g3log created log at: Sun Jul 02 14:39:54 2023
		LOG format: [YYYY/MM/DD hh:mm:ss uuu* LEVEL FILE->FUNCTION:LINE] message		(uuu*: microseconds fractions of the seconds value)

2023/07/02 14:39:54 673730	DEBUG [OSForensics.cpp->CheckRunInUSBMode:2748]	LOGGER NOT INITIALIZED:
		CheckRunInUSBMode: Not Running from Removable DriveCheckRunInUSBMode: Not Running from Removable Drive
2023/07/02 14:40:23 014798	DEBUG [OSForensics.cpp->wWinMain:231]	DEBUG: Starting...
2023/07/02 14:40:23 014808	DEBUG [OSForensics.cpp->wWinMain:237]	DEBUG: 2023/7/2, 14:40:23
2023/07/02 14:40:23 014811	DEBUG [OSForensics.cpp->wWinMain:241]	DEBUG: OSForensics 10.0 build 1014 64-bit
2023/07/02 14:40:23 014899	DEBUG [OSForensics.cpp->wWinMain:249]	DEBUG OS: Windows 10 Home build 19045 (64-bit)
2023/07/02 14:40:23 014903	DEBUG [OSForensics.cpp->wWinMain:251]	DEBUG Path: C:\Program Files\OSForensics
2023/07/02 14:40:23 014992	DEBUG [OSForensics.cpp->wWinMain:259]	Date: 07/02/23 14:40:23
2023/07/02 14:40:23 017439	DEBUG [OSForensics.cpp->wWinMain:275]	Main: Regproc check
2023/07/02 14:40:23 132905	DEBUG [OSForensics.cpp->wWinMain:315]	Main: Set security OK
2023/07/02 14:40:23 132919	DEBUG [OSForensics.cpp->wWinMain:327]	Main: Creating temp folder C:\ProgramData\PassMark\OSForensics\Temp\2264
2023/07/02 14:40:23 137396	DEBUG [OSForensics.cpp->wWinMain:344]	Main: Available phys mem: 8659693568
2023/07/02 14:40:23 137650	DEBUG [OSForensics.cpp->wWinMain:385]	Main: Load OSF config
2023/07/02 14:40:23 181502	DEBUG [OSForensics.cpp->wWinMain:422]	Main: Init OSFMount interface OK
2023/07/02 14:40:23 190481	DEBUG [OSForensics.cpp->wWinMain:453]	Main: Init direct access OK
2023/07/02 14:40:23 305826	DEBUG [OSForensics.cpp->wWinMain:513]	Main: Register disk events
2023/07/02 14:40:23 305920	DEBUG [OSForensics.cpp->wWinMain:523]	Main: init dialog
2023/07/02 14:40:23 305924	DEBUG [OSForensics.cpp->InitDialog:1225]	Init main dialog
2023/07/02 14:40:23 373982	DEBUG [CfgMain.cpp->InitCfgMain:399]	CfgMain: Creating start window
2023/07/02 14:40:23 385667	DEBUG [CfgMain.cpp->InitCfgMain:402]	CfgMain: Creating signature window
2023/07/02 14:40:23 387543	DEBUG [CfgMain.cpp->InitCfgMain:411]	CfgMain: Creating FileHashing window
2023/07/02 14:40:23 389321	DEBUG [CfgFileHashing.cpp->FileHashingWindow::InitWindow:259]	FileHashing: Creating Hash Sets Tab
2023/07/02 14:40:23 403735	DEBUG [CfgFileHashing.cpp->FileHashingWindow::InitWindow:261]	FileHashing: Creating Create Hash Tab
2023/07/02 14:40:23 443315	DEBUG [CfgMain.cpp->InitCfgMain:424]	CfgMain: Creating file name search window
2023/07/02 14:40:23 529448	DEBUG [CfgMain.cpp->InitCfgMain:426]	CfgMain: Creating mismatch search window
2023/07/02 14:40:23 560907	DEBUG [CfgMain.cpp->InitCfgMain:428]	CfgMain: Creating create index window
2023/07/02 14:40:23 563546	DEBUG [CfgMain.cpp->InitCfgMain:430]	CfgMain: Creating search index window
2023/07/02 14:40:23 583363	DEBUG [CfgMain.cpp->InitCfgMain:432]	CfgMain: Creating user activity window
2023/07/02 14:40:23 611327	DEBUG [CfgMain.cpp->InitCfgMain:434]	CfgMain: Creating deleted file search window
2023/07/02 14:40:23 652209	DEBUG [CfgMain.cpp->InitCfgMain:436]	CfgMain: Creating mem viewer window
2023/07/02 14:40:23 654223	DEBUG [CfgMain.cpp->InitCfgMain:438]	CfgMain: Creating prefetch viewer window
2023/07/02 14:40:23 656929	DEBUG [CfgMain.cpp->InitCfgMain:441]	CfgMain: Creating raw disk viewer window
2023/07/02 14:40:23 665147	DEBUG [CfgMain.cpp->InitCfgMain:443]	CfgMain: Creating sys info window
2023/07/02 14:40:23 680588	DEBUG [CfgMain.cpp->InitCfgMain:445]	CfgMain: Creating drive prep window
2023/07/02 14:40:23 708913	DEBUG [CfgMain.cpp->InitCfgMain:447]	CfgMain: Creating password window
2023/07/02 14:40:23 726088	DEBUG [CfgMain.cpp->InitCfgMain:449]	CfgMain: Creating forensic imaging window
2023/07/02 14:40:23 729516	DEBUG [CfgMain.cpp->InitCfgMain:451]	CfgMain: Creating boot virtual machine window
2023/07/02 14:40:23 732360	DEBUG [CfgMain.cpp->InitCfgMain:455]	CfgMain: Creating Mobile Artifact window
2023/07/02 14:40:23 743081	DEBUG [CfgMain.cpp->InitCfgMain:457]	CfgMain: Creating remote acquisition window
2023/07/02 14:40:23 764567	DEBUG [CfgMain.cpp->InitCfgMain:465]	CfgMain: Creating manage case window
2023/07/02 14:40:23 793090	DEBUG [CfgMain.cpp->InitCfgMain:469]	CfgMain: Creating triage window
2023/07/02 14:40:23 818691	DEBUG [CfgMain.cpp->InitCfgMain:472]	CfgMain: set focus
2023/07/02 14:40:23 849529	DEBUG [OSForensics.cpp->InitDialog:1245]	Init main dialog finished
2023/07/02 14:40:23 849536	DEBUG [OSForensics.cpp->wWinMain:527]	Main: show window
2023/07/02 14:40:23 910109	DEBUG [OSForensics.cpp->wWinMain:546]	Main: set Foreground
2023/07/02 14:40:23 910207	DEBUG [OSForensics.cpp->wWinMain:557]	Main: PopFileInitialize
2023/07/02 14:40:23 910295	DEBUG [OSForensics.cpp->wWinMain:575]	Main: Display welcome
2023/07/02 14:40:23 915039	DEBUG [OSForensics.cpp->wWinMain:589]	Main: SubCheck
2023/07/02 14:40:25 696314	DEBUG [OSForensics.cpp->wWinMain:839]	CaseManagementInitWindow: No case successfully loaded. Setting default drive to C:\
2023/07/02 14:40:25 698463	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:419]	Pswd: Creating Passwords & keys tab
2023/07/02 14:40:25 698469	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:421]	Pswd: Creating Windows Login tab
2023/07/02 14:40:25 716056	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:423]	Pswd: Initializing rainbow
2023/07/02 14:40:25 716149	DEBUG [main.cpp->initRainbowCrack:152]	Rainbow: Loading charsets from C:\ProgramData\PassMark\OSForensics\RainbowTables\charset.txt
2023/07/02 14:40:25 716277	DEBUG [main.cpp->initRainbowCrack:158]	Rainbow: Initializing SSL
2023/07/02 14:40:25 716281	DEBUG [main.cpp->initRainbowCrack:160]	Rainbow: Initializing SSL
2023/07/02 14:40:25 717041	DEBUG [main.cpp->initRainbowCrack:173]	Rainbow: Initializing Rainbow Table
2023/07/02 14:40:25 717045	DEBUG [main.cpp->initRainbowCrack:175]	Rainbow: Initializing RainbowTable
2023/07/02 14:40:25 717049	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:425]	Pswd: Creating Rainbow Generate tab
2023/07/02 14:40:25 807004	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:427]	Pswd: Creating Rainbow Retrieval tab
2023/07/02 14:40:25 824585	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:429]	Pswd: Creating Decryption tab
2023/07/02 14:40:25 849423	DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:431]	Pswd: Creating Install PFX tab
2023/07/02 14:40:25 866016	DEBUG [CfgSignature.cpp->SignatureWindow::InitWindow:200]	Sig: Creating create sig tab
2023/07/02 14:40:25 880580	DEBUG [CfgSignature.cpp->SignatureWindow::InitWindow:202]	Sig: Creating compare sig tab
2023/07/02 14:40:25 903608	DEBUG [OSForensics.cpp->wWinMain:853]	CaseManagementInitWindow: Message loop
2023/07/02 14:40:26 923752	DEBUG [misc.cpp->RefreshPhysicalDisks:5478]	Refresh Disks: sysinfo get partition info
2023/07/02 14:40:28 435696	DEBUG [misc.cpp->RefreshPhysicalDisks:5490]	Refresh Disks: Open device: \\.\PhysicalDrive0
2023/07/02 14:40:28 436222	DEBUG [misc.cpp->RefreshPhysicalDisks:5496]	Refresh Disks: Scan part table
2023/07/02 14:40:28 440796	DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2102]	Scanning for recovered file systems (StartSec=0,NumSec=2048)
2023/07/02 14:40:28 446441	DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2110]	Scanning for recovered file systems (StartSec=234438656,NumSec=2992)
2023/07/02 14:40:28 452874	DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2113]	Found 0 recovered file systems
2023/07/02 14:40:28 452914	DEBUG [misc.cpp->RefreshPhysicalDisks:5490]	Refresh Disks: Open device: \\.\PhysicalDrive1
2023/07/02 14:40:28 453451	DEBUG [misc.cpp->RefreshPhysicalDisks:5496]	Refresh Disks: Scan part table
2023/07/02 14:40:28 454831	DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2102]	Scanning for recovered file systems (StartSec=0,NumSec=34)
2023/07/02 14:40:28 458524	DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2110]	Scanning for recovered file systems (StartSec=1953521664,NumSec=3504)
2023/07/02 14:40:28 510750	DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2113]	Found 0 recovered file systems
2023/07/02 14:40:28 534533	DEBUG [CfgRecent.cpp->DoSort:2850]	User Activity Scan: Sorting
2023/07/02 14:40:32 387557	DEBUG [CfgRecent.cpp->OnScan:3516]	User Activity Scan: Begin
2023/07/02 14:40:32 387599	DEBUG [OSFActivityMonitor.cpp->OSFActivityMonitor::StartTask:198]	Activity Monitor: Task Started (User Activity)
2023/07/02 14:40:32 387611	DEBUG [CfgRecent.cpp->OnScan:3523]	User Activity Scan started on live machine
2023/07/02 14:40:32 409084	DEBUG [CfgRecent.cpp->OnScan:3665]	User Activity Scan: Available phys mem: 8639025152
2023/07/02 14:40:32 409091	DEBUG [CfgRecent.cpp->OnScan:3672]	User Activity Scan: Allocating MRUList
2023/07/02 14:40:32 409172	DEBUG [CfgRecent.cpp->OnScan:3674]	User Activity Scan: Allocating installList
2023/07/02 14:40:32 409190	DEBUG [CfgRecent.cpp->OnScan:3676]	User Activity Scan: Allocating autoRunList
2023/07/02 14:40:32 409229	DEBUG [CfgRecent.cpp->OnScan:3678]	User Activity Scan: Allocating ClipboardList
2023/07/02 14:40:32 409271	DEBUG [CfgRecent.cpp->OnScan:3680]	User Activity Scan: Allocating EventList
2023/07/02 14:40:32 409310	DEBUG [CfgRecent.cpp->OnScan:3682]	User Activity Scan: Allocating userAssistList
2023/07/02 14:40:32 409322	DEBUG [CfgRecent.cpp->OnScan:3684]	User Activity Scan: Allocating jumpListList
2023/07/02 14:40:32 409354	DEBUG [CfgRecent.cpp->OnScan:3686]	User Activity Scan: Allocating shellBagList
