 29.454s - GetLocalFolderNames: registryFile: C:\Users\Default.migrated\NTUSER.DAT 29.485s - CreateTempRegFileIfNeeded: A 29.516s - CreateTempRegFileIfNeeded: B 29.563s - CreateTempRegFileIfNeeded: E 29.594s - GetLocaFolderNames: Registry Info: Could not load C:\Users\Default.migrated\NTUSER.DAT 29.641s - Could not open file, error: 2 29.672s - LocalOSEnv::GetNextUser start 29.704s - desktop.ini 29.750s - Public 29.766s - LocalOSEnv::GetNextUser finish 29.797s - GetLocalFolderNames: registryFile: C:\Users\Public\NTUSER.DAT 29.813s - CreateTempRegFileIfNeeded: A 29.844s - CreateTempRegFileIfNeeded: B 29.922s - CreateTempRegFileIfNeeded: E 29.938s - GetLocaFolderNames: Registry Info: Could not load C:\Users\Public\NTUSER.DAT 29.969s - Could not open file, error: 2 29.985s - LocalOSEnv::GetNextUser start 30.047s - xrenx 30.094s - LocalOSEnv::GetNextUser finish 30.125s - GetLocalFolderNames: registryFile: C:\Users\xrenx\NTUSER.DAT 30.235s - CreateTempRegFileIfNeeded: A 30.266s - CreateTempRegFileIfNeeded: B 30.282s - CreateTempRegFileIfNeeded: C 30.313s - CreateTempRegFileIfNeeded: DA 30.485s - CreateTempRegFileIfNeeded: DB 30.516s - CreateTempRegFileIfNeeded: DC 30.532s - ShadowCopyFiles entry 30.563s - ShadowCopyFiles: Trying to create shadow volume 30.594s - CreateShadowVolumeForFC entry 30.610s - CreateShadowVolumeForFC Initialize VSS client 30.641s - CreateShadowVolumeForFC Get unique vol name for: C:\ 30.719s - unique vol name: \\?\Volume{d0800516-fa9a-4c53-8a90-8250d0a23b9b}\ 30.735s - CreateShadowVolumeForFC create snapshot set 36.360s - CreateShadowVolumeForFC getLatestSnapshotIdListt 36.454s - CreateShadowVolumeForFC GetSnapshotDeviceName 36.704s - CreateShadowVolumeForFC exit 36.766s - ShadowCopyFiles: created shadow volume 36.797s - ShadowCopyFiles: 1 files to copy 36.829s - ShadowCopyFiles: curent file: C:\Users\xrenx\NTUSER.DAT 36.875s - ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23\Users\xrenx\NTUSER.DAT 36.891s - ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16732\27D3D330ABC05A5E8D196D9270BEAB3D 37.079s - ShadowCopyFiles done 37.532s - Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm BlockType invalid: \x72\x69 37.875s - GetLocaFolderNames: AppDataLocalName AppData\Roaming 38.094s - GetLocaFolderNames: HistoryLocalName AppData\Local\Microsoft\Windows\History 38.125s - GetLocaFolderNames: LocalAppDataLocalName AppData\Local 38.219s - GetLocaFolderNames: RecentLocalName AppData\Roaming\Microsoft\Windows\Recent 38.266s - LocalOSEnv::GetNextUser start 38.329s - LocalOSEnv::GetNextUser ubununtu check 38.375s - LocalOSEnv::GetNextUser cleanup profile path 38.407s - LocalOSEnv::GetNextUser cleanup profile path 38.485s - LocalOSEnv::GetNextUser end 38.766s - Recent Activity Scan: Registry 38.844s - Recent Activity Scan: Registry Info drive: C 38.907s - LocalOSEnv::GetNextUser start 38.985s - LocalOSEnv::GetNextUser xp check 39.047s - LocalOSEnv::GetNextUser cleanup profile path 39.125s - LocalOSEnv::GetNextUser win7/mac check 39.235s - LocalOSEnv::GetNextUser cleanup profile path 39.297s - . 39.375s - .. 39.422s - All Users 39.500s - LocalOSEnv::GetNextUser finish 39.579s - Recent Activity Scan: Registry Info next user: All Users 39.672s - CreateTempRegFileIfNeeded: A 39.750s - CreateTempRegFileIfNeeded: B 39.813s - CreateTempRegFileIfNeeded: E 39.907s - Recent Activity Scan: Registry Info: Could not load C:\Users\All Users\NTUSER.DAT 40.016s - Could not open file, error: 2 40.094s - LocalOSEnv::GetNextUser start 40.172s - Default 40.219s - LocalOSEnv::GetNextUser finish 40.297s - Recent Activity Scan: Registry Info next user: Default 40.344s - CreateTempRegFileIfNeeded: A 40.407s - CreateTempRegFileIfNeeded: B 40.469s - CreateTempRegFileIfNeeded: E 40.610s - GetUserAssistInfo start 40.813s - GetUserAssistInfo finish 40.922s - Recent Activity Scan: Got GetRecentDocs MRUs: new total 0 40.969s - Recent Activity Scan: Got Office MRUs: new total 0 41.079s - Recent Activity Scan: Got Run MRUs: new total 0 41.125s - Recent Activity Scan: Got Network Drive MRUs: new total 0 41.188s - Recent Activity Scan: Got Search MRUs: new total 0 41.250s - Recent Activity Scan: Got PMV Search MRUs: new total 0 41.313s - Recent Activity Scan: Got Internet Search MRUs: new total 0 41.375s - Recent Activity Scan: Got PCP Search MRUs: new total 0 41.454s - Recent Activity Scan: Got Wordpad MRUs: new total 0 41.500s - Recent Activity Scan: Got Paint MRUs: new total 0 41.547s - Recent Activity Scan: Got Media Player MRUs: new total 0 41.657s - Recent Activity Scan: Got Adobe Reader MRUs: new total 0 41.735s - Recent Activity Scan: GetInstalledProgramsUser start 41.797s - Recent Activity Scan: GetInstalledProgramsUser finish 41.844s - Recent Activity Scan: GetTypedIEURLS start 41.875s - Recent Activity Scan: GetTypedIEURLS finish 41.907s - Find next user 41.954s - LocalOSEnv::GetNextUser start 41.985s - Default User 42.047s - LocalOSEnv::GetNextUser finish 42.172s - Recent Activity Scan: Registry Info next user: Default User 42.219s - CreateTempRegFileIfNeeded: A 42.297s - CreateTempRegFileIfNeeded: B 42.344s - CreateTempRegFileIfNeeded: E 42.438s - GetUserAssistInfo start 42.500s - GetUserAssistInfo finish 42.563s - Recent Activity Scan: Got GetRecentDocs MRUs: new total 0 42.610s - Recent Activity Scan: Got Office MRUs: new total 0 42.688s - Recent Activity Scan: Got Run MRUs: new total 0 42.750s - Recent Activity Scan: Got Network Drive MRUs: new total 0 42.813s - Recent Activity Scan: Got Search MRUs: new total 0 42.891s - Recent Activity Scan: Got PMV Search MRUs: new total 0 42.954s - Recent Activity Scan: Got Internet Search MRUs: new total 0 43.032s - Recent Activity Scan: Got PCP Search MRUs: new total 0 43.094s - Recent Activity Scan: Got Wordpad MRUs: new total 0 43.141s - Recent Activity Scan: Got Paint MRUs: new total 0 43.219s - Recent Activity Scan: Got Media Player MRUs: new total 0 43.266s - Recent Activity Scan: Got Adobe Reader MRUs: new total 0 43.360s - Recent Activity Scan: GetInstalledProgramsUser start 43.422s - Recent Activity Scan: GetInstalledProgramsUser finish 43.485s - Recent Activity Scan: GetTypedIEURLS start 43.563s - Recent Activity Scan: GetTypedIEURLS finish 43.610s - Find next user 43.657s - LocalOSEnv::GetNextUser start 43.735s - Default.migrated 43.860s - LocalOSEnv::GetNextUser finish 43.922s - Recent Activity Scan: Registry Info next user: Default.migrated 43.985s - CreateTempRegFileIfNeeded: A 44.032s - CreateTempRegFileIfNeeded: B 44.110s - CreateTempRegFileIfNeeded: E 44.188s - Recent Activity Scan: Registry Info: Could not load C:\Users\Default.migrated\NTUSER.DAT 44.250s - Could not open file, error: 2 44.282s - LocalOSEnv::GetNextUser start 44.313s - desktop.ini 44.375s - Public 44.454s - LocalOSEnv::GetNextUser finish 44.532s - Recent Activity Scan: Registry Info next user: Public 44.750s - CreateTempRegFileIfNeeded: A 44.875s - CreateTempRegFileIfNeeded: B 44.938s - CreateTempRegFileIfNeeded: E 45.000s - Recent Activity Scan: Registry Info: Could not load C:\Users\Public\NTUSER.DAT 45.110s - Could not open file, error: 2 45.204s - LocalOSEnv::GetNextUser start 45.266s - xrenx 45.344s - LocalOSEnv::GetNextUser finish 45.454s - Recent Activity Scan: Registry Info next user: xrenx 45.579s - CreateTempRegFileIfNeeded: A 45.657s - CreateTempRegFileIfNeeded: B 45.719s - CreateTempRegFileIfNeeded: C 46.157s - Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm BlockType invalid: \x72\x69 46.313s - GetUserAssistInfo start 46.329s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count 46.407s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count 46.532s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count 46.625s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count 46.719s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count 46.750s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count 46.782s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count 46.813s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count 46.844s - Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count 46.891s - GetUserAssistInfo finish 47.016s - Recent Activity Scan: Got GetRecentDocs MRUs: new total 249 47.079s - Recent Activity Scan: Got Office MRUs: new total 249 47.110s - Recent Activity Scan: Got Run MRUs: new total 250 47.141s - Recent Activity Scan: Got Network Drive MRUs: new total 250 47.172s - Recent Activity Scan: Got Search MRUs: new total 252 47.204s - Recent Activity Scan: Got PMV Search MRUs: new total 252 47.219s - Recent Activity Scan: Got Internet Search MRUs: new total 252 47.282s - Recent Activity Scan: Got PCP Search MRUs: new total 252 47.329s - Recent Activity Scan: Got Wordpad MRUs: new total 253 47.344s - Recent Activity Scan: Got Paint MRUs: new total 254 47.375s - Recent Activity Scan: Got Media Player MRUs: new total 254 47.438s - Recent Activity Scan: Got Adobe Reader MRUs: new total 254 47.500s - Recent Activity Scan: GetInstalledProgramsUser start 47.563s - Recent Activity Scan: GetInstalledProgramsUser finish 47.579s - Recent Activity Scan: GetTypedIEURLS start 47.610s - Recent Activity Scan: GetTypedIEURLS finish 47.625s - Find next user 47.672s - LocalOSEnv::GetNextUser start 47.750s - Recent Activity Scan: Registry Info open SYSTEM 47.829s - CreateTempRegFileIfNeeded: A 47.844s - CreateTempRegFileIfNeeded: B 47.875s - CreateTempRegFileIfNeeded: C 47.907s - CreateTempRegFileIfNeeded: DA 47.922s - CreateTempRegFileIfNeeded: DB 47.954s - CreateTempRegFileIfNeeded: DC 47.969s - ShadowCopyFiles entry 48.000s - ShadowCopyFiles: Trying to create shadow volume 48.016s - CreateShadowVolumeForFC entry 48.047s - CreateShadowVolumeForFC Initialize VSS client 48.063s - CreateShadowVolumeForFC Get unique vol name for: C:\ 48.079s - unique vol name: \\?\Volume{d0800516-fa9a-4c53-8a90-8250d0a23b9b}\ 48.094s - CreateShadowVolumeForFC create snapshot set 53.157s - CreateShadowVolumeForFC getLatestSnapshotIdListt 53.250s - CreateShadowVolumeForFC GetSnapshotDeviceName 53.282s - CreateShadowVolumeForFC exit 53.297s - ShadowCopyFiles: created shadow volume 53.329s - ShadowCopyFiles: 1 files to copy 53.344s - ShadowCopyFiles: curent file: C:\Windows\System32\Config\SYSTEM 53.360s - ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy24\Windows\System32\Config\SYSTEM 53.422s - ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16732\5BF7395560B9FEC10D4491CB0E4989F0 53.985s - ShadowCopyFiles done 55.500s - DriverDatabase\DeviceIds\PCI BlockType invalid: \x72\x69 55.594s - DriverDatabase\DeviceIds\USB BlockType invalid: \x72\x69 56.485s - Recent Activity Scan: Vista check 56.500s - IsWindowsVistaOrHigher start 56.547s - IsWindowsVistaOrHigher Microsoft\Windows NT\CurrentVersion fail 56.579s - Recent Activity Scan: Mount points 56.594s - GetMountPointsSystem start 56.641s - GetMountPointsSystem non-local 56.672s - GetMountPointsSystem 19 entries found 56.704s - GetMountPointsSystem Adding volume 82ad3afc-1d61-11e7-9bf9-848f69f52c3e 56.719s - GetMountPointsSystem - finished processing entries 56.782s - Recent Activity Scan: Connected USB storage 56.875s - Recent Activity Scan: GetOnceConnectedUSBStorage start 56.891s - Recent Activity Scan: GetOnceConnectedUSBStorage end (not local) 56.922s - Recent Activity Scan: Connected Other USB 56.938s - Recent Activity Scan: GetOtherConnectedUSB start 56.954s - GetOtherConnectedUSB() - Parsing Vendor ID file. 57.016s - Found 844 VIDs in file C:\ProgramData\PassMark\OSForensics\usb.if. 57.110s - Found 3411 VIDs 2951 PIDs in file C:\ProgramData\PassMark\OSForensics\usb.ids. 57.141s - Recent Activity Scan: GetOtherConnectedUSB end (not local) 57.250s - CreateTempRegFileIfNeeded: A 57.282s - CreateTempRegFileIfNeeded: B 57.297s - CreateTempRegFileIfNeeded: C 58.063s - Classes BlockType invalid: \x72\x69 58.282s - Microsoft\Enrollments BlockType invalid: \x72\x69 58.719s - Microsoft\Office\ClickToRun\AppVMachineRegistryStore\Integration\Ownership\SOFTWARE\Classes\Interface BlockType invalid: \x72\x69 58.985s - Microsoft\Office\ClickToRun\AppVMachineRegistryStore\Integration\Ownership\SOFTWARE\Classes\Wow6432Node\Interface BlockType invalid: \x72\x69 59.250s - Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Record BlockType invalid: \x72\x69 59.547s - Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface BlockType invalid: \x72\x69 59.594s - Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components BlockType invalid: \x72\x69 59.875s - Microsoft\SystemSettings\SettingId BlockType invalid: \x72\x69 60.032s - Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect BlockType invalid: \x72\x69 60.047s - Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect BlockType invalid: \x72\x69 60.079s - Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageIndex BlockType invalid: \x72\x69 60.094s - Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages BlockType invalid: \x72\x69 60.219s - Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components BlockType invalid: \x72\x69 60.500s - Microsoft\Windows\CurrentVersion\SideBySide\Winners BlockType invalid: \x72\x69 60.547s - Microsoft\Windows\CurrentVersion\WINEVT\Channels BlockType invalid: \x72\x69 60.875s - Microsoft\WindowsRuntime\ActivatableClassId BlockType invalid: \x72\x69 60.891s - Microsoft\WindowsRuntime\CLSID BlockType invalid: \x72\x69 61.391s - WOW6432Node\Microsoft\WindowsRuntime\ActivatableClassId BlockType invalid: \x72\x69 61.454s - WOW6432Node\Microsoft\WindowsRuntime\CLSID BlockType invalid: \x72\x69 61.500s - Recent Activity Scan: GetOnceConnectedWireless 61.610s - Recent Activity Scan: GetInstalledProgramsSystem 61.641s - Recent Activity Scan: GetInstalledPrograms start 61.657s - Recent Activity Scan: GetInstalledPrograms done 61.672s - Recent Activity Scan: GetAutoRunEntriesSystem 61.704s - CreateTempRegFileIfNeeded: A 61.719s - CreateTempRegFileIfNeeded: B 61.750s - CreateTempRegFileIfNeeded: C 61.782s - CreateTempRegFileIfNeeded: DA 61.797s - CreateTempRegFileIfNeeded: DB 61.860s - CreateTempRegFileIfNeeded: DC 61.891s - ShadowCopyFiles entry 61.907s - ShadowCopyFiles: Trying to create shadow volume 61.938s - CreateShadowVolumeForFC entry 61.954s - CreateShadowVolumeForFC Initialize VSS client 61.985s - CreateShadowVolumeForFC Get unique vol name for: C:\ 62.000s - unique vol name: \\?