g3log created log at: Sat Jul 01 22:44:47 2023 LOG format: [YYYY/MM/DD hh:mm:ss uuu* LEVEL FILE->FUNCTION:LINE] message (uuu*: microseconds fractions of the seconds value) 2023/07/01 22:44:47 590643 DEBUG [OSForensics.cpp->CheckRunInUSBMode:2748] LOGGER NOT INITIALIZED: CheckRunInUSBMode: Not Running from Removable DriveCheckRunInUSBMode: Not Running from Removable Drive 2023/07/01 22:44:52 542285 DEBUG [OSForensics.cpp->wWinMain:231] DEBUG: Starting... 2023/07/01 22:44:52 542291 DEBUG [OSForensics.cpp->wWinMain:237] DEBUG: 2023/7/1, 22:44:52 2023/07/01 22:44:52 542295 DEBUG [OSForensics.cpp->wWinMain:241] DEBUG: OSForensics 10.0 build 1014 64-bit 2023/07/01 22:44:52 542381 DEBUG [OSForensics.cpp->wWinMain:249] DEBUG OS: Windows 10 Home build 19045 (64-bit) 2023/07/01 22:44:52 542384 DEBUG [OSForensics.cpp->wWinMain:251] DEBUG Path: C:\Program Files\OSForensics 2023/07/01 22:44:52 542387 DEBUG [OSForensics.cpp->wWinMain:259] Date: 07/01/23 22:44:52 2023/07/01 22:44:52 545486 DEBUG [OSForensics.cpp->wWinMain:275] Main: Regproc check 2023/07/01 22:44:52 662142 DEBUG [OSForensics.cpp->wWinMain:315] Main: Set security OK 2023/07/01 22:44:52 662157 DEBUG [OSForensics.cpp->wWinMain:327] Main: Creating temp folder C:\ProgramData\PassMark\OSForensics\Temp\16280 2023/07/01 22:44:52 665361 DEBUG [OSForensics.cpp->wWinMain:344] Main: Available phys mem: 10978750464 2023/07/01 22:44:52 665644 DEBUG [OSForensics.cpp->wWinMain:385] Main: Load OSF config 2023/07/01 22:44:52 713629 DEBUG [OSForensics.cpp->wWinMain:422] Main: Init OSFMount interface OK 2023/07/01 22:44:52 719963 DEBUG [OSForensics.cpp->wWinMain:453] Main: Init direct access OK 2023/07/01 22:44:52 833083 DEBUG [OSForensics.cpp->wWinMain:513] Main: Register disk events 2023/07/01 22:44:52 833205 DEBUG [OSForensics.cpp->wWinMain:523] Main: init dialog 2023/07/01 22:44:52 833209 DEBUG [OSForensics.cpp->InitDialog:1225] Init main dialog 2023/07/01 22:44:52 884281 DEBUG [CfgMain.cpp->InitCfgMain:399] CfgMain: Creating start window 2023/07/01 22:44:52 894625 DEBUG [CfgMain.cpp->InitCfgMain:402] CfgMain: Creating signature window 2023/07/01 22:44:52 895850 DEBUG [CfgMain.cpp->InitCfgMain:411] CfgMain: Creating FileHashing window 2023/07/01 22:44:52 897486 DEBUG [CfgFileHashing.cpp->FileHashingWindow::InitWindow:259] FileHashing: Creating Hash Sets Tab 2023/07/01 22:44:52 909028 DEBUG [CfgFileHashing.cpp->FileHashingWindow::InitWindow:261] FileHashing: Creating Create Hash Tab 2023/07/01 22:44:52 944009 DEBUG [CfgMain.cpp->InitCfgMain:424] CfgMain: Creating file name search window 2023/07/01 22:44:53 028984 DEBUG [CfgMain.cpp->InitCfgMain:426] CfgMain: Creating mismatch search window 2023/07/01 22:44:53 055192 DEBUG [CfgMain.cpp->InitCfgMain:428] CfgMain: Creating create index window 2023/07/01 22:44:53 056844 DEBUG [CfgMain.cpp->InitCfgMain:430] CfgMain: Creating search index window 2023/07/01 22:44:53 069311 DEBUG [CfgMain.cpp->InitCfgMain:432] CfgMain: Creating user activity window 2023/07/01 22:44:53 087994 DEBUG [CfgMain.cpp->InitCfgMain:434] CfgMain: Creating deleted file search window 2023/07/01 22:44:53 119075 DEBUG [CfgMain.cpp->InitCfgMain:436] CfgMain: Creating mem viewer window 2023/07/01 22:44:53 121131 DEBUG [CfgMain.cpp->InitCfgMain:438] CfgMain: Creating prefetch viewer window 2023/07/01 22:44:53 123942 DEBUG [CfgMain.cpp->InitCfgMain:441] CfgMain: Creating raw disk viewer window 2023/07/01 22:44:53 131582 DEBUG [CfgMain.cpp->InitCfgMain:443] CfgMain: Creating sys info window 2023/07/01 22:44:53 148460 DEBUG [CfgMain.cpp->InitCfgMain:445] CfgMain: Creating drive prep window 2023/07/01 22:44:53 170150 DEBUG [CfgMain.cpp->InitCfgMain:447] CfgMain: Creating password window 2023/07/01 22:44:53 185021 DEBUG [CfgMain.cpp->InitCfgMain:449] CfgMain: Creating forensic imaging window 2023/07/01 22:44:53 187111 DEBUG [CfgMain.cpp->InitCfgMain:451] CfgMain: Creating boot virtual machine window 2023/07/01 22:44:53 189098 DEBUG [CfgMain.cpp->InitCfgMain:455] CfgMain: Creating Mobile Artifact window 2023/07/01 22:44:53 198325 DEBUG [CfgMain.cpp->InitCfgMain:457] CfgMain: Creating remote acquisition window 2023/07/01 22:44:53 218202 DEBUG [CfgMain.cpp->InitCfgMain:465] CfgMain: Creating manage case window 2023/07/01 22:44:53 241339 DEBUG [CfgMain.cpp->InitCfgMain:469] CfgMain: Creating triage window 2023/07/01 22:44:53 245116 DEBUG [CfgMain.cpp->InitCfgMain:472] CfgMain: set focus 2023/07/01 22:44:53 283043 DEBUG [OSForensics.cpp->InitDialog:1245] Init main dialog finished 2023/07/01 22:44:53 283050 DEBUG [OSForensics.cpp->wWinMain:527] Main: show window 2023/07/01 22:44:53 335527 DEBUG [OSForensics.cpp->wWinMain:546] Main: set Foreground 2023/07/01 22:44:53 335621 DEBUG [OSForensics.cpp->wWinMain:557] Main: PopFileInitialize 2023/07/01 22:44:53 335738 DEBUG [OSForensics.cpp->wWinMain:575] Main: Display welcome 2023/07/01 22:44:53 340404 DEBUG [OSForensics.cpp->wWinMain:589] Main: SubCheck 2023/07/01 22:44:55 047721 DEBUG [OSForensics.cpp->wWinMain:839] CaseManagementInitWindow: No case successfully loaded. Setting default drive to C:\ 2023/07/01 22:44:55 049715 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:419] Pswd: Creating Passwords & keys tab 2023/07/01 22:44:55 049725 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:421] Pswd: Creating Windows Login tab 2023/07/01 22:44:55 065736 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:423] Pswd: Initializing rainbow 2023/07/01 22:44:55 065836 DEBUG [main.cpp->initRainbowCrack:152] Rainbow: Loading charsets from C:\ProgramData\PassMark\OSForensics\RainbowTables\charset.txt 2023/07/01 22:44:55 065990 DEBUG [main.cpp->initRainbowCrack:158] Rainbow: Initializing SSL 2023/07/01 22:44:55 065995 DEBUG [main.cpp->initRainbowCrack:160] Rainbow: Initializing SSL 2023/07/01 22:44:55 066768 DEBUG [main.cpp->initRainbowCrack:173] Rainbow: Initializing Rainbow Table 2023/07/01 22:44:55 066772 DEBUG [main.cpp->initRainbowCrack:175] Rainbow: Initializing RainbowTable 2023/07/01 22:44:55 066776 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:425] Pswd: Creating Rainbow Generate tab 2023/07/01 22:44:55 151312 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:427] Pswd: Creating Rainbow Retrieval tab 2023/07/01 22:44:55 167359 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:429] Pswd: Creating Decryption tab 2023/07/01 22:44:55 191179 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:431] Pswd: Creating Install PFX tab 2023/07/01 22:44:55 206680 DEBUG [CfgSignature.cpp->SignatureWindow::InitWindow:200] Sig: Creating create sig tab 2023/07/01 22:44:55 219741 DEBUG [CfgSignature.cpp->SignatureWindow::InitWindow:202] Sig: Creating compare sig tab 2023/07/01 22:44:55 241209 DEBUG [OSForensics.cpp->wWinMain:853] CaseManagementInitWindow: Message loop 2023/07/01 22:44:55 833860 DEBUG [misc.cpp->RefreshPhysicalDisks:5478] Refresh Disks: sysinfo get partition info 2023/07/01 22:44:57 327262 DEBUG [misc.cpp->RefreshPhysicalDisks:5490] Refresh Disks: Open device: \\.\PhysicalDrive0 2023/07/01 22:44:57 327792 DEBUG [misc.cpp->RefreshPhysicalDisks:5496] Refresh Disks: Scan part table 2023/07/01 22:44:57 332093 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2102] Scanning for recovered file systems (StartSec=0,NumSec=2048) 2023/07/01 22:44:57 337324 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2110] Scanning for recovered file systems (StartSec=234438656,NumSec=2992) 2023/07/01 22:44:57 343660 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2113] Found 0 recovered file systems 2023/07/01 22:44:57 343700 DEBUG [misc.cpp->RefreshPhysicalDisks:5490] Refresh Disks: Open device: \\.\PhysicalDrive1 2023/07/01 22:44:57 344192 DEBUG [misc.cpp->RefreshPhysicalDisks:5496] Refresh Disks: Scan part table 2023/07/01 22:44:57 345600 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2102] Scanning for recovered file systems (StartSec=0,NumSec=34) 2023/07/01 22:44:57 348804 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2110] Scanning for recovered file systems (StartSec=1953521664,NumSec=3504) 2023/07/01 22:44:57 397440 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2113] Found 0 recovered file systems 2023/07/01 22:44:57 421222 DEBUG [CfgRecent.cpp->DoSort:2850] User Activity Scan: Sorting 2023/07/01 22:45:00 338499 DEBUG [CfgRecent.cpp->OnScan:3516] User Activity Scan: Begin 2023/07/01 22:45:00 338544 DEBUG [OSFActivityMonitor.cpp->OSFActivityMonitor::StartTask:198] Activity Monitor: Task Started (User Activity) 2023/07/01 22:45:00 338560 DEBUG [CfgRecent.cpp->OnScan:3523] User Activity Scan started on live machine 2023/07/01 22:45:00 357786 DEBUG [CfgRecent.cpp->OnScan:3665] User Activity Scan: Available phys mem: 10992422912 2023/07/01 22:45:00 357793 DEBUG [CfgRecent.cpp->OnScan:3672] User Activity Scan: Allocating MRUList 2023/07/01 22:45:00 357828 DEBUG [CfgRecent.cpp->OnScan:3674] User Activity Scan: Allocating installList 2023/07/01 22:45:00 357878 DEBUG [CfgRecent.cpp->OnScan:3676] User Activity Scan: Allocating autoRunList 2023/07/01 22:45:00 357890 DEBUG [CfgRecent.cpp->OnScan:3678] User Activity Scan: Allocating ClipboardList 2023/07/01 22:45:00 357934 DEBUG [CfgRecent.cpp->OnScan:3680] User Activity Scan: Allocating EventList 2023/07/01 22:45:00 357945 DEBUG [CfgRecent.cpp->OnScan:3682] User Activity Scan: Allocating userAssistList 2023/07/01 22:45:00 357979 DEBUG [CfgRecent.cpp->OnScan:3684] User Activity Scan: Allocating jumpListList 2023/07/01 22:45:00 358020 DEBUG [CfgRecent.cpp->OnScan:3686] User Activity Scan: Allocating shellBagList 2023/07/01 22:45:00 358060 DEBUG [CfgRecent.cpp->OnScan:3688] User Activity Scan: Allocating TimelineDBList 2023/07/01 22:45:00 358099 DEBUG [CfgRecent.cpp->OnScan:3690] User Activity Scan: Allocating CortanaList 2023/07/01 22:45:00 358139 DEBUG [CfgRecent.cpp->OnScan:3692] User Activity Scan: Allocating RecycleBinList 2023/07/01 22:45:00 358178 DEBUG [CfgRecent.cpp->OnScan:3694] User Activity Scan: Allocating ShimCacheList 2023/07/01 22:45:00 358270 DEBUG [CfgRecent.cpp->OnScan:3696] User Activity Scan: Allocating SRUMDBList 2023/07/01 22:45:00 358312 DEBUG [CfgRecent.cpp->OnScan:3698] User Activity Scan: Allocating prefetchList 2023/07/01 22:45:00 358351 