g3log created log at: Thu Jul 13 13:03:53 2023 LOG format: [YYYY/MM/DD hh:mm:ss uuu* LEVEL FILE->FUNCTION:LINE] message (uuu*: microseconds fractions of the seconds value) 2023/07/13 13:03:53 767225 DEBUG [OSForensics.cpp->CheckRunInUSBMode:2748] LOGGER NOT INITIALIZED: CheckRunInUSBMode: Not Running from Removable DriveCheckRunInUSBMode: Not Running from Removable Drive 2023/07/13 13:03:55 042696 DEBUG [OSForensics.cpp->wWinMain:231] DEBUG: Starting... 2023/07/13 13:03:55 042702 DEBUG [OSForensics.cpp->wWinMain:237] DEBUG: 2023/7/13, 13:3:55 2023/07/13 13:03:55 042705 DEBUG [OSForensics.cpp->wWinMain:241] DEBUG: OSForensics 10.0 build 1014 64-bit 2023/07/13 13:03:55 042809 DEBUG [OSForensics.cpp->wWinMain:249] DEBUG OS: Windows 10 Home build 19045 (64-bit) 2023/07/13 13:03:55 042813 DEBUG [OSForensics.cpp->wWinMain:251] DEBUG Path: F:\OSForensics 2023/07/13 13:03:55 042817 DEBUG [OSForensics.cpp->wWinMain:259] Date: 07/13/23 13:03:55 2023/07/13 13:03:55 044060 DEBUG [OSForensics.cpp->wWinMain:275] Main: Regproc check 2023/07/13 13:03:55 173211 DEBUG [OSForensics.cpp->wWinMain:315] Main: Set security OK 2023/07/13 13:03:55 173222 DEBUG [OSForensics.cpp->wWinMain:327] Main: Creating temp folder C:\ProgramData\PassMark\OSForensics\Temp\13452 2023/07/13 13:03:55 176514 DEBUG [OSForensics.cpp->wWinMain:344] Main: Available phys mem: 10538483712 2023/07/13 13:03:55 176640 DEBUG [OSForensics.cpp->wWinMain:385] Main: Load OSF config 2023/07/13 13:03:55 217438 DEBUG [OSForensics.cpp->wWinMain:422] Main: Init OSFMount interface OK 2023/07/13 13:03:55 223625 DEBUG [OSForensics.cpp->wWinMain:453] Main: Init direct access OK 2023/07/13 13:03:55 352853 DEBUG [OSForensics.cpp->wWinMain:513] Main: Register disk events 2023/07/13 13:03:55 352935 DEBUG [OSForensics.cpp->wWinMain:523] Main: init dialog 2023/07/13 13:03:55 352938 DEBUG [OSForensics.cpp->InitDialog:1225] Init main dialog 2023/07/13 13:03:55 414261 DEBUG [CfgMain.cpp->InitCfgMain:399] CfgMain: Creating start window 2023/07/13 13:03:55 425720 DEBUG [CfgMain.cpp->InitCfgMain:402] CfgMain: Creating signature window 2023/07/13 13:03:55 427954 DEBUG [CfgMain.cpp->InitCfgMain:411] CfgMain: Creating FileHashing window 2023/07/13 13:03:55 431228 DEBUG [CfgFileHashing.cpp->FileHashingWindow::InitWindow:259] FileHashing: Creating Hash Sets Tab 2023/07/13 13:03:55 447140 DEBUG [CfgFileHashing.cpp->FileHashingWindow::InitWindow:261] FileHashing: Creating Create Hash Tab 2023/07/13 13:03:55 500890 DEBUG [CfgMain.cpp->InitCfgMain:424] CfgMain: Creating file name search window 2023/07/13 13:03:55 591179 DEBUG [CfgMain.cpp->InitCfgMain:426] CfgMain: Creating mismatch search window 2023/07/13 13:03:55 612038 DEBUG [CfgMain.cpp->InitCfgMain:428] CfgMain: Creating create index window 2023/07/13 13:03:55 614074 DEBUG [CfgMain.cpp->InitCfgMain:430] CfgMain: Creating search index window 2023/07/13 13:03:55 628125 DEBUG [CfgMain.cpp->InitCfgMain:432] CfgMain: Creating user activity window 2023/07/13 13:03:55 646305 DEBUG [CfgMain.cpp->InitCfgMain:434] CfgMain: Creating deleted file search window 2023/07/13 13:03:55 672591 DEBUG [CfgMain.cpp->InitCfgMain:436] CfgMain: Creating mem viewer window 2023/07/13 13:03:55 674074 DEBUG [CfgMain.cpp->InitCfgMain:438] CfgMain: Creating prefetch viewer window 2023/07/13 13:03:55 675870 DEBUG [CfgMain.cpp->InitCfgMain:441] CfgMain: Creating raw disk viewer window 2023/07/13 13:03:55 681820 DEBUG [CfgMain.cpp->InitCfgMain:443] CfgMain: Creating sys info window 2023/07/13 13:03:55 693637 DEBUG [CfgMain.cpp->InitCfgMain:445] CfgMain: Creating drive prep window 2023/07/13 13:03:55 708100 DEBUG [CfgMain.cpp->InitCfgMain:447] CfgMain: Creating password window 2023/07/13 13:03:55 717269 DEBUG [CfgMain.cpp->InitCfgMain:449] CfgMain: Creating forensic imaging window 2023/07/13 13:03:55 718628 DEBUG [CfgMain.cpp->InitCfgMain:451] CfgMain: Creating boot virtual machine window 2023/07/13 13:03:55 719857 DEBUG [CfgMain.cpp->InitCfgMain:455] CfgMain: Creating Mobile Artifact window 2023/07/13 13:03:55 725815 DEBUG [CfgMain.cpp->InitCfgMain:457] CfgMain: Creating remote acquisition window 2023/07/13 13:03:55 739909 DEBUG [CfgMain.cpp->InitCfgMain:465] CfgMain: Creating manage case window 2023/07/13 13:03:55 756941 DEBUG [CfgMain.cpp->InitCfgMain:469] CfgMain: Creating triage window 2023/07/13 13:03:55 760373 DEBUG [CfgMain.cpp->InitCfgMain:472] CfgMain: set focus 2023/07/13 13:03:55 801330 DEBUG [OSForensics.cpp->InitDialog:1245] Init main dialog finished 2023/07/13 13:03:55 801337 DEBUG [OSForensics.cpp->wWinMain:527] Main: show window 2023/07/13 13:03:55 832422 DEBUG [OSForensics.cpp->wWinMain:546] Main: set Foreground 2023/07/13 13:03:55 832461 DEBUG [OSForensics.cpp->wWinMain:557] Main: PopFileInitialize 2023/07/13 13:03:55 832568 DEBUG [OSForensics.cpp->wWinMain:575] Main: Display welcome 2023/07/13 13:03:55 837101 DEBUG [OSForensics.cpp->wWinMain:589] Main: SubCheck 2023/07/13 13:03:56 953958 DEBUG [OSForensics.cpp->wWinMain:839] CaseManagementInitWindow: No case successfully loaded. Setting default drive to C:\ 2023/07/13 13:03:56 955166 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:419] Pswd: Creating Passwords & keys tab 2023/07/13 13:03:56 955172 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:421] Pswd: Creating Windows Login tab 2023/07/13 13:03:56 968582 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:423] Pswd: Initializing rainbow 2023/07/13 13:03:56 968701 DEBUG [main.cpp->initRainbowCrack:152] Rainbow: Loading charsets from C:\ProgramData\PassMark\OSForensics\RainbowTables\charset.txt 2023/07/13 13:03:56 968832 DEBUG [main.cpp->initRainbowCrack:158] Rainbow: Initializing SSL 2023/07/13 13:03:56 968836 DEBUG [main.cpp->initRainbowCrack:160] Rainbow: Initializing SSL 2023/07/13 13:03:56 969592 DEBUG [main.cpp->initRainbowCrack:173] Rainbow: Initializing Rainbow Table 2023/07/13 13:03:56 969596 DEBUG [main.cpp->initRainbowCrack:175] Rainbow: Initializing RainbowTable 2023/07/13 13:03:56 969600 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:425] Pswd: Creating Rainbow Generate tab 2023/07/13 13:03:57 038862 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:427] Pswd: Creating Rainbow Retrieval tab 2023/07/13 13:03:57 051653 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:429] Pswd: Creating Decryption tab 2023/07/13 13:03:57 071263 DEBUG [CfgCracking.cpp->CrackingWindow::InitWindow:431] Pswd: Creating Install PFX tab 2023/07/13 13:03:57 083447 DEBUG [CfgSignature.cpp->SignatureWindow::InitWindow:200] Sig: Creating create sig tab 2023/07/13 13:03:57 094168 DEBUG [CfgSignature.cpp->SignatureWindow::InitWindow:202] Sig: Creating compare sig tab 2023/07/13 13:03:57 111680 DEBUG [OSForensics.cpp->wWinMain:853] CaseManagementInitWindow: Message loop 2023/07/13 13:04:04 512661 DEBUG [misc.cpp->RefreshPhysicalDisks:5478] Refresh Disks: sysinfo get partition info 2023/07/13 13:04:04 974671 DEBUG [misc.cpp->RefreshPhysicalDisks:5490] Refresh Disks: Open device: \\.\PhysicalDrive0 2023/07/13 13:04:04 975167 DEBUG [misc.cpp->RefreshPhysicalDisks:5496] Refresh Disks: Scan part table 2023/07/13 13:04:04 979645 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2102] Scanning for recovered file systems (StartSec=0,NumSec=2048) 2023/07/13 13:04:04 985026 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2110] Scanning for recovered file systems (StartSec=234438656,NumSec=2992) 2023/07/13 13:04:04 991049 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2113] Found 0 recovered file systems 2023/07/13 13:04:04 991108 DEBUG [misc.cpp->RefreshPhysicalDisks:5490] Refresh Disks: Open device: \\.\PhysicalDrive1 2023/07/13 13:04:04 991719 DEBUG [misc.cpp->RefreshPhysicalDisks:5496] Refresh Disks: Scan part table 2023/07/13 13:04:04 993372 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2102] Scanning for recovered file systems (StartSec=0,NumSec=34) 2023/07/13 13:04:04 996354 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2110] Scanning for recovered file systems (StartSec=1953521664,NumSec=3504) 2023/07/13 13:04:05 047841 DEBUG [DiskPartitionInfo.cpp->ScanAllDiskPartitions:2113] Found 0 recovered file systems 2023/07/13 13:04:05 067539 DEBUG [CfgRecent.cpp->DoSort:2850] User Activity Scan: Sorting 2023/07/13 13:04:08 227538 DEBUG [CfgRecent.cpp->OnScan:3516] User Activity Scan: Begin 2023/07/13 13:04:08 227574 DEBUG [OSFActivityMonitor.cpp->OSFActivityMonitor::StartTask:198] Activity Monitor: Task Started (User Activity) 2023/07/13 13:04:08 227595 DEBUG [CfgRecent.cpp->OnScan:3523] User Activity Scan started on live machine 2023/07/13 13:04:08 242568 DEBUG [CfgRecent.cpp->OnScan:3665] User Activity Scan: Available phys mem: 10528530432 2023/07/13 13:04:08 242575 DEBUG [CfgRecent.cpp->OnScan:3672] User Activity Scan: Allocating MRUList 2023/07/13 13:04:08 242599 DEBUG [CfgRecent.cpp->OnScan:3674] User Activity Scan: Allocating installList 2023/07/13 13:04:08 242610 DEBUG [CfgRecent.cpp->OnScan:3676] User Activity Scan: Allocating autoRunList 2023/07/13 13:04:08 242621 DEBUG [CfgRecent.cpp->OnScan:3678] User Activity Scan: Allocating ClipboardList 2023/07/13 13:04:08 242630 DEBUG [CfgRecent.cpp->OnScan:3680] User Activity Scan: Allocating EventList 2023/07/13 13:04:08 242689 DEBUG [CfgRecent.cpp->OnScan:3682] User Activity Scan: Allocating userAssistList 2023/07/13 13:04:08 242701 DEBUG [CfgRecent.cpp->OnScan:3684] User Activity Scan: Allocating jumpListList 2023/07/13 13:04:08 242711 DEBUG [CfgRecent.cpp->OnScan:3686] User Activity Scan: Allocating shellBagList 2023/07/13 13:04:08 242722 DEBUG [CfgRecent.cpp->OnScan:3688] User Activity Scan: Allocating TimelineDBList 2023/07/13 13:04:08 242758 DEBUG [CfgRecent.cpp->OnScan:3690] User Activity Scan: Allocating CortanaList 2023/07/13 13:04:08 242800 DEBUG [CfgRecent.cpp->OnScan:3692] User Activity Scan: Allocating RecycleBinList 2023/07/13 13:04:08 242841 DEBUG [CfgRecent.cpp->OnScan:3694] User Activity Scan: Allocating ShimCacheList 2023/07/13 13:04:08 242882 DEBUG [CfgRecent.cpp->OnScan:3696] User Activity Scan: Allocating SRUMDBList 2023/07/13 13:04:08 242921 DEBUG [CfgRecent.cpp->OnScan:3698] User Activity Scan: Allocating prefetchList 2023/07/13 13:04:08 242961 DEBUG [CfgRecent.cpp->OnScan:3700] User Activity Scan: Allocating