2023/07/02 14:40:32 409393	DEBUG [CfgRecent.cpp->OnScan:3688]	User Activity Scan: Allocating TimelineDBList
2023/07/02 14:40:32 409432	DEBUG [CfgRecent.cpp->OnScan:3690]	User Activity Scan: Allocating CortanaList
2023/07/02 14:40:32 409470	DEBUG [CfgRecent.cpp->OnScan:3692]	User Activity Scan: Allocating RecycleBinList
2023/07/02 14:40:32 409508	DEBUG [CfgRecent.cpp->OnScan:3694]	User Activity Scan: Allocating ShimCacheList
2023/07/02 14:40:32 409545	DEBUG [CfgRecent.cpp->OnScan:3696]	User Activity Scan: Allocating SRUMDBList
2023/07/02 14:40:32 409582	DEBUG [CfgRecent.cpp->OnScan:3698]	User Activity Scan: Allocating prefetchList
2023/07/02 14:40:32 409620	DEBUG [CfgRecent.cpp->OnScan:3700]	User Activity Scan: Allocating winsearchList
2023/07/02 14:40:32 409657	DEBUG [CfgRecent.cpp->OnScan:3702]	User Activity Scan: Allocating gBAMList
2023/07/02 14:40:32 409699	DEBUG [CfgRecent.cpp->OnScan:3704]	User Activity Scan: Allocating gAntiForensicsList
2023/07/02 14:40:32 409739	DEBUG [CfgRecent.cpp->OnScan:3709]	User Activity Scan: Available phys mem: 8638980096
2023/07/02 14:40:32 409742	DEBUG [CfgRecent.cpp->OnScan:3711]	User Activity Scan: Allocating downloadList
2023/07/02 14:40:32 409778	DEBUG [CfgRecent.cpp->OnScan:3713]	User Activity Scan: Allocating urlList
2023/07/02 14:40:32 409814	DEBUG [CfgRecent.cpp->OnScan:3715]	User Activity Scan: Allocating SearchTermList
2023/07/02 14:40:32 409855	DEBUG [CfgRecent.cpp->OnScan:3717]	User Activity Scan: Allocating LoginList
2023/07/02 14:40:32 410036	DEBUG [CfgRecent.cpp->OnScan:3719]	User Activity Scan: Allocating formList
2023/07/02 14:40:32 410052	DEBUG [CfgRecent.cpp->OnScan:3721]	User Activity Scan: Allocating bookmarkList
2023/07/02 14:40:32 410085	DEBUG [CfgRecent.cpp->OnScan:3723]	User Activity Scan: Allocating ChatList
2023/07/02 14:40:32 410123	DEBUG [CfgRecent.cpp->OnScan:3725]	User Activity Scan: Allocating P2PList
2023/07/02 14:40:32 410161	DEBUG [CfgRecent.cpp->OnScan:3727]	User Activity Scan: Allocating wlanList
2023/07/02 14:40:32 410198	DEBUG [CfgRecent.cpp->OnScan:3729]	User Activity Scan: Allocating gCryptocurrencyList
2023/07/02 14:40:32 410236	DEBUG [CfgRecent.cpp->OnScan:3731]	User Activity Scan: Allocating cookieList
2023/07/02 14:40:32 410272	DEBUG [CfgRecent.cpp->OnScan:3733]	User Activity Scan: Allocating Custom Dictionary List
2023/07/02 14:40:32 410309	DEBUG [CfgRecent.cpp->OnScan:3738]	User Activity Scan: Available phys mem: 8638857216
2023/07/02 14:40:32 410312	DEBUG [CfgRecent.cpp->OnScan:3740]	User Activity Scan: Allocating UsbList
2023/07/02 14:40:32 410347	DEBUG [CfgRecent.cpp->OnScan:3742]	User Activity Scan: Allocating mountedVolList
2023/07/02 14:40:32 410384	DEBUG [CfgRecent.cpp->OnScan:3744]	User Activity Scan: Allocating MobileBackupList
2023/07/02 14:40:32 412636	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7597]	GetLocalFolderNames: check SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2023/07/02 14:40:32 412642	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7601]	GetLocalFolderNames: Key loaded successfully
2023/07/02 14:40:32 412656	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7621]	GetLocaFolderNames: DocumentsAndSettingsLocalName Users
2023/07/02 14:40:32 412663	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7643]	GetLocaFolderNames: CommonAppDataLocalName ProgramData
2023/07/02 14:40:32 412716	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7670]	GetLocalFolderNames: Could not query "{374DE290-123F-4565-9164-39C4925E467B}"
2023/07/02 14:40:32 412723	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7692]	GetLocalFolderNames: Could not query "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"
2023/07/02 14:40:32 412730	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7714]	GetLocalFolderNames: Could not query "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
2023/07/02 14:40:32 412739	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133]	CreateTempRegFileIfNeeded: A
2023/07/02 14:40:32 412819	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138]	CreateTempRegFileIfNeeded: B
2023/07/02 14:40:32 412824	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3212]	CreateTempRegFileIfNeeded: Error - file handle invalid (3)
2023/07/02 14:40:32 412830	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7792]	GetLocaFolderNames: Registry Info: Could not load C:\Windows.old\Windows\System32\Config\SOFTWARE
2023/07/02 14:40:32 412896	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8255]	GetLocaFolderNames: Getting folder locations based on current user C:\Users\User
2023/07/02 14:40:32 413084	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8274]	GetLocaFolderNames: AppDataLocalName AppData\Roaming
2023/07/02 14:40:32 413091	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8293]	GetLocaFolderNames: LocalAppDataLocalName AppData\Local
2023/07/02 14:40:32 413244	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8313]	GetLocaFolderNames: HistoryLocalName AppData\Local\Microsoft\Windows\History
2023/07/02 14:40:32 413390	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8334]	GetLocaFolderNames: RecentLocalName AppData\Roaming\Microsoft\Windows\Recent
2023/07/02 14:40:32 413405	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8345]	GetLocalFolderNames: check local registry for "Local Settings"
2023/07/02 14:40:32 413462	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8759]	LocalOSEnv::GetNextUser_Windows_Old start
2023/07/02 14:40:32 413467	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8885]	LocalOSEnv::GetNextUser_Windows_Old get appdata dir
2023/07/02 14:40:32 413472	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8895]	LocalOSEnv::GetNextUser_Windows_Old C:\Users\User\AppData\Local
2023/07/02 14:40:32 413543	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8920]	LocalOSEnv::GetNextUser_Windows_Old Could not find Windows.old directory
2023/07/02 14:40:32 413577	DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8514]	GetLocalFolderNames end (detected OS: WinXP)
2023/07/02 14:40:32 413656	DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:642]	Password recovery: GetWindowsPasswordHashes start
2023/07/02 14:40:32 413663	DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:826]	Password recovery: GetWindowsPasswordHashes Live system drive
2023/07/02 14:40:32 414187	DEBUG [RegistryPasswords.cpp->DecryptHashes:2248]	Password recovery: DecryptHashes start
2023/07/02 14:40:37 169190	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:227]	Password recovery: GetCachedDomainUsers open C:\Windows\System32\Config\security
2023/07/02 14:40:37 169199	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133]	CreateTempRegFileIfNeeded: A
2023/07/02 14:40:37 169267	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138]	CreateTempRegFileIfNeeded: B
2023/07/02 14:40:37 169270	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143]	CreateTempRegFileIfNeeded: C
2023/07/02 14:40:37 169403	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152]	CreateTempRegFileIfNeeded: DA
2023/07/02 14:40:37 169410	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160]	CreateTempRegFileIfNeeded: DB
2023/07/02 14:40:37 169412	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165]	CreateTempRegFileIfNeeded: DC
2023/07/02 14:40:37 169455	DEBUG [RegViewer.cpp->ShadowCopyFiles:182]	ShadowCopyFiles entry
2023/07/02 14:40:37 169462	DEBUG [RegViewer.cpp->ShadowCopyFiles:186]	ShadowCopyFiles: Trying to create shadow volume
2023/07/02 14:40:37 169469	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72]	CreateShadowVolumeForFC entry
2023/07/02 14:40:37 169472	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83]	CreateShadowVolumeForFC Initialize VSS client
2023/07/02 14:40:37 177956	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88]	CreateShadowVolumeForFC Get unique vol name for: C:\
2023/07/02 14:40:37 180019	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92]	 unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\
2023/07/02 14:40:37 180028	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100]	CreateShadowVolumeForFC create snapshot set
2023/07/02 14:40:38 398542	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109]	CreateShadowVolumeForFC getLatestSnapshotIdListt
2023/07/02 14:40:38 398548	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114]	CreateShadowVolumeForFC GetSnapshotDeviceName
2023/07/02 14:40:38 399054	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123]	CreateShadowVolumeForFC exit
2023/07/02 14:40:38 399061	DEBUG [RegViewer.cpp->ShadowCopyFiles:208]	ShadowCopyFiles: created shadow volume
2023/07/02 14:40:38 399065	DEBUG [RegViewer.cpp->ShadowCopyFiles:213]	ShadowCopyFiles: 1 files to copy
2023/07/02 14:40:38 399068	DEBUG [RegViewer.cpp->ShadowCopyFiles:220]	ShadowCopyFiles: curent file: C:\Windows\System32\Config\security
2023/07/02 14:40:38 399071	DEBUG [RegViewer.cpp->ShadowCopyFiles:225]	ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy17\Windows\System32\Config\security
2023/07/02 14:40:38 399085	DEBUG [RegViewer.cpp->ShadowCopyFiles:238]	ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\2264\7BF3CE7C9DC6F1EC11D70AC3ADB400B8
2023/07/02 14:40:38 795348	DEBUG [RegViewer.cpp->ShadowCopyFiles:275]	ShadowCopyFiles done
2023/07/02 14:40:38 798367	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177]	CreateTempRegFileIfNeeded check temp file access