DEBUG [CfgRecent.cpp->OnScan:3700] User Activity Scan: Allocating winsearchList 2023/07/01 22:45:00 358388 DEBUG [CfgRecent.cpp->OnScan:3702] User Activity Scan: Allocating gBAMList 2023/07/01 22:45:00 358434 DEBUG [CfgRecent.cpp->OnScan:3704] User Activity Scan: Allocating gAntiForensicsList 2023/07/01 22:45:00 358513 DEBUG [CfgRecent.cpp->OnScan:3709] User Activity Scan: Available phys mem: 10992373760 2023/07/01 22:45:00 358516 DEBUG [CfgRecent.cpp->OnScan:3711] User Activity Scan: Allocating downloadList 2023/07/01 22:45:00 358597 DEBUG [CfgRecent.cpp->OnScan:3713] User Activity Scan: Allocating urlList 2023/07/01 22:45:00 358646 DEBUG [CfgRecent.cpp->OnScan:3715] User Activity Scan: Allocating SearchTermList 2023/07/01 22:45:00 358721 DEBUG [CfgRecent.cpp->OnScan:3717] User Activity Scan: Allocating LoginList 2023/07/01 22:45:00 358889 DEBUG [CfgRecent.cpp->OnScan:3719] User Activity Scan: Allocating formList 2023/07/01 22:45:00 358935 DEBUG [CfgRecent.cpp->OnScan:3721] User Activity Scan: Allocating bookmarkList 2023/07/01 22:45:00 358975 DEBUG [CfgRecent.cpp->OnScan:3723] User Activity Scan: Allocating ChatList 2023/07/01 22:45:00 359014 DEBUG [CfgRecent.cpp->OnScan:3725] User Activity Scan: Allocating P2PList 2023/07/01 22:45:00 359053 DEBUG [CfgRecent.cpp->OnScan:3727] User Activity Scan: Allocating wlanList 2023/07/01 22:45:00 359092 DEBUG [CfgRecent.cpp->OnScan:3729] User Activity Scan: Allocating gCryptocurrencyList 2023/07/01 22:45:00 359131 DEBUG [CfgRecent.cpp->OnScan:3731] User Activity Scan: Allocating cookieList 2023/07/01 22:45:00 359178 DEBUG [CfgRecent.cpp->OnScan:3733] User Activity Scan: Allocating Custom Dictionary List 2023/07/01 22:45:00 359223 DEBUG [CfgRecent.cpp->OnScan:3738] User Activity Scan: Available phys mem: 10992087040 2023/07/01 22:45:00 359226 DEBUG [CfgRecent.cpp->OnScan:3740] User Activity Scan: Allocating UsbList 2023/07/01 22:45:00 359264 DEBUG [CfgRecent.cpp->OnScan:3742] User Activity Scan: Allocating mountedVolList 2023/07/01 22:45:00 359303 DEBUG [CfgRecent.cpp->OnScan:3744] User Activity Scan: Allocating MobileBackupList 2023/07/01 22:45:00 361696 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7597] GetLocalFolderNames: check SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 2023/07/01 22:45:00 361703 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7601] GetLocalFolderNames: Key loaded successfully 2023/07/01 22:45:00 361715 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7621] GetLocaFolderNames: DocumentsAndSettingsLocalName Users 2023/07/01 22:45:00 361723 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7643] GetLocaFolderNames: CommonAppDataLocalName ProgramData 2023/07/01 22:45:00 361776 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7670] GetLocalFolderNames: Could not query "{374DE290-123F-4565-9164-39C4925E467B}" 2023/07/01 22:45:00 361785 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7692] GetLocalFolderNames: Could not query "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" 2023/07/01 22:45:00 361794 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7714] GetLocalFolderNames: Could not query "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" 2023/07/01 22:45:00 361834 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/01 22:45:00 361926 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/01 22:45:00 361931 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3212] CreateTempRegFileIfNeeded: Error - file handle invalid (3) 2023/07/01 22:45:00 361966 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7792] GetLocaFolderNames: Registry Info: Could not load C:\Windows.old\Windows\System32\Config\SOFTWARE 2023/07/01 22:45:00 362006 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8255] GetLocaFolderNames: Getting folder locations based on current user C:\Users\User 2023/07/01 22:45:00 362194 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8274] GetLocaFolderNames: AppDataLocalName AppData\Roaming 2023/07/01 22:45:00 362233 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8293] GetLocaFolderNames: LocalAppDataLocalName AppData\Local 2023/07/01 22:45:00 362373 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8313] GetLocaFolderNames: HistoryLocalName AppData\Local\Microsoft\Windows\History 2023/07/01 22:45:00 362514 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8334] GetLocaFolderNames: RecentLocalName AppData\Roaming\Microsoft\Windows\Recent 2023/07/01 22:45:00 362525 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8345] GetLocalFolderNames: check local registry for "Local Settings" 2023/07/01 22:45:00 362606 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8759] LocalOSEnv::GetNextUser_Windows_Old start 2023/07/01 22:45:00 362611 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8885] LocalOSEnv::GetNextUser_Windows_Old get appdata dir 2023/07/01 22:45:00 362618 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8895] LocalOSEnv::GetNextUser_Windows_Old C:\Users\User\AppData\Local 2023/07/01 22:45:00 362681 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8920] LocalOSEnv::GetNextUser_Windows_Old Could not find Windows.old directory 2023/07/01 22:45:00 362689 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8514] GetLocalFolderNames end (detected OS: WinXP) 2023/07/01 22:45:00 362772 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:642] Password recovery: GetWindowsPasswordHashes start 2023/07/01 22:45:00 362780 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:826] Password recovery: GetWindowsPasswordHashes Live system drive 2023/07/01 22:45:00 363246 DEBUG [RegistryPasswords.cpp->DecryptHashes:2248] Password recovery: DecryptHashes start 2023/07/01 22:45:05 086257 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:227] Password recovery: GetCachedDomainUsers open C:\Windows\System32\Config\security 2023/07/01 22:45:05 086265 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/01 22:45:05 086329 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/01 22:45:05 086332 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/01 22:45:05 086501 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/01 22:45:05 086508 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/01 22:45:05 086510 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/01 22:45:05 086521 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/01 22:45:05 086525 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/01 22:45:05 086531 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/01 22:45:05 086533 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/01 22:45:05 095423 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/01 22:45:05 097491 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/01 22:45:05 097535 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/01 22:45:05 708376 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/01 22:45:05 708383 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/01 22:45:05 708857 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/01 22:45:05 708864 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/01 22:45:05 708867 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/01 22:45:05 708870 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\Windows\System32\Config\security 2023/07/01 22:45:05 708874 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\Windows\System32\Config\security 2023/07/01 22:45:05 708885 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16280\7BF3CE7C9DC6F1EC11D70AC3ADB400B8 2023/07/01 22:45:05 726084 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/01 22:45:05 729411 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/01 22:45:05 732852 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/01 22:45:05 733032 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:263] Password recovery: GetCachedDomainUsers 1 2023/07/01 22:45:05 733052 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:303] Password recovery: GetCachedDomainUsers 2 2023/07/01 22:45:05 733214 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:331] Password recovery: GetCachedDomainUsers 3 2023/07/01 22:45:05 733234 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:375] Password recovery: GetCachedDomainUsers 4 2023/07/01 22:45:05 733399 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:409] Password recovery: GetCachedDomainUsers 5 2023/07/01 22:45:05 733411 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:436] Password recovery: GetCachedDomainUsers 6 2023/07/01 22:45:05 733414 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:561] Password recovery: GetCachedDomainUsers done 2023/07/01 22:45:05 733418 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:568] Password recovery: GetCachedDomainUsers cleaned up 2023/07/01 22:45:05 733694 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:915] Password recovery: GetWindowsPasswordHashes end 2023/07/01 22:45:05 733700 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:642] Password recovery: GetWindowsPasswordHashes start 2023/07/01 22:45:05 733706 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:698] Password recovery: GetWindowsPasswordHashes registryFile: C:\Windows.old\Windows\System32\Config\SYSTEM 2023/07/01 22:45:05 733749 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:703] User Activity Scan: GetWindowsPasswordHashes file not found 2023/07/01 22:45:05 733904 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:39] GetSystemPWfromLSASecrets start 2023/07/01 22:45:05 734020 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/01 22:45:05 734045 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/01 22:45:05 734048 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/01 22:45:05 734069 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/01 22:45:05 734072 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/01 22:45:05 734074 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/01 22:45:05 734226 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/01 22:45:05 734230 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/01 22:45:05 734303 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/01 22:45:05 734307 