winsearchList 2023/07/13 13:04:08 243000 DEBUG [CfgRecent.cpp->OnScan:3702] User Activity Scan: Allocating gBAMList 2023/07/13 13:04:08 243040 DEBUG [CfgRecent.cpp->OnScan:3704] User Activity Scan: Allocating gAntiForensicsList 2023/07/13 13:04:08 243081 DEBUG [CfgRecent.cpp->OnScan:3709] User Activity Scan: Available phys mem: 10528481280 2023/07/13 13:04:08 243084 DEBUG [CfgRecent.cpp->OnScan:3711] User Activity Scan: Allocating downloadList 2023/07/13 13:04:08 243121 DEBUG [CfgRecent.cpp->OnScan:3713] User Activity Scan: Allocating urlList 2023/07/13 13:04:08 243158 DEBUG [CfgRecent.cpp->OnScan:3715] User Activity Scan: Allocating SearchTermList 2023/07/13 13:04:08 243196 DEBUG [CfgRecent.cpp->OnScan:3717] User Activity Scan: Allocating LoginList 2023/07/13 13:04:08 243382 DEBUG [CfgRecent.cpp->OnScan:3719] User Activity Scan: Allocating formList 2023/07/13 13:04:08 243428 DEBUG [CfgRecent.cpp->OnScan:3721] User Activity Scan: Allocating bookmarkList 2023/07/13 13:04:08 243467 DEBUG [CfgRecent.cpp->OnScan:3723] User Activity Scan: Allocating ChatList 2023/07/13 13:04:08 243506 DEBUG [CfgRecent.cpp->OnScan:3725] User Activity Scan: Allocating P2PList 2023/07/13 13:04:08 243544 DEBUG [CfgRecent.cpp->OnScan:3727] User Activity Scan: Allocating wlanList 2023/07/13 13:04:08 243582 DEBUG [CfgRecent.cpp->OnScan:3729] User Activity Scan: Allocating gCryptocurrencyList 2023/07/13 13:04:08 243619 DEBUG [CfgRecent.cpp->OnScan:3731] User Activity Scan: Allocating cookieList 2023/07/13 13:04:08 243658 DEBUG [CfgRecent.cpp->OnScan:3733] User Activity Scan: Allocating Custom Dictionary List 2023/07/13 13:04:08 243696 DEBUG [CfgRecent.cpp->OnScan:3738] User Activity Scan: Available phys mem: 10528362496 2023/07/13 13:04:08 243699 DEBUG [CfgRecent.cpp->OnScan:3740] User Activity Scan: Allocating UsbList 2023/07/13 13:04:08 243734 DEBUG [CfgRecent.cpp->OnScan:3742] User Activity Scan: Allocating mountedVolList 2023/07/13 13:04:08 243773 DEBUG [CfgRecent.cpp->OnScan:3744] User Activity Scan: Allocating MobileBackupList 2023/07/13 13:04:08 245769 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7597] GetLocalFolderNames: check SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 2023/07/13 13:04:08 245774 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7601] GetLocalFolderNames: Key loaded successfully 2023/07/13 13:04:08 245786 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7621] GetLocaFolderNames: DocumentsAndSettingsLocalName Users 2023/07/13 13:04:08 245793 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7643] GetLocaFolderNames: CommonAppDataLocalName ProgramData 2023/07/13 13:04:08 245800 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7670] GetLocalFolderNames: Could not query "{374DE290-123F-4565-9164-39C4925E467B}" 2023/07/13 13:04:08 245806 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7692] GetLocalFolderNames: Could not query "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" 2023/07/13 13:04:08 245814 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7714] GetLocalFolderNames: Could not query "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" 2023/07/13 13:04:08 245822 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/13 13:04:08 245883 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/13 13:04:08 245892 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3212] CreateTempRegFileIfNeeded: Error - file handle invalid (3) 2023/07/13 13:04:08 245899 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:7792] GetLocaFolderNames: Registry Info: Could not load C:\Windows.old\Windows\System32\Config\SOFTWARE 2023/07/13 13:04:08 245951 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8255] GetLocaFolderNames: Getting folder locations based on current user C:\Users\User 2023/07/13 13:04:08 246002 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8274] GetLocaFolderNames: AppDataLocalName AppData\Roaming 2023/07/13 13:04:08 246034 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8293] GetLocaFolderNames: LocalAppDataLocalName AppData\Local 2023/07/13 13:04:08 246114 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8313] GetLocaFolderNames: HistoryLocalName AppData\Local\Microsoft\Windows\History 2023/07/13 13:04:08 246155 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8334] GetLocaFolderNames: RecentLocalName AppData\Roaming\Microsoft\Windows\Recent 2023/07/13 13:04:08 246190 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8345] GetLocalFolderNames: check local registry for "Local Settings" 2023/07/13 13:04:08 246272 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8759] LocalOSEnv::GetNextUser_Windows_Old start 2023/07/13 13:04:08 246307 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8885] LocalOSEnv::GetNextUser_Windows_Old get appdata dir 2023/07/13 13:04:08 246312 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8895] LocalOSEnv::GetNextUser_Windows_Old C:\Users\User\AppData\Local 2023/07/13 13:04:08 246390 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8920] LocalOSEnv::GetNextUser_Windows_Old Could not find Windows.old directory 2023/07/13 13:04:08 246422 DEBUG [misc.cpp->LocalOSEnv::GetLocalFolderNames:8514] GetLocalFolderNames end (detected OS: WinXP) 2023/07/13 13:04:08 246499 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:642] Password recovery: GetWindowsPasswordHashes start 2023/07/13 13:04:08 246505 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:826] Password recovery: GetWindowsPasswordHashes Live system drive 2023/07/13 13:04:08 247009 DEBUG [RegistryPasswords.cpp->DecryptHashes:2248] Password recovery: DecryptHashes start 2023/07/13 13:04:12 852311 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:227] Password recovery: GetCachedDomainUsers open C:\Windows\System32\Config\security 2023/07/13 13:04:12 852319 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/13 13:04:12 852468 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/13 13:04:12 852472 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/13 13:04:12 852523 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/13 13:04:12 852527 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/13 13:04:12 852529 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/13 13:04:12 852569 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/13 13:04:12 852572 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/13 13:04:12 852578 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/13 13:04:12 852581 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/13 13:04:12 859735 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/13 13:04:12 862072 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/13 13:04:12 862081 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/13 13:04:13 691954 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/13 13:04:13 691965 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/13 13:04:13 692905 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/13 13:04:13 692910 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/13 13:04:13 692914 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/13 13:04:13 692917 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\Windows\System32\Config\security 2023/07/13 13:04:13 692922 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\Windows\System32\Config\security 2023/07/13 13:04:13 692932 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\13452\7BF3CE7C9DC6F1EC11D70AC3ADB400B8 2023/07/13 13:04:13 710301 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/13 13:04:13 714355 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/13 13:04:13 714486 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/13 13:04:13 714622 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:263] Password recovery: GetCachedDomainUsers 1 2023/07/13 13:04:13 714692 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:303] Password recovery: GetCachedDomainUsers 2 2023/07/13 13:04:13 714835 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:331] Password recovery: GetCachedDomainUsers 3 2023/07/13 13:04:13 714856 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:375] Password recovery: GetCachedDomainUsers 4 2023/07/13 13:04:13 714985 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:409] Password recovery: GetCachedDomainUsers 5 2023/07/13 13:04:13 714995 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:436] Password recovery: GetCachedDomainUsers 6 2023/07/13 13:04:13 714999 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:561] Password recovery: GetCachedDomainUsers done 2023/07/13 13:04:13 715004 DEBUG [RegistryPasswords.cpp->GetCachedDomainUsers:568] Password recovery: GetCachedDomainUsers cleaned up 2023/07/13 13:04:13 715302 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:915] Password recovery: GetWindowsPasswordHashes end 2023/07/13 13:04:13 715308 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:642] Password recovery: GetWindowsPasswordHashes start 2023/07/13 13:04:13 715316 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:698] Password recovery: GetWindowsPasswordHashes registryFile: C:\Windows.old\Windows\System32\Config\SYSTEM 2023/07/13 13:04:13 715367 DEBUG [RegistryPasswords.cpp->GetWindowsPasswordHashes:703] User Activity Scan: GetWindowsPasswordHashes file not found 2023/07/13 13:04:13 715464 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:39] GetSystemPWfromLSASecrets start 2023/07/13 13:04:13 715587 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/13 13:04:13 715635 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/13 13:04:13 715639 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/13 13:04:13 715673 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/13 13:04:13 715677 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/13 13:04:13 715679 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/13 13:04:13 715717 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/13 13:04:13 715719 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/13 13:04:13 715725 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/13 13:04:13 715756 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/13 13:04:13 718384 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/13 