2023/07/02 14:40:38 802453	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223]	CreateTempRegFileIfNeeded: finished
2023/07/02 14:40:38 802657	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:263]	Password recovery: GetCachedDomainUsers 1
2023/07/02 14:40:38 802750	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:303]	Password recovery: GetCachedDomainUsers 2
2023/07/02 14:40:38 802928	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:331]	Password recovery: GetCachedDomainUsers 3
2023/07/02 14:40:38 803024	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:375]	Password recovery: GetCachedDomainUsers 4
2023/07/02 14:40:38 803172	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:409]	Password recovery: GetCachedDomainUsers 5
2023/07/02 14:40:38 803184	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:436]	Password recovery: GetCachedDomainUsers 6
2023/07/02 14:40:38 803188	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:561]	Password recovery: GetCachedDomainUsers done
2023/07/02 14:40:38 803192	DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:568]	Password recovery: GetCachedDomainUsers cleaned up
2023/07/02 14:40:38 803558	DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:915]	Password recovery: GetWindowsPasswordHashes end
2023/07/02 14:40:38 803566	DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:642]	Password recovery: GetWindowsPasswordHashes start
2023/07/02 14:40:38 803573	DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:698]	Password recovery: GetWindowsPasswordHashes registryFile: C:\Windows.old\Windows\System32\Config\SYSTEM
2023/07/02 14:40:38 803660	DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:703]	User Activity Scan: GetWindowsPasswordHashes file not found
2023/07/02 14:40:38 803826	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:39]	GetSystemPWfromLSASecrets start
2023/07/02 14:40:38 803962	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133]	CreateTempRegFileIfNeeded: A
2023/07/02 14:40:38 804039	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138]	CreateTempRegFileIfNeeded: B
2023/07/02 14:40:38 804044	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143]	CreateTempRegFileIfNeeded: C
2023/07/02 14:40:38 804104	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152]	CreateTempRegFileIfNeeded: DA
2023/07/02 14:40:38 804109	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160]	CreateTempRegFileIfNeeded: DB
2023/07/02 14:40:38 804112	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165]	CreateTempRegFileIfNeeded: DC
2023/07/02 14:40:38 804155	DEBUG [RegViewer.cpp->ShadowCopyFiles:182]	ShadowCopyFiles entry
2023/07/02 14:40:38 804158	DEBUG [RegViewer.cpp->ShadowCopyFiles:186]	ShadowCopyFiles: Trying to create shadow volume
2023/07/02 14:40:38 804164	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72]	CreateShadowVolumeForFC entry
2023/07/02 14:40:38 804167	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83]	CreateShadowVolumeForFC Initialize VSS client
2023/07/02 14:40:38 807865	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88]	CreateShadowVolumeForFC Get unique vol name for: C:\
2023/07/02 14:40:38 808074	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92]	 unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\
2023/07/02 14:40:38 808079	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100]	CreateShadowVolumeForFC create snapshot set
2023/07/02 14:40:39 938989	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109]	CreateShadowVolumeForFC getLatestSnapshotIdListt
2023/07/02 14:40:39 938996	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114]	CreateShadowVolumeForFC GetSnapshotDeviceName
2023/07/02 14:40:39 939475	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123]	CreateShadowVolumeForFC exit
2023/07/02 14:40:39 939480	DEBUG [RegViewer.cpp->ShadowCopyFiles:208]	ShadowCopyFiles: created shadow volume
2023/07/02 14:40:39 939484	DEBUG [RegViewer.cpp->ShadowCopyFiles:213]	ShadowCopyFiles: 1 files to copy
2023/07/02 14:40:39 939486	DEBUG [RegViewer.cpp->ShadowCopyFiles:220]	ShadowCopyFiles: curent file: C:\Windows\System32\config\SYSTEM
2023/07/02 14:40:39 939489	DEBUG [RegViewer.cpp->ShadowCopyFiles:225]	ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy18\Windows\System32\config\SYSTEM
2023/07/02 14:40:39 939499	DEBUG [RegViewer.cpp->ShadowCopyFiles:238]	ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\2264\8F337D42B54B75C4007A892D5DDC3F83
2023/07/02 14:40:40 454298	DEBUG [RegViewer.cpp->ShadowCopyFiles:275]	ShadowCopyFiles done
2023/07/02 14:40:40 459291	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177]	CreateTempRegFileIfNeeded check temp file access
2023/07/02 14:40:40 463065	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223]	CreateTempRegFileIfNeeded: finished
2023/07/02 14:40:40 463071	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133]	CreateTempRegFileIfNeeded: A
2023/07/02 14:40:40 463130	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138]	CreateTempRegFileIfNeeded: B
2023/07/02 14:40:40 463138	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143]	CreateTempRegFileIfNeeded: C
2023/07/02 14:40:40 463182	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152]	CreateTempRegFileIfNeeded: DA
2023/07/02 14:40:40 463186	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160]	CreateTempRegFileIfNeeded: DB
2023/07/02 14:40:40 463188	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165]	CreateTempRegFileIfNeeded: DC
2023/07/02 14:40:40 463191	DEBUG [RegViewer.cpp->ShadowCopyFiles:182]	ShadowCopyFiles entry
2023/07/02 14:40:40 463193	DEBUG [RegViewer.cpp->ShadowCopyFiles:186]	ShadowCopyFiles: Trying to create shadow volume
2023/07/02 14:40:40 463197	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72]	CreateShadowVolumeForFC entry
2023/07/02 14:40:40 463201	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83]	CreateShadowVolumeForFC Initialize VSS client
2023/07/02 14:40:40 465924	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88]	CreateShadowVolumeForFC Get unique vol name for: C:\
2023/07/02 14:40:40 466117	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92]	 unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\
2023/07/02 14:40:40 466122	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100]	CreateShadowVolumeForFC create snapshot set
2023/07/02 14:40:41 621638	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109]	CreateShadowVolumeForFC getLatestSnapshotIdListt
2023/07/02 14:40:41 621645	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114]	CreateShadowVolumeForFC GetSnapshotDeviceName
2023/07/02 14:40:41 622150	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123]	CreateShadowVolumeForFC exit
2023/07/02 14:40:41 622156	DEBUG [RegViewer.cpp->ShadowCopyFiles:208]	ShadowCopyFiles: created shadow volume
2023/07/02 14:40:41 622160	DEBUG [RegViewer.cpp->ShadowCopyFiles:213]	ShadowCopyFiles: 1 files to copy
2023/07/02 14:40:41 622162	DEBUG [RegViewer.cpp->ShadowCopyFiles:220]	ShadowCopyFiles: curent file: C:\Windows\System32\config\SECURITY
2023/07/02 14:40:41 622167	DEBUG [RegViewer.cpp->ShadowCopyFiles:225]	ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy19\Windows\System32\config\SECURITY
2023/07/02 14:40:41 622177	DEBUG [RegViewer.cpp->ShadowCopyFiles:238]	ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\2264\9252EB97A379014387027E5488A602AC
2023/07/02 14:40:41 999903	DEBUG [RegViewer.cpp->ShadowCopyFiles:275]	ShadowCopyFiles done
2023/07/02 14:40:42 003478	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177]	CreateTempRegFileIfNeeded check temp file access
2023/07/02 14:40:42 007107	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223]	CreateTempRegFileIfNeeded: finished
2023/07/02 14:40:42 013528	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:181]	Opening keys in : ControlSet001\Control\Lsa
2023/07/02 14:40:42 013737	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:244]	Opening key: Policy\PolRevision
2023/07/02 14:40:42 013754	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:279]	Policy revision: 1.2
2023/07/02 14:40:42 013757	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:287]	Opening key: Policy\PolEKList
2023/07/02 14:40:42 013813	DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:645]	decryptLSAKeyNT6 start (lsa len: 172, syskey len: 16)
2023/07/02 14:40:42 013908	DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:739]	pt len = 96
2023/07/02 14:40:42 013911	DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:750]	key size = 84
2023/07/02 14:40:42 013916	DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:784]	nb = 1
2023/07/02 14:40:42 013920	DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:816]	[0] t = 3, l = 32
2023/07/02 14:40:42 013953	DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:837]	decryptLSAKeyNT6 end
2023/07/02 14:40:42 013995	DEBUG [LSASecrets.cpp->decryptLSASecret:525]	decryptLSASecret start
2023/07/02 14:40:42 014078	DEBUG [LSASecrets.cpp->decryptLSASecret:639]	decryptLSASecret end
2023/07/02 14:40:42 014087	DEBUG [LSASecrets.cpp->decryptLSASecret:525]	decryptLSASecret start
2023/07/02 14:40:42 014165	DEBUG [LSASecrets.cpp->decryptLSASecret:639]	decryptLSASecret end
2023/07/02 14:40:42 014202	DEBUG [LSASecrets.cpp->decryptLSASecret:525]	decryptLSASecret start
2023/07/02 14:40:42 014274	DEBUG [LSASecrets.cpp->decryptLSASecret:639]	decryptLSASecret end
2023/07/02 14:40:42 014349	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:517]	GetSystemPWfromLSASecrets end