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/01 22:45:05 737296 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/01 22:45:05 737497 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/01 22:45:05 737502 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/01 22:45:06 224369 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/01 22:45:06 224376 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/01 22:45:06 224886 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/01 22:45:06 224892 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/01 22:45:06 224895 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/01 22:45:06 224898 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\Windows\System32\config\SYSTEM 2023/07/01 22:45:06 224901 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\Windows\System32\config\SYSTEM 2023/07/01 22:45:06 224912 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16280\8F337D42B54B75C4007A892D5DDC3F83 2023/07/01 22:45:06 385972 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/01 22:45:06 390378 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/01 22:45:06 394223 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/01 22:45:06 394230 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/01 22:45:06 394276 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/01 22:45:06 394279 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/01 22:45:06 394315 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/01 22:45:06 394319 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/01 22:45:06 394466 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/01 22:45:06 394473 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/01 22:45:06 394540 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/01 22:45:06 394547 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/01 22:45:06 394549 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/01 22:45:06 397497 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/01 22:45:06 397672 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/01 22:45:06 397678 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/01 22:45:06 908469 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/01 22:45:06 908476 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/01 22:45:06 908939 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/01 22:45:06 908945 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/01 22:45:06 908949 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/01 22:45:06 908952 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\Windows\System32\config\SECURITY 2023/07/01 22:45:06 908955 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\Windows\System32\config\SECURITY 2023/07/01 22:45:06 908966 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16280\9252EB97A379014387027E5488A602AC 2023/07/01 22:45:06 925496 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/01 22:45:06 928940 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/01 22:45:06 932458 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/01 22:45:06 939098 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:181] Opening keys in : ControlSet001\Control\Lsa 2023/07/01 22:45:06 939286 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:244] Opening key: Policy\PolRevision 2023/07/01 22:45:06 939303 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:279] Policy revision: 1.2 2023/07/01 22:45:06 939305 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:287] Opening key: Policy\PolEKList 2023/07/01 22:45:06 939313 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:645] decryptLSAKeyNT6 start (lsa len: 172, syskey len: 16) 2023/07/01 22:45:06 939438 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:739] pt len = 96 2023/07/01 22:45:06 939441 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:750] key size = 84 2023/07/01 22:45:06 939446 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:784] nb = 1 2023/07/01 22:45:06 939448 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:816] [0] t = 3, l = 32 2023/07/01 22:45:06 939452 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:837] decryptLSAKeyNT6 end 2023/07/01 22:45:06 939488 DEBUG [LSASecrets.cpp->decryptLSASecret:525] decryptLSASecret start 2023/07/01 22:45:06 939563 DEBUG [LSASecrets.cpp->decryptLSASecret:639] decryptLSASecret end 2023/07/01 22:45:06 939572 DEBUG [LSASecrets.cpp->decryptLSASecret:525] decryptLSASecret start 2023/07/01 22:45:06 939645 DEBUG [LSASecrets.cpp->decryptLSASecret:639] decryptLSASecret end 2023/07/01 22:45:06 939681 DEBUG [LSASecrets.cpp->decryptLSASecret:525] decryptLSASecret start 2023/07/01 22:45:06 939751 DEBUG [LSASecrets.cpp->decryptLSASecret:639] decryptLSASecret end 2023/07/01 22:45:06 939823 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:517] GetSystemPWfromLSASecrets end 2023/07/01 22:45:06 940398 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:39] GetSystemPWfromLSASecrets start 2023/07/01 22:45:06 940519 DEBUG [RegViewer.cpp->RegViewer::LoadFile:2838] Could not open file, error: 3 2023/07/01 22:45:06 940524 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:129] GetSystemPWfromLSASecrets end - Couldn't open registry hive 2023/07/01 22:45:06 940535 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::DPAPIEmulator:99] using DPAPISystemToken (0) 2023/07/01 22:45:06 940541 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/01 22:45:06 940543 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8559] LocalOSEnv::GetNextUser xp check 2023/07/01 22:45:06 940693 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8566] LocalOSEnv::GetNextUser cleanup profile path 2023/07/01 22:45:06 940703 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594] LocalOSEnv::GetNextUser Drive != 0 2023/07/01 22:45:06 940705 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602] LocalOSEnv::GetNextUser GetVolumeInformation C:\ 2023/07/01 22:45:06 940826 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8611] LocalOSEnv::GetNextUser win7/mac check 2023/07/01 22:45:06 940904 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642] LocalOSEnv::GetNextUser cleanup profile path C:\Users\* 2023/07/01 22:45:06 940908 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648] LocalOSEnv::GetNextUser next 2023/07/01 22:45:06 940976 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/01 22:45:06 940981 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941051 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] . 2023/07/01 22:45:06 941083 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941085 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] .. 2023/07/01 22:45:06 941088 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941090 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] All Users 2023/07/01 22:45:06 941093 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/01 22:45:06 941163 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/01 22:45:06 941230 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/01 22:45:06 941235 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941238 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] Default 2023/07/01 22:45:06 941240 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/01 22:45:06 941300 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/01 22:45:06 941304 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/01 22:45:06 941306 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941308 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] Default User 2023/07/01 22:45:06 941309 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/01 22:45:06 941379 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/01 22:45:06 941382 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/01 22:45:06 941452 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941457 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] desktop.ini 2023/07/01 22:45:06 941486 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941489 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] Public 2023/07/01 22:45:06 941492 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/01 22:45:06 941562 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/01 22:45:06 941566 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/01 22:45:06 941568 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/01 22:45:06 941601 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] User 2023/07/01 22:45:06 941606 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/01 22:45:06 941751 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\1364fb9a-90d0-49d6-9cde-0680120fe0af 2023/07/01 22:45:06 942008 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\204e7ad4-f85d-48d8-8dcb-54b860a55f81 2023/07/01 22:45:06 942238 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\4838034f-dd34-4293-829b-99f75b0608c0 2023/07/01 22:45:06 942424 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\5baba3fc-72fc-4c20-82f6-806eefb9ca37 2023/07/01 22:45:06 942623 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\6149bc79-de93-4f07-a8c1-40fd701bba95 2023/07/01 22:45:06 942841 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\61775497-a204-41de-bf98-0e5880e7a6f2 2023/07/01 22:45:06 942940 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\646e1ef2-d412-4012-acf5-5fa1674979cf 2023/07/01 22:45:06 943035 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\813ac69a-15e8-4c95-8c7b-14b0fc71605a 2023/07/01 22:45:06 943130 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\95eb7a08-b147-48b4-8300-b5aa4b43d9af 2023/07/01 22:45:06 943207 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\9e6ae495-a7f3-4eda-aec8-907d779d75aa 2023/07/01 22:45:06 943570 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\f46b943c-dfe2-4aea-a69b-aa9d731511e6 2023/07/01 22:45:06 943691 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\f5a23ee7-1eb4-46dd-b17e-8f63726cde65 2023/07/01 22:45:06 943838 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/01 22:45:06 943848 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8586] LocalOSEnv::GetNextUser close handle 2023/07/01 22:45:06 943983 