13:04:13 718579 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/13 13:04:13 718584 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/13 13:04:14 543254 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/13 13:04:14 543261 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/13 13:04:14 544425 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/13 13:04:14 544431 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/13 13:04:14 544435 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/13 13:04:14 544437 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\Windows\System32\config\SYSTEM 2023/07/13 13:04:14 544440 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\Windows\System32\config\SYSTEM 2023/07/13 13:04:14 544451 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\13452\8F337D42B54B75C4007A892D5DDC3F83 2023/07/13 13:04:14 712593 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/13 13:04:14 717425 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/13 13:04:14 717531 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/13 13:04:14 717536 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/13 13:04:14 717599 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/13 13:04:14 717602 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/13 13:04:14 717646 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/13 13:04:14 717682 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/13 13:04:14 717685 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/13 13:04:14 717688 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/13 13:04:14 717690 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/13 13:04:14 717722 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/13 13:04:14 717724 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/13 13:04:14 720281 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/13 13:04:14 720473 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/13 13:04:14 720479 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/13 13:04:15 596879 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/13 13:04:15 596886 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/13 13:04:15 597778 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/13 13:04:15 597784 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/13 13:04:15 597788 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/13 13:04:15 597791 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\Windows\System32\config\SECURITY 2023/07/13 13:04:15 597795 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\Windows\System32\config\SECURITY 2023/07/13 13:04:15 597806 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\13452\9252EB97A379014387027E5488A602AC 2023/07/13 13:04:15 615265 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/13 13:04:15 619253 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/13 13:04:15 619379 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/13 13:04:15 626021 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:181] Opening keys in : ControlSet001\Control\Lsa 2023/07/13 13:04:15 626216 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:244] Opening key: Policy\PolRevision 2023/07/13 13:04:15 626232 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:279] Policy revision: 1.2 2023/07/13 13:04:15 626234 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:287] Opening key: Policy\PolEKList 2023/07/13 13:04:15 626243 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:645] decryptLSAKeyNT6 start (lsa len: 172, syskey len: 16) 2023/07/13 13:04:15 626355 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:739] pt len = 96 2023/07/13 13:04:15 626358 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:750] key size = 84 2023/07/13 13:04:15 626362 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:784] nb = 1 2023/07/13 13:04:15 626365 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:816] [0] t = 3, l = 32 2023/07/13 13:04:15 626369 DEBUG [LSASecrets.cpp->decryptLSAKeyNT6:837] decryptLSAKeyNT6 end 2023/07/13 13:04:15 626406 DEBUG [LSASecrets.cpp->decryptLSASecret:525] decryptLSASecret start 2023/07/13 13:04:15 626482 DEBUG [LSASecrets.cpp->decryptLSASecret:639] decryptLSASecret end 2023/07/13 13:04:15 626494 DEBUG [LSASecrets.cpp->decryptLSASecret:525] decryptLSASecret start 2023/07/13 13:04:15 626563 DEBUG [LSASecrets.cpp->decryptLSASecret:639] decryptLSASecret end 2023/07/13 13:04:15 626601 DEBUG [LSASecrets.cpp->decryptLSASecret:525] decryptLSASecret start 2023/07/13 13:04:15 626672 DEBUG [LSASecrets.cpp->decryptLSASecret:639] decryptLSASecret end 2023/07/13 13:04:15 626746 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:517] GetSystemPWfromLSASecrets end 2023/07/13 13:04:15 627397 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:39] GetSystemPWfromLSASecrets start 2023/07/13 13:04:15 627567 DEBUG [RegViewer.cpp->RegViewer::LoadFile:2838] Could not open file, error: 3 2023/07/13 13:04:15 627572 DEBUG [LSASecrets.cpp->GetSystemPWfromLSASecrets:129] GetSystemPWfromLSASecrets end - Couldn't open registry hive 2023/07/13 13:04:15 627590 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::DPAPIEmulator:99] using DPAPISystemToken (0) 2023/07/13 13:04:15 627598 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/13 13:04:15 627600 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8559] LocalOSEnv::GetNextUser xp check 2023/07/13 13:04:15 627667 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8566] LocalOSEnv::GetNextUser cleanup profile path 2023/07/13 13:04:15 627673 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594] LocalOSEnv::GetNextUser Drive != 0 2023/07/13 13:04:15 627806 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602] LocalOSEnv::GetNextUser GetVolumeInformation C:\ 2023/07/13 13:04:15 627880 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8611] LocalOSEnv::GetNextUser win7/mac check 2023/07/13 13:04:15 627992 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642] LocalOSEnv::GetNextUser cleanup profile path C:\Users\* 2023/07/13 13:04:15 627996 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648] LocalOSEnv::GetNextUser next 2023/07/13 13:04:15 627999 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/13 13:04:15 628001 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628003 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] . 2023/07/13 13:04:15 628044 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628048 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] .. 2023/07/13 13:04:15 628051 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628053 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] All Users 2023/07/13 13:04:15 628055 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/13 13:04:15 628135 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/13 13:04:15 628139 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/13 13:04:15 628141 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628211 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] Default 2023/07/13 13:04:15 628217 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/13 13:04:15 628289 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/13 13:04:15 628295 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/13 13:04:15 628362 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628368 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] Default User 2023/07/13 13:04:15 628371 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/13 13:04:15 628440 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/13 13:04:15 628445 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/13 13:04:15 628447 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628515 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] desktop.ini 2023/07/13 13:04:15 628521 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628524 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] Public 2023/07/13 13:04:15 628591 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/13 13:04:15 628702 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/13 13:04:15 628708 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8712] LocalOSEnv::GetNextUser Search for users in this location 2023/07/13 13:04:15 628778 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8716] LocalOSEnv::GetNextUser next file 2023/07/13 13:04:15 628784 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8718] User 2023/07/13 13:04:15 628852 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8726] LocalOSEnv::GetNextUser finish 2023/07/13 13:04:15 629045 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\1364fb9a-90d0-49d6-9cde-0680120fe0af 2023/07/13 13:04:15 629149 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\204e7ad4-f85d-48d8-8dcb-54b860a55f81 2023/07/13 13:04:15 629311 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\4838034f-dd34-4293-829b-99f75b0608c0 2023/07/13 13:04:15 629462 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\5baba3fc-72fc-4c20-82f6-806eefb9ca37 2023/07/13 13:04:15 629645 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\6149bc79-de93-4f07-a8c1-40fd701bba95 2023/07/13 13:04:15 629856 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\61775497-a204-41de-bf98-0e5880e7a6f2 2023/07/13 13:04:15 629962 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\646e1ef2-d412-4012-acf5-5fa1674979cf 2023/07/13 13:04:15 630057 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\813ac69a-15e8-4c95-8c7b-14b0fc71605a 2023/07/13 13:04:15 630142 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\95eb7a08-b147-48b4-8300-b5aa4b43d9af 2023/07/13 13:04:15 630218 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\9e6ae495-a7f3-4eda-aec8-907d779d75aa 2023/07/13 13:04:15 630539 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\f46b943c-dfe2-4aea-a69b-aa9d731511e6 2023/07/13 13:04:15 630645 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Users\User\AppData\Roaming\Microsoft\Protect\S-1-5-21-3433735131-2610830180-146811263-1001\f5a23ee7-1eb4-46dd-b17e-8f63726cde65 2023/07/13 13:04:15 630924 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8539] LocalOSEnv::GetNextUser start 2023/07/13 13:04:15 630951 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8586] LocalOSEnv::GetNextUser