2023/07/02 14:40:42 015737	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:39]	GetSystemPWfromLSASecrets start
2023/07/02 14:40:42 015870	DEBUG [RegViewer.cpp->RegViewer::LoadFile:2838]	Could not open file, error: 3
2023/07/02 14:40:42 015875	DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:129]	GetSystemPWfromLSASecrets end - Couldn't open registry hive
2023/07/02 14:40:42 015887	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::DPAPIEmulator:99]	using DPAPISystemToken (0)
2023/07/02 14:40:42 015982	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539]	LocalOSEnv::GetNextUser start
2023/07/02 14:40:42 015987	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8559]	LocalOSEnv::GetNextUser xp check
2023/07/02 14:40:42 016071	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8566]	LocalOSEnv::GetNextUser cleanup profile path
2023/07/02 14:40:42 016078	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594]	LocalOSEnv::GetNextUser Drive != 0
2023/07/02 14:40:42 016081	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602]	LocalOSEnv::GetNextUser GetVolumeInformation C:\
2023/07/02 14:40:42 016135	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8611]	LocalOSEnv::GetNextUser win7/mac check
2023/07/02 14:40:42 016185	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642]	LocalOSEnv::GetNextUser cleanup profile path C:\Users\*
2023/07/02 14:40:42 016190	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648]	LocalOSEnv::GetNextUser next
2023/07/02 14:40:42 016193	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712]	LocalOSEnv::GetNextUser Search for users in this location
2023/07/02 14:40:42 016194	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016196	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	.
2023/07/02 14:40:42 016255	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016335	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	..
2023/07/02 14:40:42 016341	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016344	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	All Users
2023/07/02 14:40:42 016378	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726]	LocalOSEnv::GetNextUser finish
2023/07/02 14:40:42 016460	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539]	LocalOSEnv::GetNextUser start
2023/07/02 14:40:42 016464	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712]	LocalOSEnv::GetNextUser Search for users in this location
2023/07/02 14:40:42 016467	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016469	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	Default
2023/07/02 14:40:42 016475	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726]	LocalOSEnv::GetNextUser finish
2023/07/02 14:40:42 016548	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539]	LocalOSEnv::GetNextUser start
2023/07/02 14:40:42 016552	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712]	LocalOSEnv::GetNextUser Search for users in this location
2023/07/02 14:40:42 016554	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016556	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	Default User
2023/07/02 14:40:42 016589	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726]	LocalOSEnv::GetNextUser finish
2023/07/02 14:40:42 016665	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539]	LocalOSEnv::GetNextUser start
2023/07/02 14:40:42 016668	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712]	LocalOSEnv::GetNextUser Search for users in this location
2023/07/02 14:40:42 016672	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016675	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	desktop.ini
2023/07/02 14:40:42 016677	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016710	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	Public
2023/07/02 14:40:42 016713	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726]	LocalOSEnv::GetNextUser finish
2023/07/02 14:40:42 016748	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539]	LocalOSEnv::GetNextUser start
2023/07/02 14:40:42 016751	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712]	LocalOSEnv::GetNextUser Search for users in this location
2023/07/02 14:40:42 016754	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716]	LocalOSEnv::GetNextUser next file
2023/07/02 14:40:42 016756	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718]	User
2023/07/02 14:40:42 016759	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726]	LocalOSEnv::GetNextUser finish
2023/07/02 14:40:42 016919	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\1364fb9a-90d0-49d6-9cde-0680120fe0af
2023/07/02 14:40:42 017077	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\204e7ad4-f85d-48d8-8dcb-54b860a55f81
2023/07/02 14:40:42 017281	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\4838034f-dd34-4293-829b-99f75b0608c0
2023/07/02 14:40:42 017478	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\5baba3fc-72fc-4c20-82f6-806eefb9ca37
2023/07/02 14:40:42 017690	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\6149bc79-de93-4f07-a8c1-40fd701bba95
2023/07/02 14:40:42 017950	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\61775497-a204-41de-bf98-0e5880e7a6f2
2023/07/02 14:40:42 018088	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\646e1ef2-d412-4012-acf5-5fa1674979cf
2023/07/02 14:40:42 018397	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\813ac69a-15e8-4c95-8c7b-14b0fc71605a
2023/07/02 14:40:42 018514	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\95eb7a08-b147-48b4-8300-b5aa4b43d9af
2023/07/02 14:40:42 018615	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\9e6ae495-a7f3-4eda-aec8-907d779d75aa
2023/07/02 14:40:42 019027	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\f46b943c-dfe2-4aea-a69b-aa9d731511e6
2023/07/02 14:40:42 019199	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\f5a23ee7-1eb4-46dd-b17e-8f63726cde65
2023/07/02 14:40:42 019359	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539]	LocalOSEnv::GetNextUser start
2023/07/02 14:40:42 019373	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8586]	LocalOSEnv::GetNextUser close handle
2023/07/02 14:40:42 019403	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594]	LocalOSEnv::GetNextUser Drive != 0
2023/07/02 14:40:42 019408	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602]	LocalOSEnv::GetNextUser GetVolumeInformation C:\
2023/07/02 14:40:42 019457	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8626]	LocalOSEnv::GetNextUser ubununtu check
2023/07/02 14:40:42 019497	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642]	LocalOSEnv::GetNextUser cleanup profile path C:\home\*
2023/07/02 14:40:42 019501	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648]	LocalOSEnv::GetNextUser next
2023/07/02 14:40:42 019505	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594]	LocalOSEnv::GetNextUser Drive != 0
2023/07/02 14:40:42 019581	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602]	LocalOSEnv::GetNextUser GetVolumeInformation C:\
2023/07/02 14:40:42 019626	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642]	LocalOSEnv::GetNextUser cleanup profile path 
2023/07/02 14:40:42 019629	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648]	LocalOSEnv::GetNextUser next
2023/07/02 14:40:42 019632	DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8743]	LocalOSEnv::GetNextUser end
2023/07/02 14:40:42 019757	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\03f95ae3-6db4-4482-b476-e89db1f73808
2023/07/02 14:40:42 019837	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 019882	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\19fe09c1-04a2-4ddd-bdff-03f493f410e1
2023/07/02 14:40:42 019961	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 020359	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\1cb44743-fed7-4fb5-be5b-364d20be132f
2023/07/02 14:40:42 020431	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 020520	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\3d5f12eb-2a33-4361-9674-b1098b1fad81
2023/07/02 14:40:42 020605	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 020657	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\5a9cafc1-139a-468f-81b1-7a815726efb5
2023/07/02 14:40:42 020730	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 020778	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\61363162-2599-48cd-81fe-85fa20b9c0f0
2023/07/02 14:40:42 020846	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 020891	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\66447004-a0e5-4a56-bade-d9200d4fe823
2023/07/02 14:40:42 020972	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 021051	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\7621f9b8-0ed0-423e-b192-01001ee54211
2023/07/02 14:40:42 021181	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 021766	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\90dc85cd-4fce-4eac-99cd-ca86c2c064d7
2023/07/02 14:40:42 021896	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 021951	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\b3497bb5-9fe2-456b-9f73-d749acf416fc
2023/07/02 14:40:42 022027	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022088	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\cd95054d-8c0e-4f26-a42b-4d45cde7073e
2023/07/02 14:40:42 022158	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022185	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\d9fd3abf-b694-46bf-9563-e1a3139fb5e9