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594] LocalOSEnv::GetNextUser Drive != 0 2023/07/01 22:45:06 943989 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602] LocalOSEnv::GetNextUser GetVolumeInformation C:\ 2023/07/01 22:45:06 944040 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8626] LocalOSEnv::GetNextUser ubununtu check 2023/07/01 22:45:06 944075 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642] LocalOSEnv::GetNextUser cleanup profile path C:\home\* 2023/07/01 22:45:06 944079 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648] LocalOSEnv::GetNextUser next 2023/07/01 22:45:06 944081 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594] LocalOSEnv::GetNextUser Drive != 0 2023/07/01 22:45:06 944152 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602] LocalOSEnv::GetNextUser GetVolumeInformation C:\ 2023/07/01 22:45:06 944229 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642] LocalOSEnv::GetNextUser cleanup profile path 2023/07/01 22:45:06 944233 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648] LocalOSEnv::GetNextUser next 2023/07/01 22:45:06 944236 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8743] LocalOSEnv::GetNextUser end 2023/07/01 22:45:06 944391 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\03f95ae3-6db4-4482-b476-e89db1f73808 2023/07/01 22:45:06 944479 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 944545 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\19fe09c1-04a2-4ddd-bdff-03f493f410e1 2023/07/01 22:45:06 944637 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 944994 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\1cb44743-fed7-4fb5-be5b-364d20be132f 2023/07/01 22:45:06 945082 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 945174 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\3d5f12eb-2a33-4361-9674-b1098b1fad81 2023/07/01 22:45:06 945269 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 945312 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\5a9cafc1-139a-468f-81b1-7a815726efb5 2023/07/01 22:45:06 945381 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 945407 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\61363162-2599-48cd-81fe-85fa20b9c0f0 2023/07/01 22:45:06 945480 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 945518 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\66447004-a0e5-4a56-bade-d9200d4fe823 2023/07/01 22:45:06 945610 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 945706 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\7621f9b8-0ed0-423e-b192-01001ee54211 2023/07/01 22:45:06 945805 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 946254 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\90dc85cd-4fce-4eac-99cd-ca86c2c064d7 2023/07/01 22:45:06 946345 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 946406 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\b3497bb5-9fe2-456b-9f73-d749acf416fc 2023/07/01 22:45:06 946485 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 946513 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\cd95054d-8c0e-4f26-a42b-4d45cde7073e 2023/07/01 22:45:06 946594 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 946631 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\d9fd3abf-b694-46bf-9563-e1a3139fb5e9 2023/07/01 22:45:06 946712 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 946751 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\fec2c25a-e53e-4b3c-9461-4e0b769a29d7 2023/07/01 22:45:06 946819 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 946961 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\25f362bb-240b-49de-bfb0-702dce299208 2023/07/01 22:45:06 947036 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 947080 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\3411840e-c54e-464e-8e1a-bdd1e0d2a755 2023/07/01 22:45:06 947140 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 947190 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\37305382-59b1-48c8-ab7e-2b1ae7487c47 2023/07/01 22:45:06 947266 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 947314 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\4ded6254-7a79-494f-9281-1cd1ce58094a 2023/07/01 22:45:06 947388 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948093 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\5812b1c1-e9aa-4e4b-bddf-1a45f61c0104 2023/07/01 22:45:06 948179 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948274 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\5ac75647-5556-44eb-af54-98ca59c1fc6b 2023/07/01 22:45:06 948371 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948407 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\83d03260-0b4a-447d-8281-306f3ff71553 2023/07/01 22:45:06 948482 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948519 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\a4ab9305-1480-45dc-8769-640a3f7aba3f 2023/07/01 22:45:06 948598 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948624 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\aac7f893-1c8b-4e2c-9d40-95dba8b94cdb 2023/07/01 22:45:06 948701 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948733 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e31136dc-f5b0-4cf7-9c5e-6abd56fc6c8f 2023/07/01 22:45:06 948806 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948833 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e4c77d25-4d09-4543-817d-dbd31abf03e8 2023/07/01 22:45:06 948917 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 948956 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f482c7a6-e354-4812-941f-77321ddefe5d 2023/07/01 22:45:06 949027 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 949052 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f87b443f-06d6-42cd-8b7e-14e9da15b7c0 2023/07/01 22:45:06 949179 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/01 22:45:06 949285 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8759] LocalOSEnv::GetNextUser_Windows_Old start 2023/07/01 22:45:06 949289 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8779] LocalOSEnv::GetNextUser_Windows_Old xp check 2023/07/01 22:45:06 949329 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8786] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path 2023/07/01 22:45:06 949333 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814] LocalOSEnv::GetNextUser_Windows_Old Drive != 0 2023/07/01 22:45:06 949336 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822] LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\ 2023/07/01 22:45:06 949407 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8831] LocalOSEnv::GetNextUser_Windows_Old win7/mac check 2023/07/01 22:45:06 949440 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path C:\Windows.old\Users\* 2023/07/01 22:45:06 949443 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869] LocalOSEnv::GetNextUser_Windows_Old next 2023/07/01 22:45:06 949446 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814] LocalOSEnv::GetNextUser_Windows_Old Drive != 0 2023/07/01 22:45:06 949449 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822] LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\ 2023/07/01 22:45:06 949519 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8846] LocalOSEnv::GetNextUser_Windows_Old ubununtu check 2023/07/01 22:45:06 949551 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path C:\old\home\* 2023/07/01 22:45:06 949555 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869] LocalOSEnv::GetNextUser_Windows_Old next 2023/07/01 22:45:06 949557 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814] LocalOSEnv::GetNextUser_Windows_Old Drive != 0 2023/07/01 22:45:06 949559 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822] LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\ 2023/07/01 22:45:06 949597 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path 2023/07/01 22:45:06 949601 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869] LocalOSEnv::GetNextUser_Windows_Old next 2023/07/01 22:45:06 949669 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8987] LocalOSEnv::GetNextUser_Windows_Old end 2023/07/01 22:45:06 949710 DEBUG [CfgRecent.cpp->UserActivityScanThread:4058] User Activity Scan: Registry 2023/07/01 22:45:06 949740 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:3931] IsWindowsVistaOrHigher start 2023/07/01 22:45:06 949776 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:4072] IsWindowsVistaOrHigher finished 2023/07/01 22:45:06 949780 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9250] User Activity Scan: Registry Info live system 2023/07/01 22:45:06 950116 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9255] User Activity Scan: Registry Info: User User 2023/07/01 22:45:06 950162 DEBUG [RegistryInfo.cpp->GetMRUInfo:8721] User Activity Scan: Got GetLastVisited MRUs: new total 0 2023/07/01 22:45:06 950239 DEBUG [RegistryInfo.cpp->GetMRUInfo:8725] User Activity Scan: Got GetOpenSBave MRUs: new total 0 2023/07/01 22:45:06 950284 DEBUG [RegistryInfo.cpp->GetMRUInfo:8729] User Activity Scan: Got GetRecentDocs MRUs: new total 0 2023/07/01 22:45:06 953684 DEBUG [RegistryInfo.cpp->GetMRUInfo:8733] User Activity Scan: Got Office MRUs: new total 234 2023/07/01 22:45:06 953698 DEBUG [RegistryInfo.cpp->GetMRUInfo:8737] User Activity Scan: Got Run MRUs: new total 234 2023/07/01 22:45:06 953742 DEBUG [RegistryInfo.cpp->GetMRUInfo:8741] User Activity Scan: Got Network Drive MRUs: new total 234 2023/07/01 22:45:06 953842 DEBUG [RegistryInfo.cpp->GetMRUInfo:8745] User Activity Scan: Got Search MRUs: new total 234 2023/07/01 22:45:06 953858 DEBUG [RegistryInfo.cpp->GetMRUInfo:8749] User Activity Scan: Got PMV Search MRUs: new total 234 2023/07/01 22:45:06 953866 DEBUG [RegistryInfo.cpp->GetMRUInfo:8753] User Activity Scan: Got Internet Search MRUs: new total 234 2023/07/01 22:45:06 953874 DEBUG [RegistryInfo.cpp->GetMRUInfo:8757] User Activity Scan: Got PCP Search MRUs: new total 234 2023/07/01 22:45:06 953918 DEBUG [RegistryInfo.cpp->GetMRUInfo:8761] User Activity Scan: Got Wordpad MRUs: new total 235 2023/07/01 22:45:06 954005 DEBUG [RegistryInfo.cpp->GetMRUInfo:8765] User Activity Scan: Got Paint MRUs: new total 235 