close handle 2023/07/13 13:04:15 631137 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594] LocalOSEnv::GetNextUser Drive != 0 2023/07/13 13:04:15 631143 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602] LocalOSEnv::GetNextUser GetVolumeInformation C:\ 2023/07/13 13:04:15 631340 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8626] LocalOSEnv::GetNextUser ubununtu check 2023/07/13 13:04:15 631396 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642] LocalOSEnv::GetNextUser cleanup profile path C:\home\* 2023/07/13 13:04:15 631400 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648] LocalOSEnv::GetNextUser next 2023/07/13 13:04:15 631402 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8594] LocalOSEnv::GetNextUser Drive != 0 2023/07/13 13:04:15 631446 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8602] LocalOSEnv::GetNextUser GetVolumeInformation C:\ 2023/07/13 13:04:15 631501 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8642] LocalOSEnv::GetNextUser cleanup profile path 2023/07/13 13:04:15 631541 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8648] LocalOSEnv::GetNextUser next 2023/07/13 13:04:15 631543 DEBUG [misc.cpp->LocalOSEnv::GetNextUser:8743] LocalOSEnv::GetNextUser end 2023/07/13 13:04:15 631728 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\03f95ae3-6db4-4482-b476-e89db1f73808 2023/07/13 13:04:15 631835 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 631866 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\19fe09c1-04a2-4ddd-bdff-03f493f410e1 2023/07/13 13:04:15 631933 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 632260 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\1cb44743-fed7-4fb5-be5b-364d20be132f 2023/07/13 13:04:15 632392 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 632424 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\3d5f12eb-2a33-4361-9674-b1098b1fad81 2023/07/13 13:04:15 632566 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 632593 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\5a9cafc1-139a-468f-81b1-7a815726efb5 2023/07/13 13:04:15 632711 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 632749 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\61363162-2599-48cd-81fe-85fa20b9c0f0 2023/07/13 13:04:15 632818 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 632848 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\66447004-a0e5-4a56-bade-d9200d4fe823 2023/07/13 13:04:15 632926 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 632956 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\7621f9b8-0ed0-423e-b192-01001ee54211 2023/07/13 13:04:15 633098 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 633476 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\90dc85cd-4fce-4eac-99cd-ca86c2c064d7 2023/07/13 13:04:15 633562 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 633648 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\b3497bb5-9fe2-456b-9f73-d749acf416fc 2023/07/13 13:04:15 633734 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 633825 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\cd95054d-8c0e-4f26-a42b-4d45cde7073e 2023/07/13 13:04:15 633910 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 634002 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\d9fd3abf-b694-46bf-9563-e1a3139fb5e9 2023/07/13 13:04:15 634087 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 634177 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\fec2c25a-e53e-4b3c-9461-4e0b769a29d7 2023/07/13 13:04:15 634265 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 634416 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\25f362bb-240b-49de-bfb0-702dce299208 2023/07/13 13:04:15 634496 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 634525 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\3411840e-c54e-464e-8e1a-bdd1e0d2a755 2023/07/13 13:04:15 634621 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 634644 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\37305382-59b1-48c8-ab7e-2b1ae7487c47 2023/07/13 13:04:15 634772 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 634828 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\4ded6254-7a79-494f-9281-1cd1ce58094a 2023/07/13 13:04:15 634910 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 635550 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\5812b1c1-e9aa-4e4b-bddf-1a45f61c0104 2023/07/13 13:04:15 635633 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 635717 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\5ac75647-5556-44eb-af54-98ca59c1fc6b 2023/07/13 13:04:15 635801 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 635835 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\83d03260-0b4a-447d-8281-306f3ff71553 2023/07/13 13:04:15 636000 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636038 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\a4ab9305-1480-45dc-8769-640a3f7aba3f 2023/07/13 13:04:15 636120 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636152 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\aac7f893-1c8b-4e2c-9d40-95dba8b94cdb 2023/07/13 13:04:15 636269 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636302 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e31136dc-f5b0-4cf7-9c5e-6abd56fc6c8f 2023/07/13 13:04:15 636383 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636410 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e4c77d25-4d09-4543-817d-dbd31abf03e8 2023/07/13 13:04:15 636497 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636535 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f482c7a6-e354-4812-941f-77321ddefe5d 2023/07/13 13:04:15 636619 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636654 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:242] AddMasterKeyFileToPool - C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f87b443f-06d6-42cd-8b7e-14e9da15b7c0 2023/07/13 13:04:15 636729 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::AddMasterKeyFileToPool:411] AddMasterKeyFileToPool Found DECRYPT_TYPE_SYSTEM master key 2023/07/13 13:04:15 636819 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8759] LocalOSEnv::GetNextUser_Windows_Old start 2023/07/13 13:04:15 636822 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8779] LocalOSEnv::GetNextUser_Windows_Old xp check 2023/07/13 13:04:15 636862 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8786] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path 2023/07/13 13:04:15 636865 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814] LocalOSEnv::GetNextUser_Windows_Old Drive != 0 2023/07/13 13:04:15 636868 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822] LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\ 2023/07/13 13:04:15 636980 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8831] LocalOSEnv::GetNextUser_Windows_Old win7/mac check 2023/07/13 13:04:15 637026 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path C:\Windows.old\Users\* 2023/07/13 13:04:15 637093 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869] LocalOSEnv::GetNextUser_Windows_Old next 2023/07/13 13:04:15 637098 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814] LocalOSEnv::GetNextUser_Windows_Old Drive != 0 2023/07/13 13:04:15 637101 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822] LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\ 2023/07/13 13:04:15 637180 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8846] LocalOSEnv::GetNextUser_Windows_Old ubununtu check 2023/07/13 13:04:15 637221 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path C:\old\home\* 2023/07/13 13:04:15 637296 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869] LocalOSEnv::GetNextUser_Windows_Old next 2023/07/13 13:04:15 637300 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8814] LocalOSEnv::GetNextUser_Windows_Old Drive != 0 2023/07/13 13:04:15 637303 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8822] LocalOSEnv::GetNextUser_Windows_Old GetVolumeInformation C:\ 2023/07/13 13:04:15 637424 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8863] LocalOSEnv::GetNextUser_Windows_Old cleanup profile path 2023/07/13 13:04:15 637429 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8869] LocalOSEnv::GetNextUser_Windows_Old next 2023/07/13 13:04:15 637432 DEBUG [misc.cpp->LocalOSEnv::GetNextUser_Windows_Old:8987] LocalOSEnv::GetNextUser_Windows_Old end 2023/07/13 13:04:15 637476 DEBUG [CfgRecent.cpp->UserActivityScanThread:4058] User Activity Scan: Registry 2023/07/13 13:04:15 637572 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:3947] IsWindowsVistaOrHigher start 2023/07/13 13:04:15 637608 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:4088] IsWindowsVistaOrHigher finished 2023/07/13 13:04:15 637613 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9266] User Activity Scan: Registry Info live system 2023/07/13 13:04:15 637916 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9271] User Activity Scan: Registry Info: User User 2023/07/13 13:04:15 637946 DEBUG [RegistryInfo.cpp->GetLastVisitedMRU:4377] User Activity Scan: GetLastVisitedMRU: Number of subkeys: 3 2023/07/13 13:04:15 638127 DEBUG [RegistryInfo.cpp->GetLastVisitedMRU:4449] User Activity Scan: GetLastVisitedMRU: (2) 0 (Size: 159 Bytes) => brave.exe [F:\Downloads] 2023/07/13 13:04:15 638247 DEBUG [RegistryInfo.cpp->GetLastVisitedMRU:4449] User Activity Scan: GetLastVisitedMRU: (3) 1 (Size: 783 Bytes) => {D69A10A6-1120-4984-93DB-2F5CF606BB8D} [C:\Users\User\OneDrive\Documents\Lupa\Claudia Bonalos, Aurelliano Bonalos] 2023/07/13 13:04:15 638262 DEBUG [RegistryInfo.cpp->GetMRUInfo:8737] User Activity Scan: Got GetLastVisited MRUs: new total 2 2023/07/13 13:04:15 639140 DEBUG [RegistryInfo.cpp->GetMRUInfo:8741] User Activity Scan: Got GetOpenSBave MRUs: new total 12 2023/07/13 13:04:15 639366 DEBUG [RegistryInfo.cpp->GetMRUInfo:8745] User Activity Scan: Got GetRecentDocs MRUs: new total 24 2023/07/13 13:04:15 642634 DEBUG [RegistryInfo.cpp->GetMRUInfo:8749] User Activity Scan: Got Office MRUs: new total 255 2023/07/13 13:04:15 642651 DEBUG [RegistryInfo.cpp->GetMRUInfo:8753] User Activity Scan: Got Run MRUs: new total 255 