2023/07/02 14:40:42 022280	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022306	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\fec2c25a-e53e-4b3c-9461-4e0b769a29d7
2023/07/02 14:40:42 022401	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022555	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\25f362bb-240b-49de-bfb0-702dce299208
2023/07/02 14:40:42 022623	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022678	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\3411840e-c54e-464e-8e1a-bdd1e0d2a755
2023/07/02 14:40:42 022743	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022770	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\37305382-59b1-48c8-ab7e-2b1ae7487c47
2023/07/02 14:40:42 022830	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 022856	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\4ded6254-7a79-494f-9281-1cd1ce58094a
2023/07/02 14:40:42 022952	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 023583	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\5812b1c1-e9aa-4e4b-bddf-1a45f61c0104
2023/07/02 14:40:42 023683	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 023712	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\5ac75647-5556-44eb-af54-98ca59c1fc6b
2023/07/02 14:40:42 023782	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 023815	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\83d03260-0b4a-447d-8281-306f3ff71553
2023/07/02 14:40:42 023881	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 023916	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\a4ab9305-1480-45dc-8769-640a3f7aba3f
2023/07/02 14:40:42 024014	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 024034	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\aac7f893-1c8b-4e2c-9d40-95dba8b94cdb
2023/07/02 14:40:42 024100	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 024130	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e31136dc-f5b0-4cf7-9c5e-6abd56fc6c8f
2023/07/02 14:40:42 024191	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 024218	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e4c77d25-4d09-4543-817d-dbd31abf03e8
2023/07/02 14:40:42 024309	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 024352	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f482c7a6-e354-4812-941f-77321ddefe5d
2023/07/02 14:40:42 024417	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 024465	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242]	AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f87b443f-06d6-42cd-8b7e-14e9da15b7c0
2023/07/02 14:40:42 024530	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411]	AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key
2023/07/02 14:40:42 024618	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8759]	LocalOSEnv::GetNextUser_Windows_Old start
2023/07/02 14:40:42 024621	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8779]	LocalOSEnv::GetNextUser_Windows_Old xp check
2023/07/02 14:40:42 024663	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8786]	LocalOSEnv::GetNextUser_Windows_Old cleanup profile path
2023/07/02 14:40:42 024666	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814]	LocalOSEnv::GetNextUser_Windows_Old Drive != 0
2023/07/02 14:40:42 024669	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822]	LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\
2023/07/02 14:40:42 024715	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8831]	LocalOSEnv::GetNextUser_Windows_Old win7/mac check
2023/07/02 14:40:42 024745	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863]	LocalOSEnv::GetNextUser_Windows_Old cleanup profile path C:\Windows.old\Users\*
2023/07/02 14:40:42 024748	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869]	LocalOSEnv::GetNextUser_Windows_Old next
2023/07/02 14:40:42 024751	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814]	LocalOSEnv::GetNextUser_Windows_Old Drive != 0
2023/07/02 14:40:42 024753	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822]	LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\
2023/07/02 14:40:42 024790	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8846]	LocalOSEnv::GetNextUser_Windows_Old ubununtu check
2023/07/02 14:40:42 024831	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863]	LocalOSEnv::GetNextUser_Windows_Old cleanup profile path C:\old\home\*
2023/07/02 14:40:42 024834	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869]	LocalOSEnv::GetNextUser_Windows_Old next
2023/07/02 14:40:42 024836	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814]	LocalOSEnv::GetNextUser_Windows_Old Drive != 0
2023/07/02 14:40:42 024839	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822]	LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\
2023/07/02 14:40:42 024876	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863]	LocalOSEnv::GetNextUser_Windows_Old cleanup profile path 
2023/07/02 14:40:42 024879	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869]	LocalOSEnv::GetNextUser_Windows_Old next
2023/07/02 14:40:42 024881	DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8987]	LocalOSEnv::GetNextUser_Windows_Old end
2023/07/02 14:40:42 024914	DEBUG [CfgRecent.cpp->UserActivityScanThread:4058]	User Activity Scan: Registry
2023/07/02 14:40:42 024963	DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:3931]	IsWindowsVistaOrHigher start
2023/07/02 14:40:42 024997	DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:4072]	IsWindowsVistaOrHigher finished
2023/07/02 14:40:42 025001	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9250]	User Activity Scan: Registry Info live system
2023/07/02 14:40:42 025263	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9255]	User Activity Scan: Registry Info: User User
2023/07/02 14:40:42 025296	DEBUG [RegistryInfo.cpp->GetLastVisitedMRU:4361]	User Activity Scan: GetLastVisitedMRU: Number of subkeys: 2
2023/07/02 14:40:42 025463	DEBUG [RegistryInfo.cpp->GetLastVisitedMRU:4433]	User Activity Scan: GetLastVisitedMRU: (2) 0 (Size: 159 Bytes) => brave.exe [F:\Downloads]
2023/07/02 14:40:42 025501	DEBUG [RegistryInfo.cpp->GetMRUInfo:8721]	User Activity Scan: Got GetLastVisited MRUs: new total 1
2023/07/02 14:40:42 026190	DEBUG [RegistryInfo.cpp->GetMRUInfo:8725]	User Activity Scan: Got GetOpenSBave MRUs: new total 3
2023/07/02 14:40:42 026319	DEBUG [RegistryInfo.cpp->GetMRUInfo:8729]	User Activity Scan: Got GetRecentDocs MRUs: new total 8
2023/07/02 14:40:42 029845	DEBUG [RegistryInfo.cpp->GetMRUInfo:8733]	User Activity Scan: Got Office MRUs: new total 242
2023/07/02 14:40:42 029867	DEBUG [RegistryInfo.cpp->GetMRUInfo:8737]	User Activity Scan: Got Run MRUs: new total 242
2023/07/02 14:40:42 029891	DEBUG [RegistryInfo.cpp->GetMRUInfo:8741]	User Activity Scan: Got Network Drive MRUs: new total 242
2023/07/02 14:40:42 029916	DEBUG [RegistryInfo.cpp->GetMRUInfo:8745]	User Activity Scan: Got Search MRUs: new total 242
2023/07/02 14:40:42 029927	DEBUG [RegistryInfo.cpp->GetMRUInfo:8749]	User Activity Scan: Got PMV Search MRUs: new total 242
2023/07/02 14:40:42 029935	DEBUG [RegistryInfo.cpp->GetMRUInfo:8753]	User Activity Scan: Got Internet Search MRUs: new total 242
2023/07/02 14:40:42 029944	DEBUG [RegistryInfo.cpp->GetMRUInfo:8757]	User Activity Scan: Got PCP Search MRUs: new total 242
2023/07/02 14:40:42 030004	DEBUG [RegistryInfo.cpp->GetMRUInfo:8761]	User Activity Scan: Got Wordpad MRUs: new total 243
2023/07/02 14:40:42 030062	DEBUG [RegistryInfo.cpp->GetMRUInfo:8765]	User Activity Scan: Got Paint MRUs: new total 243
2023/07/02 14:40:42 030108	DEBUG [RegistryInfo.cpp->GetMRUInfo:8769]	User Activity Scan: Got Windows Media Player MRUs: new total 243
2023/07/02 14:40:42 030423	DEBUG [RegistryInfo.cpp->GetMRUInfo:8773]	User Activity Scan: Got Adobe Acrobat Reader MRUs: new total 247
2023/07/02 14:40:42 030910	DEBUG [RegistryInfo.cpp->GetMRUInfo:8777]	User Activity Scan: Got Adobe Acrobat MRUs: new total 254
2023/07/02 14:40:42 030914	DEBUG [RegistryInfo.cpp->GetTypedIEURLS:3260]	User Activity Scan: GetTypedIEURLS Start [Local]
2023/07/02 14:40:42 030928	DEBUG [RegistryInfo.cpp->GetTypedIEURLS:3323]	User Activity Scan: GetTypedIEURLS finish no key found
2023/07/02 14:40:42 030931	DEBUG [RegistryInfo.cpp->GetMountPointsSystem:330]	GetMountPointsSystem Start [Local]
2023/07/02 14:40:42 030993	DEBUG [RegistryInfo.cpp->GetMountPointsSystem:468]	GetMountPointsSystem - enum live systems results
2023/07/02 14:40:42 032294	DEBUG [RegistryInfo.cpp->GetMountPointsSystem:551]	GetMountPointsSystem - finished
2023/07/02 14:40:42 032300	DEBUG [RegistryInfo.cpp->GetOnceConnectedUSBStorage:7130]	User Activity Scan: GetOnceConnectedUSBStorage Start [Local]
2023/07/02 14:40:42 032315	DEBUG [RegistryInfo.cpp->GetOnceConnectedUSBStorage:7324]	User Activity Scan: GetOnceConnectedUSBStorage couldn't open key
2023/07/02 14:40:42 032319	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9264]	User Activity Scan: Got connected USB
2023/07/02 14:40:42 032321	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5175]	User Activity Scan: GetOtherConnectedUSB [Local]
2023/07/02 14:40:42 032324	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5206]	GetOtherConnectedUSB() - Parsing Vendor ID file.
2023/07/02 14:40:42 034126	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5243]	Found 844 VIDs in file C:\ProgramData\PassMark\OSForensics\usb.if.
2023/07/02 14:40:42 065564	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5326]	Found 3411 VIDs 2951 PIDs in file C:\ProgramData\PassMark\OSForensics\usb.ids.