2023/07/01 22:45:06 954035 DEBUG [RegistryInfo.cpp->GetMRUInfo:8769] User Activity Scan: Got Windows Media Player MRUs: new total 235 2023/07/01 22:45:06 954325 DEBUG [RegistryInfo.cpp->GetMRUInfo:8773] User Activity Scan: Got Adobe Acrobat Reader MRUs: new total 239 2023/07/01 22:45:06 954785 DEBUG [RegistryInfo.cpp->GetMRUInfo:8777] User Activity Scan: Got Adobe Acrobat MRUs: new total 246 2023/07/01 22:45:06 954788 DEBUG [RegistryInfo.cpp->GetTypedIEURLS:3260] User Activity Scan: GetTypedIEURLS Start [Local] 2023/07/01 22:45:06 954801 DEBUG [RegistryInfo.cpp->GetTypedIEURLS:3323] User Activity Scan: GetTypedIEURLS finish no key found 2023/07/01 22:45:06 954803 DEBUG [RegistryInfo.cpp->GetMountPointsSystem:330] GetMountPointsSystem Start [Local] 2023/07/01 22:45:06 954819 DEBUG [RegistryInfo.cpp->GetMountPointsSystem:468] GetMountPointsSystem - enum live systems results 2023/07/01 22:45:06 956113 DEBUG [RegistryInfo.cpp->GetMountPointsSystem:551] GetMountPointsSystem - finished 2023/07/01 22:45:06 956120 DEBUG [RegistryInfo.cpp->GetOnceConnectedUSBStorage:7130] User Activity Scan: GetOnceConnectedUSBStorage Start [Local] 2023/07/01 22:45:06 956135 DEBUG [RegistryInfo.cpp->GetOnceConnectedUSBStorage:7324] User Activity Scan: GetOnceConnectedUSBStorage couldn't open key 2023/07/01 22:45:06 956138 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9264] User Activity Scan: Got connected USB 2023/07/01 22:45:06 956141 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5175] User Activity Scan: GetOtherConnectedUSB [Local] 2023/07/01 22:45:06 956143 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5206] GetOtherConnectedUSB() - Parsing Vendor ID file. 2023/07/01 22:45:06 957829 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5243] Found 844 VIDs in file C:\ProgramData\PassMark\OSForensics\usb.if. 2023/07/01 22:45:06 988474 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5326] Found 3411 VIDs 2951 PIDs in file C:\ProgramData\PassMark\OSForensics\usb.ids. 2023/07/01 22:45:06 988483 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5339] Open SYSTEM\CurrentControlSet\Enum\USB 2023/07/01 22:45:06 988525 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = _HUB30 2023/07/01 22:45:06 988528 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5632] Count < 2 2023/07/01 22:45:06 988536 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 03F0 2023/07/01 22:45:06 988543 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 988632 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 988778 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (03F0) 2023/07/01 22:45:06 988865 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 988870 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: HP Inc. (VID_03F0) 2023/07/01 22:45:06 988873 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/01 22:45:06 988956 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 989002 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 03F0 2023/07/01 22:45:06 989092 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 989176 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 989180 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (03F0) 2023/07/01 22:45:06 989183 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 989267 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: HP Inc. (VID_03F0) 2023/07/01 22:45:06 989273 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/01 22:45:06 989310 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 989355 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 03F0 2023/07/01 22:45:06 989400 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 989489 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 989493 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (03F0) 2023/07/01 22:45:06 989496 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 989498 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: HP Inc. (VID_03F0) 2023/07/01 22:45:06 989624 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/01 22:45:06 989629 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 989756 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 03F0 2023/07/01 22:45:06 989844 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 989931 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 989936 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (03F0) 2023/07/01 22:45:06 989939 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 989942 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: HP Inc. (VID_03F0) 2023/07/01 22:45:06 990066 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/01 22:45:06 990069 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 990157 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 03F0 2023/07/01 22:45:06 990165 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 990243 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 990248 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (03F0) 2023/07/01 22:45:06 990251 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 990258 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: HP Inc. (VID_03F0) 2023/07/01 22:45:06 990289 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/01 22:45:06 990292 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 990334 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 09DA 2023/07/01 22:45:06 990342 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 990421 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 990426 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (09DA) 2023/07/01 22:45:06 990430 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 990439 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/01 22:45:06 990472 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/01 22:45:06 990475 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 990519 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 09DA 2023/07/01 22:45:06 990527 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 990607 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 990611 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (09DA) 2023/07/01 22:45:06 990614 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 990652 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/01 22:45:06 990655 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/01 22:45:06 990658 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 990698 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 09DA 2023/07/01 22:45:06 990705 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 990784 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 990788 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (09DA) 2023/07/01 22:45:06 990791 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 990794 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/01 22:45:06 990830 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/01 22:45:06 990833 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 990875 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 0C45 2023/07/01 22:45:06 990882 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 990962 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 990968 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 990971 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991008 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991011 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991013 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991091 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991095 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991098 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991101 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991103 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991140 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991230 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991234 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991237 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991239 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991277 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991279 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991321 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 0C45 2023/07/01 22:45:06 991328 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 991407 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991411 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991414 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991421 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991456 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991459 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991538 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991542 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991545 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991547 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991549 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991550 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991633 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991638 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991675 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991678 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991680 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991682 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991720 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 0C45 2023/07/01 22:45:06 991728 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 991803 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991809 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991812 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991814 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991817 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991853 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 991937 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 991945 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 991948 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 991950 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991953 