2023/07/13 13:04:15 642675 DEBUG [RegistryInfo.cpp->GetMRUInfo:8757] User Activity Scan: Got Network Drive MRUs: new total 255 2023/07/13 13:04:15 642801 DEBUG [RegistryInfo.cpp->GetMRUInfo:8761] User Activity Scan: Got Search MRUs: new total 255 2023/07/13 13:04:15 642818 DEBUG [RegistryInfo.cpp->GetMRUInfo:8765] User Activity Scan: Got PMV Search MRUs: new total 255 2023/07/13 13:04:15 642827 DEBUG [RegistryInfo.cpp->GetMRUInfo:8769] User Activity Scan: Got Internet Search MRUs: new total 255 2023/07/13 13:04:15 642835 DEBUG [RegistryInfo.cpp->GetMRUInfo:8773] User Activity Scan: Got PCP Search MRUs: new total 255 2023/07/13 13:04:15 642928 DEBUG [RegistryInfo.cpp->GetMRUInfo:8777] User Activity Scan: Got Wordpad MRUs: new total 256 2023/07/13 13:04:15 642961 DEBUG [RegistryInfo.cpp->GetMRUInfo:8781] User Activity Scan: Got Paint MRUs: new total 256 2023/07/13 13:04:15 643113 DEBUG [RegistryInfo.cpp->GetMRUInfo:8785] User Activity Scan: Got Windows Media Player MRUs: new total 256 2023/07/13 13:04:15 643425 DEBUG [RegistryInfo.cpp->GetMRUInfo:8789] User Activity Scan: Got Adobe Acrobat Reader MRUs: new total 260 2023/07/13 13:04:15 643911 DEBUG [RegistryInfo.cpp->GetMRUInfo:8793] User Activity Scan: Got Adobe Acrobat MRUs: new total 267 2023/07/13 13:04:15 643915 DEBUG [RegistryInfo.cpp->GetTypedIEURLS:3276] User Activity Scan: GetTypedIEURLS Start [Local] 2023/07/13 13:04:15 643927 DEBUG [RegistryInfo.cpp->GetTypedIEURLS:3339] User Activity Scan: GetTypedIEURLS finish no key found 2023/07/13 13:04:15 643930 DEBUG [RegistryInfo.cpp->GetMountPointsSystem:330] GetMountPointsSystem Start [Local] 2023/07/13 13:04:15 643939 DEBUG [RegistryInfo.cpp->GetMountPointsSystem:468] GetMountPointsSystem - enum live systems results 2023/07/13 13:04:15 645305 DEBUG [RegistryInfo.cpp->GetMountPointsSystem:551] GetMountPointsSystem - finished 2023/07/13 13:04:15 645308 DEBUG [RegistryInfo.cpp->GetOnceConnectedUSBStorage:7146] User Activity Scan: GetOnceConnectedUSBStorage Start [Local] 2023/07/13 13:04:15 645324 DEBUG [RegistryInfo.cpp->GetOnceConnectedUSBStorage:7340] User Activity Scan: GetOnceConnectedUSBStorage couldn't open key 2023/07/13 13:04:15 645328 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9280] User Activity Scan: Got connected USB 2023/07/13 13:04:15 645330 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5191] User Activity Scan: GetOtherConnectedUSB [Local] 2023/07/13 13:04:15 645332 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5222] GetOtherConnectedUSB() - Parsing Vendor ID file. 2023/07/13 13:04:15 647035 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5259] Found 844 VIDs in file C:\ProgramData\PassMark\OSForensics\usb.if. 2023/07/13 13:04:15 677402 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5342] Found 3411 VIDs 2951 PIDs in file C:\ProgramData\PassMark\OSForensics\usb.ids. 2023/07/13 13:04:15 677409 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5355] Open SYSTEM\CurrentControlSet\Enum\USB 2023/07/13 13:04:15 677453 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = _HUB30 2023/07/13 13:04:15 677456 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5648] Count < 2 2023/07/13 13:04:15 677462 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 03F0 2023/07/13 13:04:15 677471 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 677567 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 677572 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (03F0) 2023/07/13 13:04:15 677652 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 677658 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: HP Inc. (VID_03F0) 2023/07/13 13:04:15 677660 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/13 13:04:15 677731 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 677768 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 03F0 2023/07/13 13:04:15 677846 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 677995 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 678002 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (03F0) 2023/07/13 13:04:15 678068 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 678074 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: HP Inc. (VID_03F0) 2023/07/13 13:04:15 678144 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/13 13:04:15 678150 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 678178 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 03F0 2023/07/13 13:04:15 678189 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 678297 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 678301 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (03F0) 2023/07/13 13:04:15 678383 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 678406 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: HP Inc. (VID_03F0) 2023/07/13 13:04:15 678409 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/13 13:04:15 678410 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 678447 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 03F0 2023/07/13 13:04:15 678520 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 678630 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 678635 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (03F0) 2023/07/13 13:04:15 678702 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 678708 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: HP Inc. (VID_03F0) 2023/07/13 13:04:15 678710 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/13 13:04:15 678712 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 678741 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 03F0 2023/07/13 13:04:15 678751 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 678857 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 678861 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (03F0) 2023/07/13 13:04:15 678865 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 678935 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: HP Inc. (VID_03F0) 2023/07/13 13:04:15 678940 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = HP Inc. (VID_03F0) 2023/07/13 13:04:15 678943 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 678970 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 09DA 2023/07/13 13:04:15 678981 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 679081 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 679086 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (09DA) 2023/07/13 13:04:15 679090 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 679158 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/13 13:04:15 679164 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/13 13:04:15 679230 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 679272 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 09DA 2023/07/13 13:04:15 679342 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 679489 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 679494 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (09DA) 2023/07/13 13:04:15 679497 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 679564 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/13 13:04:15 679567 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/13 13:04:15 679569 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 679603 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 09DA 2023/07/13 13:04:15 679675 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 679754 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 679758 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (09DA) 2023/07/13 13:04:15 679823 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 679827 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/13 13:04:15 679829 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = A-FOUR TECH CO., LTD. (VID_09DA) 2023/07/13 13:04:15 679831 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 679861 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 0C45 2023/07/13 13:04:15 679869 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 679972 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 679978 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 680010 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 680013 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680015 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680018 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 680121 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 680126 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 680130 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 680159 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680162 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680163 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 680271 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 680276 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 680279 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 680281 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680310 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680313 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 680349 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 0C45 2023/07/13 13:04:15 680357 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 680434 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 680463 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 680467 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 680469 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680472 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680501 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 680585 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 680688 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 680692 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 680695 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680697 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680699 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 680805 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 680810 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 680813 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 680844 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680847 