\Volume{d0800516-fa9a-4c53-8a90-8250d0a23b9b}\ 62.032s - CreateShadowVolumeForFC create snapshot set 66.954s - CreateShadowVolumeForFC getLatestSnapshotIdListt 67.125s - CreateShadowVolumeForFC GetSnapshotDeviceName 67.188s - CreateShadowVolumeForFC exit 67.204s - ShadowCopyFiles: created shadow volume 67.235s - ShadowCopyFiles: 1 files to copy 67.266s - ShadowCopyFiles: curent file: C:\Users\xrenx\AppData\Local\Microsoft\Windows\UsrClass.DAT 67.313s - ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy25\Users\xrenx\AppData\Local\Microsoft\Windows\UsrClass.DAT 67.375s - ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16732\7A936690CE7006E3DA06B03A6455563A 67.969s - ShadowCopyFiles done 69.407s - Local Settings\MrtCache BlockType invalid: \x6c\x69 69.782s - Recent Activity Scan: GetShellBagInfo 1 69.844s - GetShellBagInfo start 69.922s - GetShellBagInfo Open: Software\Microsoft\Windows\Shell\BagMRU 69.985s - GetShellBagInfo Open: Software\Microsoft\Windows\ShellNoRoam\BagMRU 70.079s - GetShellBagInfo: C:\Users\xrenx\AppData\Local\Microsoft\Windows\UsrClass.DAT - Local Settings\Software\Microsoft\Windows\Shell\BagMRU 70.282s - GetShellBagInfo cleanup 70.313s - GetShellBagInfo Done 70.329s - CreateTempRegFileIfNeeded: A 70.344s - CreateTempRegFileIfNeeded: B 70.360s - CreateTempRegFileIfNeeded: E 70.563s - Recent Activity Scan: Registry Info: Could not load C:\Users\xrenx\AppData\Local\Microsoft\Windows\NTUSER.DAT 70.579s - Could not open file, error: 2 70.594s - CreateTempRegFileIfNeeded: A 70.657s - CreateTempRegFileIfNeeded: B 70.688s - CreateTempRegFileIfNeeded: E 70.704s - Recent Activity Scan: Registry Info: Could not load C:\NTUSER.DAT 70.735s - Could not open file, error: 2 70.766s - Recent Activity Scan: GetShellBagInfo2 70.782s - GetShellBagInfo start 70.813s - GetShellBagInfo Open: Software\Microsoft\Windows\Shell\BagMRU 70.829s - GetShellBagInfo Open: Software\Microsoft\Windows\ShellNoRoam\BagMRU 70.875s - GetShellBagInfo cleanup 70.922s - GetShellBagInfo Done 70.969s - Recent Activity Scan: Registry Info done 71.000s - Recent Activity Scan: Jump lists 71.016s - LocalOSEnv::GetNextUser start 71.047s - LocalOSEnv::GetNextUser xp check 71.063s - LocalOSEnv::GetNextUser cleanup profile path 71.094s - LocalOSEnv::GetNextUser win7/mac check 71.125s - LocalOSEnv::GetNextUser cleanup profile path 71.141s - . 71.172s - .. 71.188s - All Users 71.219s - LocalOSEnv::GetNextUser finish 71.250s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\All Users\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 71.266s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\All Users\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms 71.297s - LocalOSEnv::GetNextUser start 71.313s - Default 71.344s - LocalOSEnv::GetNextUser finish 71.391s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 71.422s - DEBUG: JumpLists: Processing C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 71.454s - ParseJumpList start: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 71.500s - ParseJumpList finish 71.516s - DEBUG: JumpLists: Processing C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 71.532s - ParseJumpList start: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 71.610s - Process_DestList start 71.641s - Process_DestList end 71.672s - ParseJumpList finish 71.688s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms 71.750s - DEBUG: JumpLists: Processing C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\55a647d66bfe6c7e.customDestinations-ms 71.782s - ParseCustomJumpList start: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\55a647d66bfe6c7e.customDestinations-ms 71.797s - ReadLINKINFO start 71.829s - ReadLINKINFO end 71.844s - ReadStringData start 71.875s - ReadStringData end 71.907s - ParseCustomJumpList end 71.922s - LocalOSEnv::GetNextUser start 71.954s - Default User 71.985s - LocalOSEnv::GetNextUser finish 72.000s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 72.032s - DEBUG: JumpLists: Processing C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 72.063s - ParseJumpList start: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 72.110s - ParseJumpList finish 72.141s - DEBUG: JumpLists: Processing C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 72.188s - ParseJumpList start: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 72.219s - Process_DestList start 72.250s - Process_DestList end 72.266s - ParseJumpList finish 72.297s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms 72.313s - DEBUG: JumpLists: Processing C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\55a647d66bfe6c7e.customDestinations-ms 72.344s - ParseCustomJumpList start: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\55a647d66bfe6c7e.customDestinations-ms 72.375s - ReadLINKINFO start 72.500s - ReadLINKINFO end 72.547s - ReadStringData start 72.579s - ReadStringData end 72.594s - ParseCustomJumpList end 72.641s - LocalOSEnv::GetNextUser start 72.735s - Default.migrated 72.766s - LocalOSEnv::GetNextUser finish 72.782s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Default.migrated\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 72.813s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Default.migrated\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms 72.829s - LocalOSEnv::GetNextUser start 72.860s - desktop.ini 72.891s - Public 72.922s - LocalOSEnv::GetNextUser finish 72.985s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Public\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 73.032s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\Public\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms 73.079s - LocalOSEnv::GetNextUser start 73.094s - xrenx 73.125s - LocalOSEnv::GetNextUser finish 73.141s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 73.172s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\12dc1ea8e34b5a6.automaticDestinations-ms 73.188s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\12dc1ea8e34b5a6.automaticDestinations-ms 73.235s - Process_DestList start 73.297s - Process_DestList end 73.344s - ParseJumpList finish 73.375s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms 73.407s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms 73.454s - Process_DestList start 73.500s - Process_DestList end 73.516s - ParseJumpList finish 73.563s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\28c8b86deab549a1.automaticDestinations-ms 73.610s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\28c8b86deab549a1.automaticDestinations-ms 73.657s - Process_DestList start 73.672s - Process_DestList end 73.704s - ParseJumpList finish 73.719s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\2b88af31b31e51e0.automaticDestinations-ms 73.750s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\2b88af31b31e51e0.automaticDestinations-ms 73.782s - Process_DestList start 73.813s - Process_DestList end 73.844s - ParseJumpList finish 73.875s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\2b8c71d0bc380671.automaticDestinations-ms 73.891s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\2b8c71d0bc380671.automaticDestinations-ms 73.922s - Process_DestList start 73.969s - Process_DestList end 74.000s - ParseJumpList finish 74.016s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\2f114339dfde05dc.automaticDestinations-ms 74.032s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\2f114339dfde05dc.automaticDestinations-ms 74.079s - Process_DestList start 74.094s - Process_DestList end 74.125s - ParseJumpList finish 74.141s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\351caccb796acc84.automaticDestinations-ms 