2023/07/02 14:40:42 065572	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5339]	Open SYSTEM\CurrentControlSet\Enum\USB
2023/07/02 14:40:42 065622	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = _HUB30
2023/07/02 14:40:42 065627	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5632]	Count < 2
2023/07/02 14:40:42 065633	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 03F0
2023/07/02 14:40:42 065645	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 065863	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 065942	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (03F0)
2023/07/02 14:40:42 065949	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 066023	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: HP Inc. (VID_03F0)
2023/07/02 14:40:42 066028	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = HP Inc. (VID_03F0)
2023/07/02 14:40:42 066030	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 066060	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 03F0
2023/07/02 14:40:42 066145	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 066301	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 066307	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (03F0)
2023/07/02 14:40:42 066310	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 066313	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: HP Inc. (VID_03F0)
2023/07/02 14:40:42 066315	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = HP Inc. (VID_03F0)
2023/07/02 14:40:42 066317	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 066339	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 03F0
2023/07/02 14:40:42 066351	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 066447	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 066451	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (03F0)
2023/07/02 14:40:42 066454	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 066456	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: HP Inc. (VID_03F0)
2023/07/02 14:40:42 066457	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = HP Inc. (VID_03F0)
2023/07/02 14:40:42 066459	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 066538	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 03F0
2023/07/02 14:40:42 066624	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 066781	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 066788	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (03F0)
2023/07/02 14:40:42 066860	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 066866	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: HP Inc. (VID_03F0)
2023/07/02 14:40:42 066939	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = HP Inc. (VID_03F0)
2023/07/02 14:40:42 066942	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 067017	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 03F0
2023/07/02 14:40:42 067099	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 067290	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 067295	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (03F0)
2023/07/02 14:40:42 067298	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 067330	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: HP Inc. (VID_03F0)
2023/07/02 14:40:42 067332	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = HP Inc. (VID_03F0)
2023/07/02 14:40:42 067335	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 067374	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 09DA
2023/07/02 14:40:42 067384	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 067494	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 067499	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (09DA)
2023/07/02 14:40:42 067533	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 067537	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: A-FOUR TECH CO., LTD. (VID_09DA)
2023/07/02 14:40:42 067539	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA)
2023/07/02 14:40:42 067542	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 067573	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 09DA
2023/07/02 14:40:42 067615	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 067699	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 067731	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (09DA)
2023/07/02 14:40:42 067735	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 067738	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: A-FOUR TECH CO., LTD. (VID_09DA)
2023/07/02 14:40:42 067741	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA)
2023/07/02 14:40:42 067771	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 067813	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 09DA
2023/07/02 14:40:42 067821	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 067896	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 067900	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (09DA)
2023/07/02 14:40:42 067930	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 067933	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: A-FOUR TECH CO., LTD. (VID_09DA)
2023/07/02 14:40:42 068050	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA)
2023/07/02 14:40:42 068053	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 068089	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 0C45
2023/07/02 14:40:42 068129	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 068211	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 068248	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 068252	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 068256	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068288	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068291	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 068382	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 068387	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 068390	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 068423	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068426	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068428	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 068515	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 068520	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 068522	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 068524	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068526	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068528	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 068561	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 0C45
2023/07/02 14:40:42 068601	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 068681	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 068686	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 068689	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 068691	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068721	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068723	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 068951	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 068957	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 068960	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 068963	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068994	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 068997	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069080	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 069085	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 069116	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 069120	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069122	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069124	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069156	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 0C45
2023/07/02 14:40:42 069167	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 069272	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 069277	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 069280	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 069313	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069316	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069318	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069401	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 069433	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 069437	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 069440	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069443	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069476	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069559	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 069590	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (0C45)
2023/07/02 14:40:42 069594	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 069597	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069600	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45)
2023/07/02 14:40:42 069631	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069671	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1532
2023/07/02 14:40:42 069711	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 069818	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 069824	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 069829	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 069832	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 069835	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 069837	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069931	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 069939	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 069943	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 069945	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 069947	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 069950	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 069997	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1532
2023/07/02 14:40:42 070040	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 070159	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 070164	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 070167	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 070231	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070235	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070238	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 070455	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 070462	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 070537	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 070543	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070546	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070580	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 070620	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1532
2023/07/02 14:40:42 070661	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 070749	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 070754	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 070757	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 070759	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070762	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070807	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 070925	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 070930	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 070933	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 070966	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070969	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 070971	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 071006	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1532
2023/07/02 14:40:42 071047	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 071126	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 071130	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 071134	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 071136	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 071139	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 071171	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 071256	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 071288	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1532)
2023/07/02 14:40:42 071292	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 071295	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 071298	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = Razer USA, Ltd (VID_1532)
2023/07/02 14:40:42 071330	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 071410	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1C4F
2023/07/02 14:40:42 071450	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 071539	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 071573	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1C4F)
2023/07/02 14:40:42 071578	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 071580	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: SiGma Micro (VID_1C4F)
2023/07/02 14:40:42 071583	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = SiGma Micro (VID_1C4F)
2023/07/02 14:40:42 071613	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 071654	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1C4F
2023/07/02 14:40:42 071664	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 071898	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 071904	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1C4F)
2023/07/02 14:40:42 071939	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 071942	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: SiGma Micro (VID_1C4F)