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 680849 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 680883 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 0C45 2023/07/13 13:04:15 680892 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 680994 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 680999 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 681001 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681008 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 681032 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 681035 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681143 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 681148 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 681151 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681181 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 681184 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 681187 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681294 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 681299 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (0C45) 2023/07/13 13:04:15 681303 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681305 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 681307 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Sonix Technology Co., Ltd. (VID_0C45) 2023/07/13 13:04:15 681310 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681364 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1532 2023/07/13 13:04:15 681372 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 681448 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 681452 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 681455 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681458 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681463 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681491 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681575 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 681604 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 681608 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681611 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681613 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681643 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681682 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1532 2023/07/13 13:04:15 681690 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 681765 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 681793 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 681796 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681799 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681802 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681831 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681913 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 681942 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 681945 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 681948 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681950 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 681952 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 681964 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1532 2023/07/13 13:04:15 681972 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 682059 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 682063 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 682067 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 682069 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682099 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682102 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 682209 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 682213 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 682216 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 682223 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682252 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682258 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 682288 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1532 2023/07/13 13:04:15 682328 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 682438 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 682442 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 682445 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 682476 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682479 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682481 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 682584 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 682588 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1532) 2023/07/13 13:04:15 682591 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 682594 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682623 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = Razer USA, Ltd (VID_1532) 2023/07/13 13:04:15 682626 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 682661 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1C4F 2023/07/13 13:04:15 682699 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 682776 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 682810 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1C4F) 2023/07/13 13:04:15 682814 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 682817 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: SiGma Micro (VID_1C4F) 2023/07/13 13:04:15 682819 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = SiGma Micro (VID_1C4F) 2023/07/13 13:04:15 682848 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 682887 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1C4F 2023/07/13 13:04:15 682925 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 683002 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 683007 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1C4F) 2023/07/13 13:04:15 683041 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 683044 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: SiGma Micro (VID_1C4F) 2023/07/13 13:04:15 683046 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = SiGma Micro (VID_1C4F) 2023/07/13 13:04:15 683048 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 683082 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5634] tmpVID = 1C4F 2023/07/13 13:04:15 683122 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5659] Find unique IDs 2023/07/13 13:04:15 683201 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5729] Look up product 2023/07/13 13:04:15 683206 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5766] Look up vendor (1C4F) 2023/07/13 13:04:15 683240 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5771] Found: vendor 2023/07/13 13:04:15 683243 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5776] Found: SiGma Micro (VID_1C4F) 2023/07/13 13:04:15 683245 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5784] tmpVID 2 = SiGma Micro (VID_1C4F) 2023/07/13 13:04:15 683247 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5788] Add USB entry 2023/07/13 13:04:15 683282 DEBUG [RegistryInfo.cpp->GetOtherConnectedUSB:5816] User Activity Scan: GetOtherConnectedUSB end 2023/07/13 13:04:15 685359 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9283] User Activity Scan: Got other connected USB 2023/07/13 13:04:15 685368 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:5821] User Activity Scan: GetConnectedUSBasSCSI Start [Local] 2023/07/13 13:04:15 685372 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:5855] Open SYSTEM\CurrentControlSet\Enum\SCSI 2023/07/13 13:04:15 685407 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6102] Find unique IDs 2023/07/13 13:04:15 685564 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6102] Find unique IDs 2023/07/13 13:04:15 685677 DEBUG [RegistryInfo.cpp->GetConnectedUSBasSCSI:6232] User Activity Scan: GetConnectedUSBasSCSI end 2023/07/13 13:04:15 685685 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9286] User Activity Scan: Got connected USB as SCSI device 2023/07/13 13:04:15 685800 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:3947] IsWindowsVistaOrHigher start 2023/07/13 13:04:15 685833 DEBUG [RegistryInfo.cpp->IsWindowsVistaOrHigher:4088] IsWindowsVistaOrHigher finished 2023/07/13 13:04:15 685837 DEBUG [RegistryInfo.cpp->GetShimCacheInfo:1825] GetShimCacheInfo local 2023/07/13 13:04:15 685840 DEBUG [RegistryInfo.cpp->GetShimCacheInfo:1834] User Activity Scan: GetShimCacheInfo opening key SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache 2023/07/13 13:04:15 686520 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000100d7033c0000 000a0000585d0000 8664 SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/13 13:04:15 686611 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 0008090255f10000 000a000047ba0000 8664 Microsoft.UI.Xaml.2.8 8wekyb3d8bbwe 2023/07/13 13:04:15 686615 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0008090255f10000 000a000047ba0000 8664 Microsoft.UI.Xaml.2.8 8wekyb3d8bbwe 2023/07/13 13:04:15 686621 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000a000059e40000 000a000028000000 8664 Microsoft.Services.Store.Engagement 8wekyb3d8bbwe 2023/07/13 13:04:15 686625 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000a000059e40000 000a000028000000 8664 Microsoft.Services.Store.Engagement 8wekyb3d8bbwe 2023/07/13 13:04:15 686703 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000a000059e30000 000a000028000000 8664 Microsoft.Services.Store.Engagement 8wekyb3d8bbwe 2023/07/13 13:04:15 686710 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000a000059e30000 000a000028000000 8664 Microsoft.Services.Store.Engagement 8wekyb3d8bbwe 2023/07/13 13:04:15 686857 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0001001406240000 000a000062200000 8664 Microsoft.DesktopAppInstaller 8wekyb3d8bbwe 2023/07/13 13:04:15 686923 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 000a00004a61079d 000a00004a61079d 8664 Microsoft.Windows.ShellExperienceHost cw5n1h2txyewy neutral 2023/07/13 13:04:15 687417 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00040035ca3f0000 000a00004a610000 8664 Microsoft.BingWeather 8wekyb3d8bbwe 2023/07/13 13:04:15 