74.172s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\351caccb796acc84.automaticDestinations-ms 74.188s - Process_DestList start 74.235s - Process_DestList end 74.266s - ParseJumpList finish 74.282s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\3de9158e9523a0fc.automaticDestinations-ms 74.313s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\3de9158e9523a0fc.automaticDestinations-ms 74.391s - Process_DestList start 74.407s - Process_DestList end 74.469s - ParseJumpList finish 74.500s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\43db12c05a51922a.automaticDestinations-ms 74.516s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\43db12c05a51922a.automaticDestinations-ms 74.563s - Process_DestList start 74.610s - Process_DestList end 74.625s - ParseJumpList finish 74.688s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\469e4a7982cea4d4.automaticDestinations-ms 74.719s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\469e4a7982cea4d4.automaticDestinations-ms 74.750s - Process_DestList start 74.797s - Process_DestList end 74.829s - ParseJumpList finish 74.860s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\46f433176bc0b3d2.automaticDestinations-ms 74.922s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\46f433176bc0b3d2.automaticDestinations-ms 75.000s - Process_DestList start 75.079s - Process_DestList end 75.110s - ParseJumpList finish 75.141s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4affda9510a85f92.automaticDestinations-ms 75.157s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4affda9510a85f92.automaticDestinations-ms 75.188s - Process_DestList start 75.219s - Process_DestList end 75.282s - ParseJumpList finish 75.297s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4cb9c5750d51c07f.automaticDestinations-ms 75.329s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4cb9c5750d51c07f.automaticDestinations-ms 75.375s - Process_DestList start 75.391s - Process_DestList end 75.422s - ParseJumpList finish 75.438s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4cbeb0480f758c36.automaticDestinations-ms 75.469s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4cbeb0480f758c36.automaticDestinations-ms 75.500s - ParseJumpList finish 75.516s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\50620fe75ee0093.automaticDestinations-ms 75.547s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\50620fe75ee0093.automaticDestinations-ms 75.563s - Process_DestList start 75.579s - Process_DestList end 75.610s - ParseJumpList finish 75.625s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5624d6548ae046e1.automaticDestinations-ms 75.657s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5624d6548ae046e1.automaticDestinations-ms 75.672s - Process_DestList start 75.704s - Process_DestList end 75.766s - ParseJumpList finish 75.797s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\59fe1486d27aa9d0.automaticDestinations-ms 75.829s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\59fe1486d27aa9d0.automaticDestinations-ms 75.860s - Process_DestList start 75.875s - Process_DestList end 75.907s - ParseJumpList finish 75.922s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5c5e4638f6459826.automaticDestinations-ms 75.985s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5c5e4638f6459826.automaticDestinations-ms 76.016s - Process_DestList start 76.063s - Process_DestList end 76.079s - ParseJumpList finish 76.110s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5d696d521de238c3.automaticDestinations-ms 76.141s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5d696d521de238c3.automaticDestinations-ms 76.157s - Process_DestList start 76.188s - Process_DestList end 76.204s - ParseJumpList finish 76.235s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 76.250s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms 76.282s - Process_DestList start 76.297s - Process_DestList end 76.313s - ParseJumpList finish 76.344s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6a19055025edb725.automaticDestinations-ms 76.360s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6a19055025edb725.automaticDestinations-ms 76.391s - Process_DestList start 76.407s - Process_DestList end 76.438s - ParseJumpList finish 76.454s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6bdc009bf2ee7a97.automaticDestinations-ms 76.469s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6bdc009bf2ee7a97.automaticDestinations-ms 76.500s - Process_DestList start 76.532s - Process_DestList end 76.547s - ParseJumpList finish 76.563s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6d2bac8f1edf6668.automaticDestinations-ms 76.610s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6d2bac8f1edf6668.automaticDestinations-ms 76.625s - Process_DestList start 76.688s - Process_DestList end 76.750s - ParseJumpList finish 76.766s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\74d7f43c1561fc1e.automaticDestinations-ms 76.797s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\74d7f43c1561fc1e.automaticDestinations-ms 76.813s - Process_DestList start 76.829s - Process_DestList end 76.860s - ParseJumpList finish 76.875s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\74ea779831912e30.automaticDestinations-ms 76.891s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\74ea779831912e30.automaticDestinations-ms 76.922s - Process_DestList start 76.954s - Process_DestList end 76.969s - ParseJumpList finish 76.985s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\7e4dca80246863e3.automaticDestinations-ms 77.016s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\7e4dca80246863e3.automaticDestinations-ms 77.032s - Process_DestList start 77.063s - Process_DestList end 77.125s - ParseJumpList finish 77.157s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\865490f117bb7afa.automaticDestinations-ms 77.204s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\865490f117bb7afa.automaticDestinations-ms 77.266s - Process_DestList start 77.313s - Process_DestList end 77.329s - ParseJumpList finish 77.360s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\89df8e0e6a355c25.automaticDestinations-ms 77.375s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\89df8e0e6a355c25.automaticDestinations-ms 77.407s - Process_DestList start 77.422s - Process_DestList end 77.469s - ParseJumpList finish 77.485s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\8cbfb718f912e2b9.automaticDestinations-ms 77.516s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\8cbfb718f912e2b9.automaticDestinations-ms 77.532s - Process_DestList start 77.594s - Process_DestList end 77.625s - ParseJumpList finish 77.657s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\8eafbd04ec8631ce.automaticDestinations-ms 77.672s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\8eafbd04ec8631ce.automaticDestinations-ms 77.688s - Process_DestList start 77.704s - Process_DestList end 77.719s - ParseJumpList finish 77.735s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\952114290200841d.automaticDestinations-ms 77.750s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\952114290200841d.automaticDestinations-ms 77.797s - Process_DestList start 77.813s - Process_DestList end 77.844s - ParseJumpList finish 