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 991955 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992029 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992034 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (0C45) 2023/07/01 22:45:06 992065 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992068 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 992070 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/01 22:45:06 992073 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992104 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1532 2023/07/01 22:45:06 992111 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 992181 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992186 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 992218 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992222 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992224 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992226 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992299 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992331 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 992334 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992337 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992339 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992369 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992409 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1532 2023/07/01 22:45:06 992416 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 992490 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992520 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 992524 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992527 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992529 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992558 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992632 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992637 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 992669 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992672 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992675 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992677 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992705 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1532 2023/07/01 22:45:06 992713 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 992786 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992790 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 992819 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992822 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992825 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992827 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 992928 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 992932 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 992935 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 992937 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992940 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 992972 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 993010 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1532 2023/07/01 22:45:06 993017 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 993086 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 993119 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 993122 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 993126 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 993156 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 993159 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 993232 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 993236 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1532) 2023/07/01 22:45:06 993239 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 993269 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 993272 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/01 22:45:06 993274 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 993307 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1C4F 2023/07/01 22:45:06 993314 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 993383 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 993416 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1C4F) 2023/07/01 22:45:06 993420 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 993423 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: SiGma Micro (VID_1C4F) 2023/07/01 22:45:06 993429 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = SiGma Micro (VID_1C4F) 2023/07/01 22:45:06 993456 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 993494 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1C4F 2023/07/01 22:45:06 993501 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 993570 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 993603 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1C4F) 2023/07/01 22:45:06 993607 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 993609 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: SiGma Micro (VID_1C4F) 2023/07/01 22:45:06 993612 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = SiGma Micro (VID_1C4F) 2023/07/01 22:45:06 993641 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 993652 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5618] tmpVID = 1C4F 2023/07/01 22:45:06 993660 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5643] Find unique IDs 2023/07/01 22:45:06 993729 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5713] Look up product 2023/07/01 22:45:06 993760 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5750] Look up vendor (1C4F) 2023/07/01 22:45:06 993764 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5755] Found: vendor 2023/07/01 22:45:06 993767 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5760] Found: SiGma Micro (VID_1C4F) 2023/07/01 22:45:06 993769 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5768] tmpVID 2 = SiGma Micro (VID_1C4F) 2023/07/01 22:45:06 993799 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5772] Add USB entry 2023/07/01 22:45:06 993837 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5800] User Activity Scan: GetOtherConnectedUSB end 2023/07/01 22:45:06 995922 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9267] User Activity Scan: Got other connected USB 2023/07/01 22:45:06 996000 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:5805] User Activity Scan: GetConnectedUSBasSCSI Start [Local] 2023/07/01 22:45:06 996070 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:5839] Open SYSTEM\CurrentControlSet\Enum\SCSI 2023/07/01 22:45:06 996141 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6086] Find unique IDs 2023/07/01 22:45:06 996251 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6086] Find unique IDs 2023/07/01 22:45:06 996328 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6216] User Activity Scan: GetConnectedUSBasSCSI end 2023/07/01 22:45:06 996361 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9270] User Activity Scan: Got connected USB as SCSI device 2023/07/01 22:45:06 996366 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:3931] IsWindowsVistaOrHigher start 2023/07/01 22:45:06 996396 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:4072] IsWindowsVistaOrHigher finished 2023/07/01 22:45:06 996400 DEBUG [RegistryInfo.cpp->GetShimCacheInfo:1809] GetShimCacheInfo local 2023/07/01 22:45:06 996402 DEBUG [RegistryInfo.cpp->GetShimCacheInfo:1818] User Activity Scan: GetShimCacheInfo opening key SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache 2023/07/01 22:45:06 997056 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 00720000071f003a 000a00004a610000 8664 Microsoft.MicrosoftEdge.Stable 8wekyb3d8bbwe 2023/07/01 22:45:06 997160 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0002000447940000 000a000042ee0000 8664 Microsoft.Wallet 8wekyb3d8bbwe 2023/07/01 22:45:06 997875 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 000a0000000203e8 000a000047ba0001 8664 windows.immersivecontrolpanel cw5n1h2txyewy neutral 2023/07/01 22:45:06 997955 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00015a0c00790000 000a0000585d0000 8664 Microsoft.YourPhone 8wekyb3d8bbwe 2023/07/01 22:45:06 998081 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0bb80372089f0000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/01 22:45:06 998088 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 3e8537f653f20000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/01 22:45:06 998122 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 5721057900020000 000a000047ba0000 8664 Microsoft.StorePurchaseApp 8wekyb3d8bbwe 2023/07/01 22:45:06 998126 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 0bb80372089f0000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/01 22:45:06 998640 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0004089c33f70000 000a00004a610000 8664 Microsoft.549981C3F5F10 8wekyb3d8bbwe 2023/07/01 22:45:06 998682 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 000a00004a610749 000a00004a610749 8664 Microsoft.Windows.SecHealthUI cw5n1h2txyewy 2023/07/01 22:45:06 998686 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 03e84a6103e80000 000a00007fff0000 8664 MicrosoftWindows.Client.CBS cw5n1h2txyewy 2023/07/01 22:45:06 998802 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000100d6047d0000 000a0000585d0000 014c SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/01 22:45:06 998806 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000100d6047d0000 000a0000585d0000 8664 SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/01 22:45:06 998809 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 5721057900010000 000a0000585d0000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/01 22:45:06 998814 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00010000f0970000 000a0000585d0000 8664 Microsoft.WebMediaExtensions 8wekyb3d8bbwe 2023/07/01 22:45:06 998968 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 07e7272e697a0000 000a00004a650000 8664 Microsoft.Windows.Photos 8wekyb3d8bbwe 2023/07/01 22:45:06 999134 