687955 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00010000f0970000 000a0000585d0000 8664 Microsoft.VP9VideoExtensions 8wekyb3d8bbwe 2023/07/13 13:04:15 687959 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000a07d80bb90000 000a000047ba0000 8664 Microsoft.ScreenSketch 8wekyb3d8bbwe 2023/07/13 13:04:15 688159 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0008000103c40000 000a0000585d04aa 8664 NVIDIACorp.NVIDIAControlPanel 56jybvy8sckqj 2023/07/13 13:04:15 689145 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 00720000071f003a 000a00004a610000 8664 Microsoft.MicrosoftEdge.Stable 8wekyb3d8bbwe 2023/07/13 13:04:15 689238 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0002000447940000 000a000042ee0000 8664 Microsoft.Wallet 8wekyb3d8bbwe 2023/07/13 13:04:15 689935 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 000a0000000203e8 000a000047ba0001 8664 windows.immersivecontrolpanel cw5n1h2txyewy neutral 2023/07/13 13:04:15 690074 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00015a0c00790000 000a0000585d0000 8664 Microsoft.YourPhone 8wekyb3d8bbwe 2023/07/13 13:04:15 690080 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0bb80372089f0000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/13 13:04:15 690085 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 3e8537f653f20000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/13 13:04:15 690122 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 5721057900020000 000a000047ba0000 8664 Microsoft.StorePurchaseApp 8wekyb3d8bbwe 2023/07/13 13:04:15 690259 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 0bb80372089f0000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/13 13:04:15 690771 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0004089c33f70000 000a00004a610000 8664 Microsoft.549981C3F5F10 8wekyb3d8bbwe 2023/07/13 13:04:15 690813 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 000a00004a610749 000a00004a610749 8664 Microsoft.Windows.SecHealthUI cw5n1h2txyewy 2023/07/13 13:04:15 690817 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 03e84a6103e80000 000a00007fff0000 8664 MicrosoftWindows.Client.CBS cw5n1h2txyewy 2023/07/13 13:04:15 690956 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000100d6047d0000 000a0000585d0000 014c SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/13 13:04:15 690960 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000100d6047d0000 000a0000585d0000 8664 SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/13 13:04:15 690965 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 5721057900010000 000a0000585d0000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/13 13:04:15 691038 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00010000f0970000 000a0000585d0000 8664 Microsoft.WebMediaExtensions 8wekyb3d8bbwe 2023/07/13 13:04:15 691197 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 07e7272e697a0000 000a00004a650000 8664 Microsoft.Windows.Photos 8wekyb3d8bbwe 2023/07/13 13:04:15 691363 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00920003043f0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/13 13:04:15 691368 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000a564b27390000 000a00004bc80000 8664 Microsoft.ZuneVideo 8wekyb3d8bbwe 2023/07/13 13:04:15 691371 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000b090000000000 000a000055f00000 8664 Microsoft.WindowsAlarms 8wekyb3d8bbwe 2023/07/13 13:04:15 691934 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 3e8137f653cc0000 000a000047ba0000 8664 Microsoft.Office.OneNote 8wekyb3d8bbwe 2023/07/13 13:04:15 691939 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000609013ed70000 000a000047ba0000 8664 Microsoft.MSPaint 8wekyb3d8bbwe 2023/07/13 13:04:15 692622 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 07e7272e697a0000 000a000055f00000 8664 Microsoft.Windows.Photos 8wekyb3d8bbwe 2023/07/13 13:04:15 692639 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000503370cbd0000 000a000055f00000 8664 Microsoft.XboxGamingOverlay 8wekyb3d8bbwe 2023/07/13 13:04:15 692716 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 0001000e000a4a61 000a00004a610000 8664 Microsoft.Windows.Search cw5n1h2txyewy neutral 2023/07/13 13:04:15 692751 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 3e8537f653e80000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/13 13:04:15 692804 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00920002041f0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/13 13:04:15 693266 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 03e84a6103ff0000 000a0000295b0000 8664 Microsoft.AAD.BrokerPlugin cw5n1h2txyewy neutral 2023/07/13 13:04:15 693887 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000100d502950000 000a0000585d0000 014c SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/13 13:04:15 694038 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 000a00004a6103ff 000a000000000000 8664 Microsoft.Windows.ContentDeliveryManager cw5n1h2txyewy neutral 2023/07/13 13:04:15 694274 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 000a00004a6103ff 000a00004a6103ff 8664 Microsoft.Windows.StartMenuExperienceHost cw5n1h2txyewy neutral 2023/07/13 13:04:15 694484 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000100d502950000 000a0000585d0000 8664 SpotifyAB.SpotifyMusic zpdnekdrzrea0 2023/07/13 13:04:15 694488 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00920001043a0000 000a000047ba0000 8664 AD2F1837.HPPrinterControl v10z8vjag6ke6 2023/07/13 13:04:15 694639 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00010000a4d00000 000a00004a610000 8664 Microsoft.WebMediaExtensions 8wekyb3d8bbwe 2023/07/13 13:04:15 694729 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 3e8537f653e00000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/13 13:04:15 694734 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 00015a02006c0000 000a0000585d0000 8664 Microsoft.YourPhone 8wekyb3d8bbwe 2023/07/13 13:04:15 694738 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00.UWPDesktop 8wekyb3d8bbwe 2023/07/13 13:04:15 694743 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00.UWPDesktop 8wekyb3d8bbwe 2023/07/13 13:04:15 694747 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00 8wekyb3d8bbwe 2023/07/13 13:04:15 694827 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000e00007f120000 000a0000273a0000 8664 Microsoft.VCLibs.140.00 8wekyb3d8bbwe 2023/07/13 13:04:15 694833 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0012090104c60000 000a00004a610000 8664 Microsoft.MicrosoftOfficeHub 8wekyb3d8bbwe 2023/07/13 13:04:15 694838 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0bb8035306b00000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/13 13:04:15 694911 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 0066090136b20000 000a00004a610000 8664 Microsoft.6365217CE6EB4 8wekyb3d8bbwe 2023/07/13 13:04:15 694918 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000000 0bb8035306b00000 000c000000000000 8664 Microsoft.WindowsAppRuntime.1.3 8wekyb3d8bbwe 2023/07/13 13:04:15 695635 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 5720057900030000 000a00004a650000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/13 13:04:15 695823 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 3e8537f653d80000 000a00004c610000 8664 microsoft.windowscommunicationsapps 8wekyb3d8bbwe 2023/07/13 13:04:15 696010 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 00720000071f0025 000a00004a610000 8664 Microsoft.MicrosoftEdge.Stable 8wekyb3d8bbwe 2023/07/13 13:04:15 696596 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 03e84a6103ff0000 000a000000000000 8664 Microsoft.Windows.Apprep.ChxApp cw5n1h2txyewy neutral 2023/07/13 13:04:15 696626 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 0000000b 0001000e00094a61 000a00004a610000 8664 Microsoft.Windows.Search cw5n1h2txyewy neutral 2023/07/13 13:04:15 696667 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 07e70900000b0000 000a000055f00000 8664 Microsoft.WindowsCamera 8wekyb3d8bbwe 2023/07/13 13:04:15 696672 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 5720057900030000 000a0000585d0000 8664 Microsoft.WindowsStore 8wekyb3d8bbwe 2023/07/13 13:04:15 696676 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000100132b3f0000 000a000062200000 8664 Microsoft.DesktopAppInstaller 8wekyb3d8bbwe 2023/07/13 13:04:15 696680 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000b090000020000 000a000055f0015a 8664 Microsoft.ZuneMusic 8wekyb3d8bbwe 2023/07/13 13:04:15 696684 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000a089a001e0000 000a000045630000 8664 Microsoft.People 8wekyb3d8bbwe 2023/07/13 13:04:15 696689 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 300f057900010000 000a000047ba0000 8664 Microsoft.StorePurchaseApp 8wekyb3d8bbwe 2023/07/13 13:04:15 696764 DEBUG [RegistryInfo.cpp->ParseShimEntries_Win10:1786] Unknown Shim Entry - App Name: 00000009 000a089a001f0000 000a000045630000 8664 Microsoft.People 8wekyb3d8bbwe 2023/07/13 13:04:15 698788 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9289] User Activity Scan: Got Shim Cache 2023/07/13 13:04:15 698797 DEBUG [RegistryInfo.cpp->GetBAMInfo:1950] GetBAMInfo local 2023/07/13 13:04:15 698801 DEBUG [RegistryInfo.cpp->GetBAMInfo:1958] User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\bam\State\UserSettings 2023/07/13 13:04:15 705862 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-2): 1332 2023/07/13 13:04:15 705969 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-3): 1332 2023/07/13 13:04:15 706073 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-4): 1332 2023/07/13 13:04:15 706171 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-5): 1332 2023/07/13 13:04:15 706279 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-6): 1332 2023/07/13 13:04:15 706377 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-7): 1332 2023/07/13 13:04:15 706475 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-8): 1332 2023/07/13 13:04:15 706572 DEBUG [misc.cpp->GetUserFromSID:13501] Error: LookupAccountSid(S-1-5-90-0-9): 1332 2023/07/13 13:04:15 706591 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9292] User