77.891s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\99dffcfc0bc26e2b.automaticDestinations-ms 77.969s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\99dffcfc0bc26e2b.automaticDestinations-ms 77.985s - Process_DestList start 78.016s - Process_DestList end 78.032s - ParseJumpList finish 78.063s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9a165f62edbfa161.automaticDestinations-ms 78.079s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9a165f62edbfa161.automaticDestinations-ms 78.094s - Process_DestList start 78.157s - Process_DestList end 78.172s - ParseJumpList finish 78.188s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9b9cdc69c1c24e2b.automaticDestinations-ms 78.204s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9b9cdc69c1c24e2b.automaticDestinations-ms 78.219s - Process_DestList start 78.235s - Process_DestList end 78.250s - ParseJumpList finish 78.266s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9c087ed3662c5c8d.automaticDestinations-ms 78.282s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9c087ed3662c5c8d.automaticDestinations-ms 78.344s - Process_DestList start 78.360s - Process_DestList end 78.375s - ParseJumpList finish 78.391s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9d1f905ce5044aee.automaticDestinations-ms 78.438s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9d1f905ce5044aee.automaticDestinations-ms 78.547s - Process_DestList start 78.579s - Process_DestList end 78.594s - ParseJumpList finish 78.610s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\a52b0784bd667468.automaticDestinations-ms 78.625s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\a52b0784bd667468.automaticDestinations-ms 78.641s - Process_DestList start 78.672s - Process_DestList end 78.688s - ParseJumpList finish 78.766s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\aa5025d147eaa07a.automaticDestinations-ms 78.782s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\aa5025d147eaa07a.automaticDestinations-ms 78.829s - Process_DestList start 78.875s - Process_DestList end 78.938s - ParseJumpList finish 78.954s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b664b1b14f80e7d.automaticDestinations-ms 78.969s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b664b1b14f80e7d.automaticDestinations-ms 79.000s - Process_DestList start 79.016s - Process_DestList end 79.094s - ParseJumpList finish 79.110s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b8ab77100df80ab2.automaticDestinations-ms 79.141s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b8ab77100df80ab2.automaticDestinations-ms 79.157s - Process_DestList start 79.172s - Process_DestList end 79.204s - ParseJumpList finish 79.235s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\bdeb65b0e3ba55c5.automaticDestinations-ms 79.282s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\bdeb65b0e3ba55c5.automaticDestinations-ms 79.344s - Process_DestList start 79.360s - Process_DestList end 79.375s - ParseJumpList finish 79.391s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\c01d906d9b219f6e.automaticDestinations-ms 79.407s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\c01d906d9b219f6e.automaticDestinations-ms 79.469s - Process_DestList start 79.500s - Process_DestList end 79.516s - ParseJumpList finish 79.532s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\c97ff995997830b7.automaticDestinations-ms 79.547s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\c97ff995997830b7.automaticDestinations-ms 79.579s - Process_DestList start 79.594s - Process_DestList end 79.610s - ParseJumpList finish 79.625s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\d00655d2aa12ff6d.automaticDestinations-ms 79.641s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\d00655d2aa12ff6d.automaticDestinations-ms 79.657s - Process_DestList start 79.672s - Process_DestList end 79.688s - ParseJumpList finish 79.719s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\d06c94537ecaee12.automaticDestinations-ms 79.750s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\d06c94537ecaee12.automaticDestinations-ms 79.782s - Process_DestList start 79.813s - Process_DestList end 79.829s - ParseJumpList finish 79.891s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\de01afc90c2841e5.automaticDestinations-ms 79.907s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\de01afc90c2841e5.automaticDestinations-ms 79.938s - Process_DestList start 79.954s - Process_DestList end 79.985s - ParseJumpList finish 80.032s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\de48a32edcbe79e4.automaticDestinations-ms 80.079s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\de48a32edcbe79e4.automaticDestinations-ms 80.094s - Process_DestList start 80.125s - Process_DestList end 80.141s - ParseJumpList finish 80.157s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\e0671ea77cc0f77a.automaticDestinations-ms 80.172s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\e0671ea77cc0f77a.automaticDestinations-ms 80.204s - Process_DestList start 80.219s - Process_DestList end 80.235s - ParseJumpList finish 80.250s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\eab3dce6b65f08bf.automaticDestinations-ms 80.266s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\eab3dce6b65f08bf.automaticDestinations-ms 80.313s - Process_DestList start 80.344s - Process_DestList end 80.360s - ParseJumpList finish 80.375s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 80.391s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms 80.407s - Process_DestList start 80.407s - Process_DestList end 80.422s - ParseJumpList finish 80.438s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f18460fded109990.automaticDestinations-ms 80.454s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f18460fded109990.automaticDestinations-ms 80.469s - Process_DestList start 80.469s - Process_DestList end 80.485s - ParseJumpList finish 80.500s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f592f1aac8e2b561.automaticDestinations-ms 80.516s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f592f1aac8e2b561.automaticDestinations-ms 80.610s - Process_DestList start 80.625s - Process_DestList end 80.641s - ParseJumpList finish 80.657s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f7c954ca57d294a1.automaticDestinations-ms 80.657s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f7c954ca57d294a1.automaticDestinations-ms 80.750s - Process_DestList start 80.766s - Process_DestList end 80.782s - ParseJumpList finish 80.813s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms 80.860s - ParseJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms 80.875s - Process_DestList start 80.891s - Process_DestList end 81.000s - ParseJumpList finish 81.000s - DEBUG: JumpLists: Checking for Jump Lists in C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms 81.016s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1057b0110eb2adfd.customDestinations-ms 81.032s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1057b0110eb2adfd.customDestinations-ms 81.047s - ReadLINKINFO start 81.063s - ReadLINKINFO end 81.063s - ReadStringData start 81.079s - ReadStringData end 81.094s - ReadLINKINFO start 81.110s - ReadLINKINFO end 81.125s - ReadStringData start 81.141s - ReadStringData end 81.141s - ReadStringData