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00920003043f0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/01 22:45:06 999138 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000a564b27390000 000a00004bc80000 8664 Microsoft.ZuneVideo 8wekyb3d8bbwe 2023/07/01 22:45:06 999142 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000b090000000000 000a000055f00000 8664 Microsoft.WindowsAlarms 8wekyb3d8bbwe 2023/07/01 22:45:06 999724 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 3e8137f653cc0000 000a000047ba0000 8664 Microsoft.Office.OneNote 8wekyb3d8bbwe 2023/07/01 22:45:06 999729 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000609013ed70000 000a000047ba0000 8664 Microsoft.MSPaint 8wekyb3d8bbwe 2023/07/01 22:45:07 000424 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 07e7272e697a0000 000a000055f00000 8664 Microsoft.Windows.Photos 8wekyb3d8bbwe 2023/07/01 22:45:07 000443 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000503370cbd0000 000a000055f00000 8664 Microsoft.XboxGamingOverlay 8wekyb3d8bbwe 2023/07/01 22:45:07 000523 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 0001000e000a4a61 000a00004a610000 8664 Microsoft.Windows.Search cw5n1h2txyewy neutral 2023/07/01 22:45:07 000562 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 3e8537f653e80000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/01 22:45:07 000616 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00920002041f0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/01 22:45:07 001077 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 03e84a6103ff0000 000a0000295b0000 8664 Microsoft.AAD.BrokerPlugin cw5n1h2txyewy neutral 2023/07/01 22:45:07 001714 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000100d502950000 000a0000585d0000 014c SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/01 22:45:07 001865 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 000a00004a6103ff 000a000000000000 8664 Microsoft.Windows.ContentDeliveryManager cw5n1h2txyewy neutral 2023/07/01 22:45:07 002105 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 000a00004a6103ff 000a00004a6103ff 8664 Microsoft.Windows.StartMenuExperienceHost cw5n1h2txyewy neutral 2023/07/01 22:45:07 002318 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000100d502950000 000a0000585d0000 8664 SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/01 22:45:07 002322 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00920001043a0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/01 22:45:07 002476 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00010000a4d00000 000a00004a610000 8664 Microsoft.WebMediaExtensions 8wekyb3d8bbwe 2023/07/01 22:45:07 002633 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 3e8537f653e00000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/01 22:45:07 002639 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00015a02006c0000 000a0000585d0000 8664 Microsoft.YourPhone 8wekyb3d8bbwe 2023/07/01 22:45:07 002643 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00.UWPDesktop 8wekyb3d8bbwe 2023/07/01 22:45:07 002647 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00.UWPDesktop 8wekyb3d8bbwe 2023/07/01 22:45:07 002650 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00 8wekyb3d8bbwe 2023/07/01 22:45:07 002654 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00 8wekyb3d8bbwe 2023/07/01 22:45:07 002658 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0012090104c60000 000a00004a610000 8664 Microsoft.MicrosoftOfficeHub 8wekyb3d8bbwe 2023/07/01 22:45:07 002662 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0bb8035306b00000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/01 22:45:07 002666 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0066090136b20000 000a00004a610000 8664 Microsoft.6365217CE6EB4 8wekyb3d8bbwe 2023/07/01 22:45:07 002671 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 0bb8035306b00000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/01 22:45:07 003399 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 5720057900030000 000a00004a650000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/01 22:45:07 003592 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 3e8537f653d80000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/01 22:45:07 003781 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 00720000071f0025 000a00004a610000 8664 Microsoft.MicrosoftEdge.Stable 8wekyb3d8bbwe 2023/07/01 22:45:07 004375 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 03e84a6103ff0000 000a000000000000 8664 Microsoft.Windows.Apprep.ChxApp cw5n1h2txyewy neutral 2023/07/01 22:45:07 004403 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 0001000e00094a61 000a00004a610000 8664 Microsoft.Windows.Search cw5n1h2txyewy neutral 2023/07/01 22:45:07 004447 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 07e70900000b0000 000a000055f00000 8664 Microsoft.WindowsCamera 8wekyb3d8bbwe 2023/07/01 22:45:07 004586 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 5720057900030000 000a0000585d0000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/01 22:45:07 004593 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000100132b3f0000 000a000062200000 8664 Microsoft.DesktopAppInstaller 8wekyb3d8bbwe 2023/07/01 22:45:07 004597 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000b090000020000 000a000055f0015a 8664 Microsoft.ZuneMusic 8wekyb3d8bbwe 2023/07/01 22:45:07 004600 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000a089a001e0000 000a000045630000 8664 Microsoft.People 8wekyb3d8bbwe 2023/07/01 22:45:07 004605 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 300f057900010000 000a000047ba0000 8664 Microsoft.StorePurchaseApp 8wekyb3d8bbwe 2023/07/01 22:45:07 004608 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000a089a001f0000 000a000045630000 8664 Microsoft.People 8wekyb3d8bbwe 2023/07/01 22:45:07 006816 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000100d403860000 000a0000585d0000 014c SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/01 22:45:07 006968 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 0071000006ee0039 000a00004a610000 8664 Microsoft.MicrosoftEdge.Stable 8wekyb3d8bbwe 2023/07/01 22:45:07 007153 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000000 000100d403860000 000a0000585d0000 8664 SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/01 22:45:07 007170 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 3e8537f653c60000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/01 22:45:07 007174 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00040035c9050000 000a00004a610000 8664 Microsoft.BingWeather 8wekyb3d8bbwe 2023/07/01 22:45:07 007430 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 000a00004a61079d 000a00004a61079d 8664 Microsoft.Windows.ShellExperienceHost cw5n1h2txyewy neutral 2023/07/01 22:45:07 007766 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0030005961a90000 000a00003ad70000 8664 Microsoft.XboxApp 8wekyb3d8bbwe 2023/07/01 22:45:07 007771 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 300d057900080000 000a000047ba0000 8664 Microsoft.StorePurchaseApp 8wekyb3d8bbwe 2023/07/01 22:45:07 007775 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 07d0523b05020000 000a000045180000 8664 Microsoft.MixedReality.Portal 8wekyb3d8bbwe 2023/07/01 22:45:07 007778 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000c005f0bb90000 000a000045630000 8664 Microsoft.XboxIdentityProvider 8wekyb3d8bbwe 2023/07/01 22:45:07 007782 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0004000600000000 000a000047ba0000 8664 Microsoft.MicrosoftStickyNotes 8wekyb3d8bbwe 2023/07/01 22:45:07 007785 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000400100c440000 000a00004a610000 8664 Microsoft.MicrosoftSolitaireCollection 8wekyb3d8bbwe 2023/07/01 22:45:07 007789 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 07e708fe000e0000 000a000055f00000 8664 Microsoft.WindowsCamera 8wekyb3d8bbwe 2023/07/01 22:45:07 007792 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000b08ff00050000 000a000055f00000 8664 Microsoft.WindowsMaps 8wekyb3d8bbwe 2023/07/01 22:45:07 008429 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000a07d80bb90000 000a000047ba0000 8664 Microsoft.ScreenSketch 8wekyb3d8bbwe 2023/07/01 22:45:07 008691 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00910003043e0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/01 22:45:07 008695 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000159f800ba0000 000a0000585d0000 8664 Microsoft.YourPhone 8wekyb3d8bbwe 2023/07/01 22:45:07 008698 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000159f800c40000 000a0000585d0000 8664 Microsoft.YourPhone 8wekyb3d8bbwe 2023/07/01 22:45:07 008703 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 571f057900070000 000a0000585d0000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/01 22:45:07 008744 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 0012090004b20000 000a00004a610000 8664 Microsoft.MicrosoftOfficeHub 8wekyb3d8bbwe 2023/07/01 22:45:07 008760 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00040035c8350000 000a00004a610000 8664 Microsoft.BingWeather 8wekyb3d8bbwe 2023/07/01 22:45:07 008764 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00040035c8a10000 000a00004a610000 8664 Microsoft.BingWeather 8wekyb3d8bbwe 2023/07/01 22:45:07 008767 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 00010000eef30000 000a0000585d0000 8664 Microsoft.HEIFImageExtension 8wekyb3d8bbwe 2023/07/01 22:45:07 008771 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 0000000b 0071000006ee0032 000a00004a610000 8664 Microsoft.MicrosoftEdge.Stable 8wekyb3d8bbwe 2023/07/01 22:45:07 009121 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1770] Unknown Shim Entry - App Name: 00000009 000a08ff2ad10000 000a000055f00000 8664 Microsoft.GetHelp 8wekyb3d8bbwe 2023/07/01 22:45:07 009282 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9273] User Activity Scan: Got Shim Cache 2023/07/01 22:45:07 009291 DEBUG [RegistryInfo.cpp->GetBAMInfo:1934] GetBAMInfo local 2023/07/01 22:45:07 009293 DEBUG [RegistryInfo.cpp->GetBAMInfo:1942] User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\bam\State\UserSettings 