2023/07/02 14:40:42 071944	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = SiGma Micro (VID_1C4F)
2023/07/02 14:40:42 071946	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 071979	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618]	tmpVID = 1C4F
2023/07/02 14:40:42 072023	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643]	Find unique IDs
2023/07/02 14:40:42 072103	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713]	Look up product
2023/07/02 14:40:42 072138	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750]	Look up vendor (1C4F)
2023/07/02 14:40:42 072141	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755]	Found: vendor
2023/07/02 14:40:42 072144	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760]	Found: SiGma Micro (VID_1C4F)
2023/07/02 14:40:42 072147	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768]	tmpVID 2 = SiGma Micro (VID_1C4F)
2023/07/02 14:40:42 072221	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772]	Add USB entry
2023/07/02 14:40:42 072264	DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5800]	User Activity Scan: GetOtherConnectedUSB end
2023/07/02 14:40:42 074386	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9267]	User Activity Scan: Got other connected USB
2023/07/02 14:40:42 074393	DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:5805]	User Activity Scan: GetConnectedUSBasSCSI Start [Local]
2023/07/02 14:40:42 074426	DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:5839]	Open SYSTEM\CurrentControlSet\Enum\SCSI
2023/07/02 14:40:42 074465	DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6086]	Find unique IDs
2023/07/02 14:40:42 074583	DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6086]	Find unique IDs
2023/07/02 14:40:42 074665	DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6216]	User Activity Scan: GetConnectedUSBasSCSI end
2023/07/02 14:40:42 074702	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9270]	User Activity Scan: Got connected USB as SCSI device
2023/07/02 14:40:42 074709	DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:3931]	IsWindowsVistaOrHigher start
2023/07/02 14:40:42 074740	DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:4072]	IsWindowsVistaOrHigher finished
2023/07/02 14:40:42 074744	DEBUG [RegistryInfo.cpp->GetShimCacheInfo:1809]	GetShimCacheInfo local
2023/07/02 14:40:42 074747	DEBUG [RegistryInfo.cpp->GetShimCacheInfo:1818]	User Activity Scan: GetShimCacheInfo opening key SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
2023/07/02 14:40:42 075460	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	00720000071f003a	000a00004a610000	8664	Microsoft.MicrosoftEdge.Stable	8wekyb3d8bbwe	
2023/07/02 14:40:42 075586	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0002000447940000	000a000042ee0000	8664	Microsoft.Wallet	8wekyb3d8bbwe	
2023/07/02 14:40:42 076347	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	000a0000000203e8	000a000047ba0001	8664	windows.immersivecontrolpanel	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 076491	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00015a0c00790000	000a0000585d0000	8664	Microsoft.YourPhone	8wekyb3d8bbwe	
2023/07/02 14:40:42 076497	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0bb80372089f0000	000c000000000000	8664	Microsoft.WindowsAppRuntime.1.3	8wekyb3d8bbwe	
2023/07/02 14:40:42 076501	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	3e8537f653f20000	000a00004c610000	8664	microsoft.windowscommunicationsapps	8wekyb3d8bbwe	
2023/07/02 14:40:42 076539	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	5721057900020000	000a000047ba0000	8664	Microsoft.StorePurchaseApp	8wekyb3d8bbwe	
2023/07/02 14:40:42 076543	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	0bb80372089f0000	000c000000000000	8664	Microsoft.WindowsAppRuntime.1.3	8wekyb3d8bbwe	
2023/07/02 14:40:42 077055	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0004089c33f70000	000a00004a610000	8664	Microsoft.549981C3F5F10	8wekyb3d8bbwe	
2023/07/02 14:40:42 077096	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	000a00004a610749	000a00004a610749	8664	Microsoft.Windows.SecHealthUI	cw5n1h2txyewy	
2023/07/02 14:40:42 077100	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	03e84a6103e80000	000a00007fff0000	8664	MicrosoftWindows.Client.CBS	cw5n1h2txyewy	
2023/07/02 14:40:42 077225	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000100d6047d0000	000a0000585d0000	014c	SpotifyAB.SpotifyMusic	zpdnekdrzrea0	
2023/07/02 14:40:42 077231	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000100d6047d0000	000a0000585d0000	8664	SpotifyAB.SpotifyMusic	zpdnekdrzrea0	
2023/07/02 14:40:42 077235	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	5721057900010000	000a0000585d0000	8664	Microsoft.WindowsStore	8wekyb3d8bbwe	
2023/07/02 14:40:42 077239	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00010000f0970000	000a0000585d0000	8664	Microsoft.WebMediaExtensions	8wekyb3d8bbwe	
2023/07/02 14:40:42 077398	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	07e7272e697a0000	000a00004a650000	8664	Microsoft.Windows.Photos	8wekyb3d8bbwe	
2023/07/02 14:40:42 077567	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00920003043f0000	000a000047ba0000	8664	AD2F1837.HPPrinterControl	v10z8vjag6ke6	
2023/07/02 14:40:42 077571	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000a564b27390000	000a00004bc80000	8664	Microsoft.ZuneVideo	8wekyb3d8bbwe	
2023/07/02 14:40:42 077574	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000b090000000000	000a000055f00000	8664	Microsoft.WindowsAlarms	8wekyb3d8bbwe	
2023/07/02 14:40:42 078148	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	3e8137f653cc0000	000a000047ba0000	8664	Microsoft.Office.OneNote	8wekyb3d8bbwe	
2023/07/02 14:40:42 078152	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000609013ed70000	000a000047ba0000	8664	Microsoft.MSPaint	8wekyb3d8bbwe	
2023/07/02 14:40:42 078857	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	07e7272e697a0000	000a000055f00000	8664	Microsoft.Windows.Photos	8wekyb3d8bbwe	
2023/07/02 14:40:42 078874	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000503370cbd0000	000a000055f00000	8664	Microsoft.XboxGamingOverlay	8wekyb3d8bbwe	
2023/07/02 14:40:42 079072	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	0001000e000a4a61	000a00004a610000	8664	Microsoft.Windows.Search	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 079110	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	3e8537f653e80000	000a00004c610000	8664	microsoft.windowscommunicationsapps	8wekyb3d8bbwe	
2023/07/02 14:40:42 079169	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00920002041f0000	000a000047ba0000	8664	AD2F1837.HPPrinterControl	v10z8vjag6ke6	
2023/07/02 14:40:42 079640	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	03e84a6103ff0000	000a0000295b0000	8664	Microsoft.AAD.BrokerPlugin	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 080277	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000100d502950000	000a0000585d0000	014c	SpotifyAB.SpotifyMusic	zpdnekdrzrea0	
2023/07/02 14:40:42 080431	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	000a00004a6103ff	000a000000000000	8664	Microsoft.Windows.ContentDeliveryManager	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 080671	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	000a00004a6103ff	000a00004a6103ff	8664	Microsoft.Windows.StartMenuExperienceHost	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 080885	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000100d502950000	000a0000585d0000	8664	SpotifyAB.SpotifyMusic	zpdnekdrzrea0	
2023/07/02 14:40:42 080890	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00920001043a0000	000a000047ba0000	8664	AD2F1837.HPPrinterControl	v10z8vjag6ke6	
2023/07/02 14:40:42 081051	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00010000a4d00000	000a00004a610000	8664	Microsoft.WebMediaExtensions	8wekyb3d8bbwe	
2023/07/02 14:40:42 081204	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	3e8537f653e00000	000a00004c610000	8664	microsoft.windowscommunicationsapps	8wekyb3d8bbwe	
2023/07/02 14:40:42 081211	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00015a02006c0000	000a0000585d0000	8664	Microsoft.YourPhone	8wekyb3d8bbwe	
2023/07/02 14:40:42 081215	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000e00007f120000	000a0000273a0000	8664	Microsoft.VCLibs.140.00.UWPDesktop	8wekyb3d8bbwe	
2023/07/02 14:40:42 081220	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000e00007f120000	000a0000273a0000	8664	Microsoft.VCLibs.140.00.UWPDesktop	8wekyb3d8bbwe	
2023/07/02 14:40:42 081224	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000e00007f120000	000a0000273a0000	8664	Microsoft.VCLibs.140.00	8wekyb3d8bbwe	
2023/07/02 14:40:42 081229	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000e00007f120000	000a0000273a0000	8664	Microsoft.VCLibs.140.00	8wekyb3d8bbwe	
2023/07/02 14:40:42 081233	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0012090104c60000	000a00004a610000	8664	Microsoft.MicrosoftOfficeHub	8wekyb3d8bbwe	
2023/07/02 14:40:42 081237	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0bb8035306b00000	000c000000000000	8664	Microsoft.WindowsAppRuntime.1.3	8wekyb3d8bbwe	
2023/07/02 14:40:42 081241	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0066090136b20000	000a00004a610000	8664	Microsoft.6365217CE6EB4	8wekyb3d8bbwe	
2023/07/02 14:40:42 081246	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	0bb8035306b00000	000c000000000000	8664	Microsoft.WindowsAppRuntime.1.3	8wekyb3d8bbwe	
2023/07/02 14:40:42 081978	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	5720057900030000	000a00004a650000	8664	Microsoft.WindowsStore	8wekyb3d8bbwe	
2023/07/02 14:40:42 082169	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	3e8537f653d80000	000a00004c610000	8664	microsoft.windowscommunicationsapps	8wekyb3d8bbwe	
2023/07/02 14:40:42 082362	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	00720000071f0025	000a00004a610000	8664	Microsoft.MicrosoftEdge.Stable	8wekyb3d8bbwe	
2023/07/02 14:40:42 083017	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	03e84a6103ff0000	000a000000000000	8664	Microsoft.Windows.Apprep.ChxApp	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 083046	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	0001000e00094a61	000a00004a610000	8664	Microsoft.Windows.Search	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 083087	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	07e70900000b0000	000a000055f00000	8664	Microsoft.WindowsCamera	8wekyb3d8bbwe	
2023/07/02 14:40:42 083091	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	5720057900030000	000a0000585d0000	8664	Microsoft.WindowsStore	8wekyb3d8bbwe	
2023/07/02 14:40:42 083241	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000100132b3f0000	000a000062200000	8664	Microsoft.DesktopAppInstaller	8wekyb3d8bbwe	
2023/07/02 14:40:42 083249	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000b090000020000	000a000055f0015a	8664	Microsoft.ZuneMusic	8wekyb3d8bbwe	
2023/07/02 14:40:42 083253	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000a089a001e0000	000a000045630000	8664	Microsoft.People	8wekyb3d8bbwe	
2023/07/02 14:40:42 083328	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	300f057900010000	000a000047ba0000	8664	Microsoft.StorePurchaseApp	8wekyb3d8bbwe	
2023/07/02 14:40:42 083336	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000a089a001f0000	000a000045630000	8664	Microsoft.People	8wekyb3d8bbwe	
2023/07/02 14:40:42 085850	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000100d403860000	000a0000585d0000	014c	SpotifyAB.SpotifyMusic	zpdnekdrzrea0	
2023/07/02 14:40:42 086007	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	0071000006ee0039	000a00004a610000	8664	Microsoft.MicrosoftEdge.Stable	8wekyb3d8bbwe	
2023/07/02 14:40:42 086198	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000000	000100d403860000	000a0000585d0000	8664	SpotifyAB.SpotifyMusic	zpdnekdrzrea0	
2023/07/02 14:40:42 086216	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	3e8537f653c60000	000a00004c610000	8664	microsoft.windowscommunicationsapps	8wekyb3d8bbwe	
2023/07/02 14:40:42 086219	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00040035c9050000	000a00004a610000	8664	Microsoft.BingWeather	8wekyb3d8bbwe	
2023/07/02 14:40:42 086481	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	000a00004a61079d	000a00004a61079d	8664	Microsoft.Windows.ShellExperienceHost	cw5n1h2txyewy	neutral
2023/07/02 14:40:42 086826	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0030005961a90000	000a00003ad70000	8664	Microsoft.XboxApp	8wekyb3d8bbwe	
2023/07/02 14:40:42 086832	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	300d057900080000	000a000047ba0000	8664	Microsoft.StorePurchaseApp	8wekyb3d8bbwe	
2023/07/02 14:40:42 086835	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	07d0523b05020000	000a000045180000	8664	Microsoft.MixedReality.Portal	8wekyb3d8bbwe	
2023/07/02 14:40:42 086839	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000c005f0bb90000	000a000045630000	8664	Microsoft.XboxIdentityProvider	8wekyb3d8bbwe	
2023/07/02 14:40:42 086846	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0004000600000000	000a000047ba0000	8664	Microsoft.MicrosoftStickyNotes	8wekyb3d8bbwe	
2023/07/02 14:40:42 086850	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000400100c440000	000a00004a610000	8664	Microsoft.MicrosoftSolitaireCollection	8wekyb3d8bbwe	
2023/07/02 14:40:42 086853	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	07e708fe000e0000	000a000055f00000	8664	Microsoft.WindowsCamera	8wekyb3d8bbwe	