start 81.157s - ReadStringData end 81.172s - ReadLINKINFO start 81.188s - ReadLINKINFO end 81.188s - ReadStringData start 81.204s - ReadStringData end 81.235s - ReadLINKINFO start 81.235s - ReadLINKINFO end 81.250s - ReadStringData start 81.266s - ReadStringData end 81.282s - ReadLINKINFO start 81.297s - ReadLINKINFO end 81.329s - ReadStringData start 81.391s - ReadStringData end 81.407s - ParseCustomJumpList end 81.422s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\188a63fb65e5f997.customDestinations-ms 81.438s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\188a63fb65e5f997.customDestinations-ms 81.454s - ReadLINKINFO start 81.469s - ReadLINKINFO end 81.469s - ReadStringData start 81.485s - ReadStringData end 81.532s - ReadLINKINFO start 81.625s - ReadLINKINFO end 81.750s - ReadStringData start 81.782s - ReadStringData end 81.844s - ReadLINKINFO start 81.891s - ReadLINKINFO end 81.954s - ReadStringData start 81.969s - ReadStringData end 81.985s - ParseCustomJumpList end 81.985s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\195a58ecf8b8c5b6.customDestinations-ms 82.000s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\195a58ecf8b8c5b6.customDestinations-ms 82.016s - ParseCustomJumpList end 82.032s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms 82.047s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms 82.079s - ReadLINKINFO start 82.094s - ReadLINKINFO end 82.125s - ReadStringData start 82.188s - ReadStringData end 82.250s - ReadLINKINFO start 82.329s - ReadLINKINFO end 82.375s - ReadStringData start 82.407s - ReadStringData end 82.422s - ReadLINKINFO start 82.469s - ReadLINKINFO end 82.469s - ReadStringData start 82.485s - ReadStringData end 82.500s - ReadStringData start 82.516s - ReadStringData end 82.532s - ReadStringData start 82.532s - ReadStringData end 82.547s - ReadStringData start 82.610s - ReadStringData end 82.657s - ReadStringData start 82.704s - ReadStringData end 82.782s - ReadStringData start 82.844s - ReadStringData end 82.875s - ReadStringData start 82.922s - ReadStringData end 82.969s - ReadStringData start 83.047s - ReadStringData end 83.094s - ReadStringData start 83.141s - ReadStringData end 83.219s - ReadStringData start 83.282s - ReadStringData end 83.329s - ParseCustomJumpList end 83.375s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\337ed59af273c758.customDestinations-ms 83.469s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\337ed59af273c758.customDestinations-ms 83.547s - ReadLINKINFO start 83.610s - ReadLINKINFO end 83.625s - ReadStringData start 83.641s - ReadStringData end 83.641s - ParseCustomJumpList end 83.657s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\345d5ed66bebccba.customDestinations-ms 83.672s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\345d5ed66bebccba.customDestinations-ms 83.688s - ReadLINKINFO start 83.688s - ReadLINKINFO end 83.704s - ReadStringData start 83.766s - ReadStringData end 83.813s - ReadLINKINFO start 83.860s - ReadLINKINFO end 83.922s - ReadStringData start 83.969s - ReadStringData end 84.000s - ReadLINKINFO start 84.094s - ReadLINKINFO end 84.141s - ReadStringData start 84.188s - ReadStringData end 84.250s - ReadLINKINFO start 84.282s - ReadLINKINFO end 84.360s - ReadStringData start 84.438s - ReadStringData end 84.500s - ParseCustomJumpList end 84.516s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\512e2e16d34bacf5.customDestinations-ms 84.532s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\512e2e16d34bacf5.customDestinations-ms 84.547s - ReadLINKINFO start 84.563s - ReadLINKINFO end 84.625s - ReadStringData start 84.641s - ReadStringData end 84.704s - ReadLINKINFO start 84.735s - ReadLINKINFO end 84.829s - ReadStringData start 84.860s - ReadStringData end 84.907s - ReadLINKINFO start 84.922s - ReadLINKINFO end 84.938s - ReadStringData start 85.000s - ReadStringData end 85.047s - ReadLINKINFO start 85.188s - ReadLINKINFO end 85.204s - ReadStringData start 85.219s - ReadStringData end 85.235s - ReadLINKINFO start 85.329s - ReadLINKINFO end 85.375s - ReadStringData start 85.422s - ReadStringData end 85.516s - ReadLINKINFO start 85.563s - ReadLINKINFO end 85.610s - ReadStringData start 85.625s - ReadStringData end 85.641s - ReadLINKINFO start 85.672s - ReadLINKINFO end 85.672s - ReadStringData start 85.688s - ReadStringData end 85.719s - ReadLINKINFO start 85.735s - ReadLINKINFO end 85.750s - ReadStringData start 85.766s - ReadStringData end 85.782s - ReadLINKINFO start 85.782s - ReadLINKINFO end 85.813s - ReadStringData start 85.844s - ReadStringData end 85.860s - ReadLINKINFO start 85.860s - ReadLINKINFO end 85.875s - ReadStringData start 85.891s - ReadStringData end 85.907s - ParseCustomJumpList end 85.922s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\59fe1486d27aa9d0.customDestinations-ms 85.922s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\59fe1486d27aa9d0.customDestinations-ms 85.938s - ReadLINKINFO start 85.954s - ReadLINKINFO end 85.969s - ReadStringData start 85.985s - ReadStringData end 85.985s - ReadLINKINFO start 86.000s - ReadLINKINFO end 86.141s - ReadStringData start 86.188s - ReadStringData end 86.204s - ReadLINKINFO start 86.235s - ReadLINKINFO end 86.235s - ReadStringData start 86.266s - ReadStringData end 86.282s - ReadLINKINFO start 86.297s - ReadLINKINFO end 86.313s - ReadStringData start 86.329s - ReadStringData end 86.329s - ParseCustomJumpList end 86.344s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms 86.375s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms 86.375s - ReadLINKINFO start 86.407s - ReadLINKINFO end 86.469s - ReadStringData start 86.516s - ReadStringData end 86.563s - ReadLINKINFO start 86.610s - ReadLINKINFO end 86.641s - ReadStringData start 86.719s - ReadStringData end 86.813s - ReadLINKINFO start 86.922s - ReadLINKINFO end 86.985s - ReadStringData start 87.047s - ReadStringData end 87.063s - ReadLINKINFO start 87.094s - ReadLINKINFO end 87.110s - ReadStringData start 87.188s - ReadStringData end 87.219s - ReadLINKINFO start 87.282s - ReadLINKINFO end 87.297s - ReadStringData start 87.297s - ReadStringData end 87.313s - ReadLINKINFO start 87.329s - ReadLINKINFO end 87.344s - ReadStringData start 87.375s - ReadStringData end 87.407s - ReadLINKINFO start 87.485s - ReadLINKINFO end 87.500s - ReadStringData start 87.532s - ReadStringData end 87.547s - ReadLINKINFO start 87.594s - ReadLINKINFO end 87.610s - ReadStringData start 87.625s - ReadStringData end 87.657s - ReadLINKINFO start 87.688s - ReadLINKINFO end 87.704s - ReadStringData start 87.719s - ReadStringData end 87.719s - ReadLINKINFO start 87.750s - ReadLINKINFO end 87.766s - ReadStringData start 87.782s - ReadStringData end 87.797s - ReadLINKINFO start 87.829s - ReadLINKINFO end 87.891s - ReadStringData start 87.907s - ReadStringData end 87.922s - ReadLINKINFO start 87.938s - ReadLINKINFO end 87.954s - ReadStringData start 87.969s - ReadStringData end 88.000s - ParseCustomJumpList end 88.016s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6e65f7f55e47857e.customDestinations-ms 88.047s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6e65f7f55e47857e.customDestinations-ms 88.047s - ReadLINKINFO start 88.063s - ReadLINKINFO end 88.079s - ReadStringData start 88.094s - ReadStringData end 88.110s - ReadLINKINFO