2023/07/01 22:45:07 015652 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-2): 1332 2023/07/01 22:45:07 015755 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-3): 1332 2023/07/01 22:45:07 015919 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-4): 1332 2023/07/01 22:45:07 016048 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-5): 1332 2023/07/01 22:45:07 016155 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-6): 1332 2023/07/01 22:45:07 016260 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-7): 1332 2023/07/01 22:45:07 016383 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-8): 1332 2023/07/01 22:45:07 016490 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-9): 1332 2023/07/01 22:45:07 016509 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9276] User Activity Scan: Got BAM 2023/07/01 22:45:07 016513 DEBUG [RegistryInfo.cpp->GetBAMInfo:1934] GetBAMInfo local 2023/07/01 22:45:07 016516 DEBUG [RegistryInfo.cpp->GetBAMInfo:1942] User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\dam\State\UserSettings 2023/07/01 22:45:07 016533 DEBUG [RegistryInfo.cpp->GetBAMInfo:1948] User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\dam\UserSettings 2023/07/01 22:45:07 016543 DEBUG [RegistryInfo.cpp->GetBAMInfo:1954] User Activity Scan: GetBAMInfo couldn't open key 2023/07/01 22:45:07 016640 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9279] User Activity Scan: Got DAM 2023/07/01 22:45:07 017894 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:615] DPAPI emulator: using master key 34 : Blob GUID e31136dc-f5b0-4cf7-9c5e-6abd56fc6c8f 2023/07/01 22:45:07 017899 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:649] DPAPI emulator: useHashAlgo 32782 2023/07/01 22:45:07 017902 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:657] DPAPI emulator: DPAPIMasterkey not decrypted 2023/07/01 22:45:07 018638 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:765] DPAPI emulator: sha1 key FDAC2380CE5C61A51DC504E852CA6279C0712BB7 2023/07/01 22:45:07 037453 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:777] DPAPI emulator: pbkdf2hmac 33BD1C51E176227EA5F368F18B34EB5AB8C6CF6578E8AAC21B498100839BFCF5DC7C90C4F07F3D4726CB1F7F144335A3 2023/07/01 22:45:07 037483 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:997] DPAPI emulator: Data blob decryption successful with Masterkey 34: 4143493139313631303031414C00 2023/07/01 22:45:07 037564 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9283] User Activity Scan: Got connected Wireless 2023/07/01 22:45:07 037718 DEBUG [RegistryInfo.cpp->GetAmCacheInfo:6285] User Activity Scan: GetAmCacheInfo Start [local] 2023/07/01 22:45:07 037873 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/01 22:45:07 037935 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/01 22:45:07 037938 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/01 22:45:07 038066 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/01 22:45:07 038072 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/01 22:45:07 038074 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/01 22:45:07 038077 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/01 22:45:07 038079 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/01 22:45:07 038155 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/01 22:45:07 038160 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/01 22:45:07 041612 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/01 22:45:07 041801 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/01 22:45:07 041806 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/01 22:45:07 476805 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/01 22:45:07 476811 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/01 22:45:07 477292 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/01 22:45:07 477298 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/01 22:45:07 477301 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/01 22:45:07 477304 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\WINDOWS\appcompat\Programs\AmCache.hve 2023/07/01 22:45:07 477309 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\WINDOWS\appcompat\Programs\AmCache.hve 2023/07/01 22:45:07 477320 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\16280\932723935BBEACA7AF94DA0223C32809 2023/07/01 22:45:07 536965 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/01 22:45:07 540514 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/01 22:45:07 544074 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/01 22:45:07 601371 DEBUG [RegistryInfo.cpp->GetAmCacheInfo:6527] User Activity Scan: GetAmCacheInfo Finish [OK] 2023/07/01 22:45:07 601378 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9288] User Activity Scan: Got AmCache 2023/07/01 22:45:07 601381 DEBUG [RegistryInfo.cpp->GetInstalledProgramsSystem:6534] User Activity Scan: GetInstalledPrograms Start [Local] 2023/07/01 22:45:07 616946 DEBUG [RegistryInfo.cpp->GetInstalledProgramsSystem:6741] User Activity Scan: GetInstalledPrograms done 2023/07/01 22:45:07 616954 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9291] User Activity Scan: Got installed programs system 2023/07/01 22:45:07 616968 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser:7096] User Activity Scan: GetInstalledProgramsUser Start [Local] 2023/07/01 22:45:07 617336 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser_Local:6760] User Activity Scan: GetInstalledProgramsUser couldn't open key [Software\Microsoft\Installer\Products] 2023/07/01 22:45:07 617348 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser_Local:6760] User Activity Scan: GetInstalledProgramsUser couldn't open key [Software\Microsoft\Windows\ShellNoRoam\MuiCache] 2023/07/01 22:45:07 618915 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser:7117] User Activity Scan: GetInstalledProgramsUser Finish [OK] 2023/07/01 22:45:07 618922 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9294] User Activity Scan: Got installed programs user 2023/07/01 22:45:07 618927 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/01 22:45:07 618931 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1233] User Activity Scan: GetAppCompatFlagsInfo opening key SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers 2023/07/01 22:45:07 618971 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1291] User Activity Scan: GetAppCompatFlagsInfo done 2023/07/01 22:45:07 618975 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9306] User Activity Scan: Got AppCompatFlags system 2023/07/01 22:45:07 618978 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/01 22:45:07 619011 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1225] User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers 2023/07/01 22:45:07 619421 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1291] User Activity Scan: GetAppCompatFlagsInfo done 2023/07/01 22:45:07 619424 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9301] User Activity Scan: Got AppCompatFlags user 2023/07/01 22:45:07 619426 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/01 22:45:07 619429 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1225] User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted 2023/07/01 22:45:07 619441 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1239] User Activity Scan: GetAppCompatFlagsInfo couldn't open key 2023/07/01 22:45:07 619443 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9301] User Activity Scan: Got AppCompatFlags user 2023/07/01 22:45:07 619445 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1214] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/01 22:45:07 619448 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1225] User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store 2023/07/01 22:45:07 641120 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1291] User Activity Scan: GetAppCompatFlagsInfo done 2023/07/01 22:45:07 641127 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9301] User Activity Scan: Got AppCompatFlags user 2023/07/01 22:45:07 641131 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:574] User Activity Scan: GetAutoRunEntriesSystem Start [Local] 2023/07/01 22:45:07 641158 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:595] User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\Run 2023/07/01 22:45:07 641161 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:647] User Activity Scan: GetAutoRunEntriesSystem scan values local 2023/07/01 22:45:07 641206 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:682] User Activity Scan: GetAutoRunEntriesSystem scan values done 2023/07/01 22:45:07 641358 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:690] User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run 2023/07/01 22:45:07 641440 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:780] User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\RunOnce 2023/07/01 22:45:07 641445 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:829] User Activity Scan: GetAutoRunEntriesSystem scan values local 2023/07/01 22:45:07 641470 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:864] User Activity Scan: GetAutoRunEntriesSystem scan values done 2023/07/01 22:45:07 641473 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:870] User Activity Scan: GetAutoRunEntriesSystem done 2023/07/01 22:45:07 641481 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9312] User Activity Scan: Got autorun entries system 2023/07/01 22:45:07 641551 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:893] User Activity Scan: GetAutoRunEntriesUser Start [Local] 2023/07/01 22:45:07 641588 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:913] User Activity Scan: GetAutoRunEntriesUser Open Software\Microsoft\Windows NT\CurrentVersion\Run 2023/07/01 22:45:07 641703 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:1008] User Activity Scan: GetAutoRunEntriesUser Open Software\Microsoft\Windows\CurrentVersion\Run 2023/07/01 22:45:07 641771 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:1059] User Activity Scan: GetAutoRunEntriesUser scan values local