2023/07/02 14:40:42 086857	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000b08ff00050000	000a000055f00000	8664	Microsoft.WindowsMaps	8wekyb3d8bbwe	
2023/07/02 14:40:42 087495	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000a07d80bb90000	000a000047ba0000	8664	Microsoft.ScreenSketch	8wekyb3d8bbwe	
2023/07/02 14:40:42 087759	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00910003043e0000	000a000047ba0000	8664	AD2F1837.HPPrinterControl	v10z8vjag6ke6	
2023/07/02 14:40:42 087764	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000159f800ba0000	000a0000585d0000	8664	Microsoft.YourPhone	8wekyb3d8bbwe	
2023/07/02 14:40:42 087767	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000159f800c40000	000a0000585d0000	8664	Microsoft.YourPhone	8wekyb3d8bbwe	
2023/07/02 14:40:42 087771	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	571f057900070000	000a0000585d0000	8664	Microsoft.WindowsStore	8wekyb3d8bbwe	
2023/07/02 14:40:42 087815	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	0012090004b20000	000a00004a610000	8664	Microsoft.MicrosoftOfficeHub	8wekyb3d8bbwe	
2023/07/02 14:40:42 087831	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00040035c8350000	000a00004a610000	8664	Microsoft.BingWeather	8wekyb3d8bbwe	
2023/07/02 14:40:42 087835	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00040035c8a10000	000a00004a610000	8664	Microsoft.BingWeather	8wekyb3d8bbwe	
2023/07/02 14:40:42 087838	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	00010000eef30000	000a0000585d0000	8664	Microsoft.HEIFImageExtension	8wekyb3d8bbwe	
2023/07/02 14:40:42 087983	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 0000000b	0071000006ee0032	000a00004a610000	8664	Microsoft.MicrosoftEdge.Stable	8wekyb3d8bbwe	
2023/07/02 14:40:42 088396	DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770]	Unknown Shim Entry - App Name: 00000009	000a08ff2ad10000	000a000055f00000	8664	Microsoft.GetHelp	8wekyb3d8bbwe	
2023/07/02 14:40:42 088547	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9273]	User Activity Scan: Got Shim Cache
2023/07/02 14:40:42 088557	DEBUG [RegistryInfo.cpp->GetBAMInfo:1934]	GetBAMInfo local
2023/07/02 14:40:42 088560	DEBUG [RegistryInfo.cpp->GetBAMInfo:1942]	User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\bam\State\UserSettings
2023/07/02 14:40:42 095339	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-2): 1332
2023/07/02 14:40:42 095461	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-3): 1332
2023/07/02 14:40:42 095587	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-4): 1332
2023/07/02 14:40:42 095743	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-5): 1332
2023/07/02 14:40:42 095863	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-6): 1332
2023/07/02 14:40:42 096072	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-7): 1332
2023/07/02 14:40:42 096225	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-8): 1332
2023/07/02 14:40:42 096367	DEBUG [misc.cpp->GetUserFromSID:13501]	Error: LookupAccountSid(S-1-5-90-0-9): 1332
2023/07/02 14:40:42 096390	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9276]	User Activity Scan: Got BAM
2023/07/02 14:40:42 096394	DEBUG [RegistryInfo.cpp->GetBAMInfo:1934]	GetBAMInfo local
2023/07/02 14:40:42 096397	DEBUG [RegistryInfo.cpp->GetBAMInfo:1942]	User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\dam\State\UserSettings
2023/07/02 14:40:42 096414	DEBUG [RegistryInfo.cpp->GetBAMInfo:1948]	User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\dam\UserSettings
2023/07/02 14:40:42 096425	DEBUG [RegistryInfo.cpp->GetBAMInfo:1954]	User Activity Scan: GetBAMInfo couldn't open key
2023/07/02 14:40:42 096427	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9279]	User Activity Scan: Got DAM
2023/07/02 14:40:42 097798	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:615]	DPAPI emulator: using master key 34 : Blob GUID e31136dc-f5b0-4cf7-9c5e-6abd56fc6c8f
2023/07/02 14:40:42 097803	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:649]	DPAPI emulator: useHashAlgo 32782
2023/07/02 14:40:42 097807	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:657]	DPAPI emulator: DPAPIMasterkey not decrypted
2023/07/02 14:40:42 098609	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:765]	DPAPI emulator: sha1 key FDAC2380CE5C61A51DC504E852CA6279C0712BB7
2023/07/02 14:40:42 112810	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:777]	DPAPI emulator: pbkdf2hmac 33BD1C51E176227EA5F368F18B34EB5AB8C6CF6578E8AAC21B498100839BFCF5DC7C90C4F07F3D4726CB1F7F144335A3
2023/07/02 14:40:42 112839	DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:997]	DPAPI emulator: Data blob decryption successful with Masterkey 34: 4143493139313631303031414C00
2023/07/02 14:40:42 112984	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9283]	User Activity Scan: Got connected Wireless
2023/07/02 14:40:42 112990	DEBUG [RegistryInfo.cpp->GetAmCacheInfo:6285]	User Activity Scan: GetAmCacheInfo Start [local]
2023/07/02 14:40:42 113081	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133]	CreateTempRegFileIfNeeded: A
2023/07/02 14:40:42 113223	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138]	CreateTempRegFileIfNeeded: B
2023/07/02 14:40:42 113228	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143]	CreateTempRegFileIfNeeded: C
2023/07/02 14:40:42 113274	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152]	CreateTempRegFileIfNeeded: DA
2023/07/02 14:40:42 113278	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160]	CreateTempRegFileIfNeeded: DB
2023/07/02 14:40:42 113280	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165]	CreateTempRegFileIfNeeded: DC
2023/07/02 14:40:42 113283	DEBUG [RegViewer.cpp->ShadowCopyFiles:182]	ShadowCopyFiles entry
2023/07/02 14:40:42 113286	DEBUG [RegViewer.cpp->ShadowCopyFiles:186]	ShadowCopyFiles: Trying to create shadow volume
2023/07/02 14:40:42 113290	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72]	CreateShadowVolumeForFC entry
2023/07/02 14:40:42 113293	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83]	CreateShadowVolumeForFC Initialize VSS client
2023/07/02 14:40:42 116024	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88]	CreateShadowVolumeForFC Get unique vol name for: C:\
2023/07/02 14:40:42 116206	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92]	 unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\
2023/07/02 14:40:42 116211	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100]	CreateShadowVolumeForFC create snapshot set
2023/07/02 14:40:43 217310	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109]	CreateShadowVolumeForFC getLatestSnapshotIdListt
2023/07/02 14:40:43 217317	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114]	CreateShadowVolumeForFC GetSnapshotDeviceName
2023/07/02 14:40:43 217771	DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123]	CreateShadowVolumeForFC exit
2023/07/02 14:40:43 217777	DEBUG [RegViewer.cpp->ShadowCopyFiles:208]	ShadowCopyFiles: created shadow volume
2023/07/02 14:40:43 217781	DEBUG [RegViewer.cpp->ShadowCopyFiles:213]	ShadowCopyFiles: 1 files to copy
2023/07/02 14:40:43 217783	DEBUG [RegViewer.cpp->ShadowCopyFiles:220]	ShadowCopyFiles: curent file: C:\WINDOWS\appcompat\Programs\AmCache.hve
2023/07/02 14:40:43 217786	DEBUG [RegViewer.cpp->ShadowCopyFiles:225]	ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy20\WINDOWS\appcompat\Programs\AmCache.hve
2023/07/02 14:40:43 217796	DEBUG [RegViewer.cpp->ShadowCopyFiles:238]	ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\2264\932723935BBEACA7AF94DA0223C32809
2023/07/02 14:40:43 632937	DEBUG [RegViewer.cpp->ShadowCopyFiles:275]	ShadowCopyFiles done
2023/07/02 14:40:43 636740	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177]	CreateTempRegFileIfNeeded check temp file access
2023/07/02 14:40:43 640425	DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223]	CreateTempRegFileIfNeeded: finished
2023/07/02 14:40:43 699394	DEBUG [RegistryInfo.cpp->GetAmCacheInfo:6527]	User Activity Scan: GetAmCacheInfo Finish [OK]
2023/07/02 14:40:43 699401	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9288]	User Activity Scan: Got AmCache
2023/07/02 14:40:43 699404	DEBUG [RegistryInfo.cpp->GetInstalledProgramsSystem:6534]	User Activity Scan: GetInstalledPrograms Start [Local]
2023/07/02 14:40:43 716505	DEBUG [RegistryInfo.cpp->GetInstalledProgramsSystem:6741]	User Activity Scan: GetInstalledPrograms done
2023/07/02 14:40:43 716512	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9291]	User Activity Scan: Got installed programs system
2023/07/02 14:40:43 716515	DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser:7096]	User Activity Scan: GetInstalledProgramsUser Start [Local]
2023/07/02 14:40:43 716904	DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser_Local:6760]	User Activity Scan: GetInstalledProgramsUser couldn't open key [Software\Microsoft\Installer\Products]
2023/07/02 14:40:43 716915	DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser_Local:6760]	User Activity Scan: GetInstalledProgramsUser couldn't open key [Software\Microsoft\Windows\ShellNoRoam\MuiCache]
2023/07/02 14:40:43 718509	DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser:7117]	User Activity Scan: GetInstalledProgramsUser Finish [OK]
2023/07/02 14:40:43 718513	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9294]	User Activity Scan: Got installed programs user
2023/07/02 14:40:43 718520	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214]	User Activity Scan: GetAppCompatFlagsInfo Start [Local]
2023/07/02 14:40:43 718524	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1233]	User Activity Scan: GetAppCompatFlagsInfo opening key SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
2023/07/02 14:40:43 718561	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1291]	User Activity Scan: GetAppCompatFlagsInfo done
2023/07/02 14:40:43 718711	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9306]	User Activity Scan: Got AppCompatFlags system
2023/07/02 14:40:43 718717	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214]	User Activity Scan: GetAppCompatFlagsInfo Start [Local]
2023/07/02 14:40:43 718720	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1225]	User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
2023/07/02 14:40:43 719153	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1291]	User Activity Scan: GetAppCompatFlagsInfo done
2023/07/02 14:40:43 719156	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9301]	User Activity Scan: Got AppCompatFlags user
2023/07/02 14:40:43 719159	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214]	User Activity Scan: GetAppCompatFlagsInfo Start [Local]
2023/07/02 14:40:43 719162	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1225]	User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
2023/07/02 14:40:43 719176	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1239]	User Activity Scan: GetAppCompatFlagsInfo couldn't open key
2023/07/02 14:40:43 719179	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9301]	User Activity Scan: Got AppCompatFlags user
2023/07/02 14:40:43 719181	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214]	User Activity Scan: GetAppCompatFlagsInfo Start [Local]
2023/07/02 14:40:43 719185	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1225]	User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
2023/07/02 14:40:43 740855	DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1291]	User Activity Scan: GetAppCompatFlagsInfo done
2023/07/02 14:40:43 740863	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9301]	User Activity Scan: Got AppCompatFlags user
2023/07/02 14:40:43 740866	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:574]	User Activity Scan: GetAutoRunEntriesSystem Start [Local]
2023/07/02 14:40:43 740897	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:595]	User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\Run
2023/07/02 14:40:43 740977	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:647]	User Activity Scan: GetAutoRunEntriesSystem scan values local
2023/07/02 14:40:43 741101	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:682]	User Activity Scan: GetAutoRunEntriesSystem scan values done
2023/07/02 14:40:43 741143	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:690]	User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
2023/07/02 14:40:43 741259	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:780]	User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\RunOnce
2023/07/02 14:40:43 741264	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:829]	User Activity Scan: GetAutoRunEntriesSystem scan values local
2023/07/02 14:40:43 741281	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:864]	User Activity Scan: GetAutoRunEntriesSystem scan values done
2023/07/02 14:40:43 741285	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:870]	User Activity Scan: GetAutoRunEntriesSystem done
2023/07/02 14:40:43 741294	DEBUG [RegistryInfo.cpp->GetRegistryInfo:9312]	User Activity Scan: Got autorun entries system
2023/07/02 14:40:43 741296	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:893]	User Activity Scan: GetAutoRunEntriesUser Start [Local]
2023/07/02 14:40:43 741312	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:913]	User Activity Scan: GetAutoRunEntriesUser Open Software\Microsoft\Windows NT\CurrentVersion\Run
2023/07/02 14:40:43 741322	DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:1008]	User Activity Scan: GetAutoRunEntriesUser Open Software\Microsoft\Windows\CurrentVersion\Run