start 88.125s - ReadLINKINFO end 88.157s - ReadStringData start 88.235s - ReadStringData end 88.329s - ReadLINKINFO start 88.344s - ReadLINKINFO end 88.360s - ReadStringData start 88.375s - ReadStringData end 88.391s - ParseCustomJumpList end 88.422s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms 88.485s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms 88.500s - ReadLINKINFO start 88.516s - ReadLINKINFO end 88.532s - ReadStringData start 88.547s - ReadStringData end 88.579s - ReadLINKINFO start 88.594s - ReadLINKINFO end 88.625s - ReadStringData start 88.657s - ReadStringData end 88.672s - ParseCustomJumpList end 88.688s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\79bc3d8b70e33c5e.customDestinations-ms 88.766s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\79bc3d8b70e33c5e.customDestinations-ms 88.829s - ReadLINKINFO start 88.829s - ReadLINKINFO end 88.844s - ReadStringData start 88.860s - ReadStringData end 88.875s - ReadStringData start 88.891s - ReadStringData end 88.891s - ReadLINKINFO start 88.907s - ReadLINKINFO end 88.922s - ReadStringData start 88.938s - ReadStringData end 88.954s - ReadLINKINFO start 88.969s - ReadLINKINFO end 88.985s - ReadStringData start 89.000s - ReadStringData end 89.000s - ReadLINKINFO start 89.016s - ReadLINKINFO end 89.032s - ReadStringData start 89.047s - ReadStringData end 89.047s - ReadLINKINFO start 89.063s - ReadLINKINFO end 89.079s - ReadStringData start 89.094s - ReadStringData end 89.110s - ReadLINKINFO start 89.110s - ReadLINKINFO end 89.125s - ReadStringData start 89.141s - ReadStringData end 89.204s - ReadLINKINFO start 89.219s - ReadLINKINFO end 89.235s - ReadStringData start 89.250s - ReadStringData end 89.266s - ReadLINKINFO start 89.282s - ReadLINKINFO end 89.282s - ReadStringData start 89.297s - ReadStringData end 89.360s - ParseCustomJumpList end 89.375s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9d1f905ce5044aee.customDestinations-ms 89.391s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9d1f905ce5044aee.customDestinations-ms 89.407s - ReadStringData start 89.407s - ReadStringData end 89.438s - ReadStringData start 89.469s - ReadStringData end 89.547s - ParseCustomJumpList end 89.563s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-ms 89.579s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-ms 89.594s - ReadLINKINFO start 89.625s - ReadLINKINFO end 89.641s - ReadStringData start 89.672s - ReadStringData end 89.688s - ReadStringData start 89.704s - ReadStringData end 89.719s - ReadLINKINFO start 89.735s - ReadLINKINFO end 89.750s - ReadStringData start 89.750s - ReadStringData end 89.766s - ReadLINKINFO start 89.797s - ReadLINKINFO end 89.797s - ReadStringData start 89.813s - ReadStringData end 89.829s - ReadLINKINFO start 89.844s - ReadLINKINFO end 89.860s - ReadStringData start 89.875s - ReadStringData end 89.875s - ReadLINKINFO start 89.891s - ReadLINKINFO end 89.938s - ReadStringData start 89.954s - ReadStringData end 90.032s - ParseCustomJumpList end 90.032s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ec3e36af0cdcb3e1.customDestinations-ms 90.047s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ec3e36af0cdcb3e1.customDestinations-ms 90.063s - ReadLINKINFO start 90.079s - ReadLINKINFO end 90.079s - ReadStringData start 90.141s - ReadStringData end 90.188s - ReadLINKINFO start 90.204s - ReadLINKINFO end 90.219s - ReadStringData start 90.219s - ReadStringData end 90.235s - ReadLINKINFO start 90.250s - ReadLINKINFO end 90.266s - ReadStringData start 90.297s - ReadStringData end 90.313s - ReadLINKINFO start 90.329s - ReadLINKINFO end 90.329s - ReadStringData start 90.344s - ReadStringData end 90.360s - ReadLINKINFO start 90.375s - ReadLINKINFO end 90.454s - ReadStringData start 90.469s - ReadStringData end 90.485s - ReadLINKINFO start 90.500s - ReadLINKINFO end 90.516s - ReadStringData start 90.563s - ReadStringData end 90.594s - ReadLINKINFO start 90.594s - ReadLINKINFO end 90.610s - ReadStringData start 90.625s - ReadStringData end 90.641s - ReadLINKINFO start 90.657s - ReadLINKINFO end 90.657s - ReadStringData start 90.672s - ReadStringData end 90.704s - ReadLINKINFO start 90.719s - ReadLINKINFO end 90.782s - ReadStringData start 90.860s - ReadStringData end 90.891s - ReadLINKINFO start 90.954s - ReadLINKINFO end 91.000s - ReadStringData start 91.016s - ReadStringData end 91.032s - ReadLINKINFO start 91.063s - ReadLINKINFO end 91.079s - ReadStringData start 91.094s - ReadStringData end 91.125s - ReadLINKINFO start 91.157s - ReadLINKINFO end 91.188s - ReadStringData start 91.204s - ReadStringData end 91.219s - ReadLINKINFO start 91.235s - ReadLINKINFO end 91.250s - ReadStringData start 91.266s - ReadStringData end 91.282s - ReadLINKINFO start 91.297s - ReadLINKINFO end 91.329s - ReadStringData start 91.344s - ReadStringData end 91.360s - ReadLINKINFO start 91.375s - ReadLINKINFO end 91.422s - ReadStringData start 91.454s - ReadStringData end 91.469s - ReadLINKINFO start 91.485s - ReadLINKINFO end 91.563s - ReadStringData start 91.579s - ReadStringData end 91.641s - ReadLINKINFO start 91.719s - ReadLINKINFO end 91.735s - ReadStringData start 91.750s - ReadStringData end 91.766s - ReadLINKINFO start 91.782s - ReadLINKINFO end 91.829s - ReadStringData start 91.844s - ReadStringData end 91.954s - ReadLINKINFO start 91.969s - ReadLINKINFO end 91.985s - ReadStringData start 92.016s - ReadStringData end 92.047s - ReadLINKINFO start 92.172s - ReadLINKINFO end 92.204s - ReadStringData start 92.250s - ReadStringData end 92.266s - ReadLINKINFO start 92.282s - ReadLINKINFO end 92.329s - ReadStringData start 92.344s - ReadStringData end 92.360s - ReadLINKINFO start 92.375s - ReadLINKINFO end 92.391s - ReadStringData start 92.422s - ReadStringData end 92.438s - ReadLINKINFO start 92.454s - ReadLINKINFO end 92.469s - ReadStringData start 92.485s - ReadStringData end 92.500s - ReadLINKINFO start 92.516s - ReadLINKINFO end 92.532s - ReadStringData start 92.579s - ReadStringData end 92.610s - ReadLINKINFO start 92.625s - ReadLINKINFO end 92.641s - ReadStringData start 92.657s - ReadStringData end 92.704s - ReadStringData start 92.719s - ReadStringData end 92.750s - ReadLINKINFO start 92.782s - ReadLINKINFO end 92.797s - ReadStringData start 92.813s - ReadStringData end 92.829s - ReadLINKINFO start 92.844s - ReadLINKINFO end 92.891s - ReadStringData start 92.922s - ReadStringData end 92.954s - ReadLINKINFO start 93.016s - ReadLINKINFO end 93.047s - ReadStringData start 93.063s - ReadStringData end 93.079s - ParseCustomJumpList end 93.094s - DEBUG: JumpLists: Processing C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms 93.110s - ParseCustomJumpList start: C:\Users\xrenx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms 93.125s - ParseCustomJumpList end 93.157s - LocalOSEnv::GetNextUser start 93.172s - LocalOSEnv::GetNextUser ubununtu check 93.188s - LocalOSEnv::GetNextUser cleanup profile path 93.204s - LocalOSEnv::GetNextUser cleanup profile path 93.219s - LocalOSEnv::GetNextUser end 93.235s - Recent Activity Scan: Chat Logs 93.250s - LocalOSEnv::GetNextUser start 93.266s - LocalOSEnv::GetNextUser xp check 93.329s - LocalOSEnv::GetNextUser cleanup profile path 93.375s - LocalOSEnv::GetNextUser win7/mac check 93.438s - LocalOSEnv::GetNextUser cleanup profile path 93.485s - . 