Background Activity Moderator (BAM) Python Parser
I read this today - https://www.linkedin.com/pulse/alternative-prefetch-bam-costas-katsavounidis/ and decided to write a parser.
It needs more testing. Let me know if you find errors.
python .\bamparser.py -sys C:\Users\prols\Desktop\RegistryHives\SYSTEM
2018-09-05 16:58:19 S-1-5-18 \Device\HarddiskVolume3\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe
2018-09-08 11:31:09 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\explorer.exe
2018-09-08 11:31:09 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\ApplicationFrameHost.exe
2018-09-08 11:31:33 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe
2018-09-07 23:59:17 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\DataExchangeHost.exe
2018-09-05 16:58:25 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\msiexec.exe
2018-09-06 17:45:04 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\OpenWith.exe
2018-09-01 14:21:35 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\SystemSettingsAdminFlows.exe
2018-09-08 11:31:24 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Program Files\WiTopia\WiTopia.exe
2018-09-04 20:37:05 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Program Files\Microsoft VS Code\Code.exe
2018-09-06 17:28:36 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\PickerHost.exe
2018-09-08 00:01:13 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\notepad.exe
2018-09-04 20:37:09 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\splwow64.exe
2018-09-04 19:04:28 S-1-5-21-2973747279-3272892531-3836209949-1001 \Device\HarddiskVolume3\Windows\System32\Taskmgr.exe