Activity Scan: Got BAM 2023/07/13 13:04:15 706595 DEBUG [RegistryInfo.cpp->GetBAMInfo:1950] GetBAMInfo local 2023/07/13 13:04:15 706598 DEBUG [RegistryInfo.cpp->GetBAMInfo:1958] User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\dam\State\UserSettings 2023/07/13 13:04:15 706611 DEBUG [RegistryInfo.cpp->GetBAMInfo:1964] User Activity Scan: GetBAMInfo opening key SYSTEM\CurrentControlSet\Services\dam\UserSettings 2023/07/13 13:04:15 706621 DEBUG [RegistryInfo.cpp->GetBAMInfo:1970] User Activity Scan: GetBAMInfo couldn't open key 2023/07/13 13:04:15 706623 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9295] User Activity Scan: Got DAM 2023/07/13 13:04:15 708185 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:615] DPAPI emulator: using master key 34 : Blob GUID e31136dc-f5b0-4cf7-9c5e-6abd56fc6c8f 2023/07/13 13:04:15 708190 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:649] DPAPI emulator: useHashAlgo 32782 2023/07/13 13:04:15 708194 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:657] DPAPI emulator: DPAPIMasterkey not decrypted 2023/07/13 13:04:15 709079 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:765] DPAPI emulator: sha1 key FDAC2380CE5C61A51DC504E852CA6279C0712BB7 2023/07/13 13:04:15 723204 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:777] DPAPI emulator: pbkdf2hmac 33BD1C51E176227EA5F368F18B34EB5AB8C6CF6578E8AAC21B498100839BFCF5DC7C90C4F07F3D4726CB1F7F144335A3 2023/07/13 13:04:15 723232 DEBUG [DPAPI_Emulator.cpp->DPAPIEmulator::CustomCryptUnprotectData:997] DPAPI emulator: Data blob decryption successful with Masterkey 34: 4143493139313631303031414C00 2023/07/13 13:04:15 723318 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9299] User Activity Scan: Got connected Wireless 2023/07/13 13:04:15 723322 DEBUG [RegistryInfo.cpp->GetAmCacheInfo:6301] User Activity Scan: GetAmCacheInfo Start [local] 2023/07/13 13:04:15 723408 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3133] CreateTempRegFileIfNeeded: A 2023/07/13 13:04:15 723467 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3138] CreateTempRegFileIfNeeded: B 2023/07/13 13:04:15 723470 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3143] CreateTempRegFileIfNeeded: C 2023/07/13 13:04:15 723506 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3152] CreateTempRegFileIfNeeded: DA 2023/07/13 13:04:15 723509 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3160] CreateTempRegFileIfNeeded: DB 2023/07/13 13:04:15 723511 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3165] CreateTempRegFileIfNeeded: DC 2023/07/13 13:04:15 723516 DEBUG [RegViewer.cpp->ShadowCopyFiles:182] ShadowCopyFiles entry 2023/07/13 13:04:15 723607 DEBUG [RegViewer.cpp->ShadowCopyFiles:186] ShadowCopyFiles: Trying to create shadow volume 2023/07/13 13:04:15 723709 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:72] CreateShadowVolumeForFC entry 2023/07/13 13:04:15 723838 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:83] CreateShadowVolumeForFC Initialize VSS client 2023/07/13 13:04:15 726803 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:88] CreateShadowVolumeForFC Get unique vol name for: C:\ 2023/07/13 13:04:15 726984 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:92] unique vol name: \\?\Volume{7ca98c3f-915d-4b9b-af94-0c1461c57887}\ 2023/07/13 13:04:15 726989 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:100] CreateShadowVolumeForFC create snapshot set 2023/07/13 13:04:16 523310 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:109] CreateShadowVolumeForFC getLatestSnapshotIdListt 2023/07/13 13:04:16 523316 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:114] CreateShadowVolumeForFC GetSnapshotDeviceName 2023/07/13 13:04:16 524152 DEBUG [RegViewer.cpp->CreateShadowVolumeForFC:123] CreateShadowVolumeForFC exit 2023/07/13 13:04:16 524158 DEBUG [RegViewer.cpp->ShadowCopyFiles:208] ShadowCopyFiles: created shadow volume 2023/07/13 13:04:16 524162 DEBUG [RegViewer.cpp->ShadowCopyFiles:213] ShadowCopyFiles: 1 files to copy 2023/07/13 13:04:16 524165 DEBUG [RegViewer.cpp->ShadowCopyFiles:220] ShadowCopyFiles: curent file: C:\WINDOWS\appcompat\Programs\AmCache.hve 2023/07/13 13:04:16 524167 DEBUG [RegViewer.cpp->ShadowCopyFiles:225] ShadowCopyFiles: SourceFile: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\WINDOWS\appcompat\Programs\AmCache.hve 2023/07/13 13:04:16 524178 DEBUG [RegViewer.cpp->ShadowCopyFiles:238] ShadowCopyFiles: DestFile: C:\ProgramData\PassMark\OSForensics\Temp\13452\932723935BBEACA7AF94DA0223C32809 2023/07/13 13:04:16 573135 DEBUG [RegViewer.cpp->ShadowCopyFiles:275] ShadowCopyFiles done 2023/07/13 13:04:16 577523 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3177] CreateTempRegFileIfNeeded check temp file access 2023/07/13 13:04:16 577635 DEBUG [CfgStart.cpp->CreateTempRegFileIfNeeded:3223] CreateTempRegFileIfNeeded: finished 2023/07/13 13:04:16 635158 DEBUG [RegistryInfo.cpp->GetAmCacheInfo:6543] User Activity Scan: GetAmCacheInfo Finish [OK] 2023/07/13 13:04:16 635168 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9304] User Activity Scan: Got AmCache 2023/07/13 13:04:16 635173 DEBUG [RegistryInfo.cpp->GetInstalledProgramsSystem:6550] User Activity Scan: GetInstalledPrograms Start [Local] 2023/07/13 13:04:16 651501 DEBUG [RegistryInfo.cpp->GetInstalledProgramsSystem:6757] User Activity Scan: GetInstalledPrograms done 2023/07/13 13:04:16 651512 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9307] User Activity Scan: Got installed programs system 2023/07/13 13:04:16 651514 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser:7112] User Activity Scan: GetInstalledProgramsUser Start [Local] 2023/07/13 13:04:16 651890 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser_Local:6776] User Activity Scan: GetInstalledProgramsUser couldn't open key [Software\Microsoft\Installer\Products] 2023/07/13 13:04:16 651900 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser_Local:6776] User Activity Scan: GetInstalledProgramsUser couldn't open key [Software\Microsoft\Windows\ShellNoRoam\MuiCache] 2023/07/13 13:04:16 653669 DEBUG [RegistryInfo.cpp->GetInstalledProgramsUser:7133] User Activity Scan: GetInstalledProgramsUser Finish [OK] 2023/07/13 13:04:16 653673 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9310] User Activity Scan: Got installed programs user 2023/07/13 13:04:16 653675 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1230] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/13 13:04:16 653679 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1249] User Activity Scan: GetAppCompatFlagsInfo opening key SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers 2023/07/13 13:04:16 653701 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1307] User Activity Scan: GetAppCompatFlagsInfo done 2023/07/13 13:04:16 653704 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9322] User Activity Scan: Got AppCompatFlags system 2023/07/13 13:04:16 653707 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1230] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/13 13:04:16 653710 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1241] User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers 2023/07/13 13:04:16 654077 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1307] User Activity Scan: GetAppCompatFlagsInfo done 2023/07/13 13:04:16 654080 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9317] User Activity Scan: Got AppCompatFlags user 2023/07/13 13:04:16 654082 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1230] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/13 13:04:16 654086 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1241] User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted 2023/07/13 13:04:16 654095 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1255] User Activity Scan: GetAppCompatFlagsInfo couldn't open key 2023/07/13 13:04:16 654097 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9317] User Activity Scan: Got AppCompatFlags user 2023/07/13 13:04:16 654099 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1230] User Activity Scan: GetAppCompatFlagsInfo Start [Local] 2023/07/13 13:04:16 654102 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1241] User Activity Scan: GetAppCompatFlagsInfo opening key Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store 2023/07/13 13:04:16 675645 DEBUG [RegistryInfo.cpp->GetAppCompatFlagsInfo:1307] User Activity Scan: GetAppCompatFlagsInfo done 2023/07/13 13:04:16 675651 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9317] User Activity Scan: Got AppCompatFlags user 2023/07/13 13:04:16 675654 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:574] User Activity Scan: GetAutoRunEntriesSystem Start [Local] 2023/07/13 13:04:16 675683 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:595] User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\Run 2023/07/13 13:04:16 675686 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:647] User Activity Scan: GetAutoRunEntriesSystem scan values local 2023/07/13 13:04:16 675887 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:682] User Activity Scan: GetAutoRunEntriesSystem scan values done 2023/07/13 13:04:16 675928 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:690] User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run 2023/07/13 13:04:16 676006 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:780] User Activity Scan: GetAutoRunEntriesSystem Open Software\Microsoft\Windows\CurrentVersion\RunOnce 2023/07/13 13:04:16 676011 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:829] User Activity Scan: GetAutoRunEntriesSystem scan values local 2023/07/13 13:04:16 676038 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:864] User Activity Scan: GetAutoRunEntriesSystem scan values done 2023/07/13 13:04:16 676042 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesSystem:870] User Activity Scan: GetAutoRunEntriesSystem done 2023/07/13 13:04:16 676049 DEBUG [RegistryInfo.cpp->GetRegistryInfo:9328] User Activity Scan: Got autorun entries system 2023/07/13 13:04:16 676052 DEBUG [RegistryInfo.cpp->GetAutoRunEntriesUser:893] User Activity Scan: GetAutoRunEntriesUser Start [Local]