93.625s - .. 93.657s - All Users 93.719s - LocalOSEnv::GetNextUser finish 93.750s - LocalOSEnv::GetNextUser start 93.766s - Default 93.782s - LocalOSEnv::GetNextUser finish 93.797s - LocalOSEnv::GetNextUser start 93.813s - Default User 93.829s - LocalOSEnv::GetNextUser finish 93.891s - LocalOSEnv::GetNextUser start 93.907s - Default.migrated 93.954s - LocalOSEnv::GetNextUser finish 93.969s - LocalOSEnv::GetNextUser start 93.985s - desktop.ini 94.032s - Public 94.032s - LocalOSEnv::GetNextUser finish 94.063s - LocalOSEnv::GetNextUser start 94.079s - xrenx 94.110s - LocalOSEnv::GetNextUser finish 94.125s - LocalOSEnv::GetNextUser start 94.157s - Recent Activity Scan: Events 94.172s - DEBUG: Scanning log file: C:\Windows\System32\winevt\Logs\Security.evtx 95.485s - DEBUG: Scanning log file: C:\Windows\System32\winevt\Logs\System.evtx 95.610s - DEBUG: Scanning log file: C:\Windows\System32\winevt\Logs\Application.evtx 95.657s - DEBUG: Scanning log file: C:\Windows\System32\winevt\Logs\OAlerts.evtx 95.672s - Recent Activity Scan: Get Firefox info start 95.672s - LocalOSEnv::GetNextUser start 95.688s - LocalOSEnv::GetNextUser xp check 95.719s - LocalOSEnv::GetNextUser cleanup profile path 95.719s - LocalOSEnv::GetNextUser win7/mac check 95.735s - LocalOSEnv::GetNextUser cleanup profile path 95.735s - . 95.750s - .. 95.782s - All Users 95.797s - LocalOSEnv::GetNextUser finish 95.813s - LocalOSEnv::GetNextUser start 95.829s - Default 95.829s - LocalOSEnv::GetNextUser finish 95.844s - LocalOSEnv::GetNextUser start 95.844s - Default User 95.860s - LocalOSEnv::GetNextUser finish 95.907s - LocalOSEnv::GetNextUser start 95.938s - Default.migrated 95.938s - LocalOSEnv::GetNextUser finish 95.954s - LocalOSEnv::GetNextUser start 95.969s - desktop.ini 95.985s - Public 96.000s - LocalOSEnv::GetNextUser finish 96.016s - LocalOSEnv::GetNextUser start 96.016s - xrenx 96.032s - LocalOSEnv::GetNextUser finish 96.047s - LocalOSEnv::GetNextUser start 96.063s - Recent Activity Scan: Get Firefox info finish 96.079s - Recent Activity Scan: Get Chrome info start 96.094s - LocalOSEnv::GetNextUser start 96.125s - LocalOSEnv::GetNextUser xp check 96.125s - LocalOSEnv::GetNextUser cleanup profile path 96.141s - LocalOSEnv::GetNextUser win7/mac check 96.157s - LocalOSEnv::GetNextUser cleanup profile path 96.157s - . 96.188s - .. 96.188s - All Users 96.204s - LocalOSEnv::GetNextUser finish 96.250s - Scanning C:\Users\All Users\AppData\Local\Google\Chrome\User Data\* for Chrome Profiles. 96.266s - Recent Activity Scan: GetChromeInfo : Get next user 96.266s - LocalOSEnv::GetNextUser start 96.282s - Default 96.297s - LocalOSEnv::GetNextUser finish 96.313s - Scanning C:\Users\Default\AppData\Local\Google\Chrome\User Data\* for Chrome Profiles. 96.329s - Recent Activity Scan: GetChromeInfo : Get next user 96.344s - LocalOSEnv::GetNextUser start 96.360s - Default User 96.360s - LocalOSEnv::GetNextUser finish 96.375s - Scanning C:\Users\Default User\AppData\Local\Google\Chrome\User Data\* for Chrome Profiles. 96.454s - Recent Activity Scan: GetChromeInfo : Get next user 96.469s - LocalOSEnv::GetNextUser start 96.485s - Default.migrated 96.500s - LocalOSEnv::GetNextUser finish 96.500s - Scanning C:\Users\Default.migrated\AppData\Local\Google\Chrome\User Data\* for Chrome Profiles. 96.516s - Recent Activity Scan: GetChromeInfo : Get next user 96.532s - LocalOSEnv::GetNextUser start 96.532s - desktop.ini 96.579s - Public 96.579s - LocalOSEnv::GetNextUser finish 96.594s - Scanning C:\Users\Public\AppData\Local\Google\Chrome\User Data\* for Chrome Profiles. 96.610s - Recent Activity Scan: GetChromeInfo : Get next user 96.610s - LocalOSEnv::GetNextUser start 96.641s - xrenx 96.657s - LocalOSEnv::GetNextUser finish 96.657s - Scanning C:\Users\xrenx\AppData\Local\Google\Chrome\User Data\* for Chrome Profiles. 96.688s - C:\Users\xrenx\AppData\Local\Google\Chrome\User Data\Default 96.688s - Recent Activity Scan: Chrome URLs 97.438s - Failed to Create Temp File Error Code: 2, The system cannot find the file specified. C:\Users\xrenx\AppData\Local\Google\Chrome\User Data\Default\Archived History 97.454s - Recent Activity Scan: Chrome Cookies 97.672s - Recent Activity Scan: Chrome Downloads 97.750s - Recent Activity Scan: Chrome Bookmarks 97.782s - Recent Activity Scan: Chrome form data 97.860s - Recent Activity Scan: GetChromeInfo : Get next user 97.875s - LocalOSEnv::GetNextUser start 97.875s - Recent Activity Scan: GetChromeInfo: no more users 97.891s - Recent Activity Scan: Get Chrome info finish 97.907s - Recent Activity Scan: Get Safari info start 97.922s - LocalOSEnv::GetNextUser start 97.922s - LocalOSEnv::GetNextUser xp check 97.938s - LocalOSEnv::GetNextUser cleanup profile path 97.954s - LocalOSEnv::GetNextUser win7/mac check 97.969s - LocalOSEnv::GetNextUser cleanup profile path 97.969s - . 97.985s - .. 98.000s - All Users 98.016s - LocalOSEnv::GetNextUser finish 98.016s - Recent Activity Scan: Safari URLs 98.047s - Recent Activity Scan: Safari Cookies 98.047s - Recent Activity Scan: Safari Downloads 98.063s - Recent Activity Scan: Safari Bookmarks 98.079s - LocalOSEnv::GetNextUser start 98.125s - Default 98.141s - LocalOSEnv::GetNextUser finish 98.141s - Recent Activity Scan: Safari URLs 98.172s - Recent Activity Scan: Safari Cookies 98.172s - Recent Activity Scan: Safari Downloads 98.188s - Recent Activity Scan: Safari Bookmarks 98.204s - LocalOSEnv::GetNextUser start 98.204s - Default User 98.250s - LocalOSEnv::GetNextUser finish 98.250s - Recent Activity Scan: Safari URLs 98.313s - Recent Activity Scan: Safari Cookies 98.329s - Recent Activity Scan: Safari Downloads 98.344s - Recent Activity Scan: Safari Bookmarks 98.344s - LocalOSEnv::GetNextUser start 98.360s - Default.migrated 98.391s - LocalOSEnv::GetNextUser finish 98.391s - Recent Activity Scan: Safari URLs 98.422s - Recent Activity Scan: Safari Cookies 98.454s - Recent Activity Scan: Safari Downloads 98.485s - Recent Activity Scan: Safari Bookmarks 98.485s - LocalOSEnv::GetNextUser start 98.500s - desktop.ini 98.532s - Public 98.547s - LocalOSEnv::GetNextUser finish 98.579s - Recent Activity Scan: Safari URLs 98.594s - Recent Activity Scan: Safari Cookies 98.625s - Recent Activity Scan: Safari Downloads 98.625s - Recent Activity Scan: Safari Bookmarks 98.641s - LocalOSEnv::GetNextUser start 98.704s - xrenx 98.735s - LocalOSEnv::GetNextUser finish 98.750s - Recent Activity Scan: Safari URLs 98.766s - Recent Activity Scan: Safari Cookies 98.782s - Recent Activity Scan: Safari Downloads 98.844s - Recent Activity Scan: Safari Bookmarks 98.860s - LocalOSEnv::GetNextUser start 98.860s - Recent Activity Scan: Get Safari info finish 98.875s - Recent Activity Scan: Get Opera info start 98.891s - LocalOSEnv::GetNextUser start 98.891s - LocalOSEnv::GetNextUser xp check 98.938s - LocalOSEnv::GetNextUser cleanup profile path 98.954s - LocalOSEnv::GetNextUser win7/mac check 98.954s - LocalOSEnv::GetNextUser cleanup profile path 99.000s - . 99.000s - .. 99.032s - All Users 99.047s - LocalOSEnv::GetNextUser finish 99.063s - C:\Users\All Users\AppData\Roaming\Opera\Opera 99.063s - opera version: 0 99.079s - Recent Activity Scan: Opera URLs 99.094s - Recent Activity Scan: Opera Cookies 99.094s - Recent Activity Scan: ProcessOperaCookies start 99.110s - Trying