Edit current collections for amcache and usrclass

[JorahTheExplorer]

Hello, can we add the AMCache transaction logs to the windows.yaml file?

paths: ['%%environ_systemroot%%\AppCompat\Programs\Amcache.hve.LOG1']
paths: ['%%environ_systemroot%%\AppCompat\Programs\Amcache.hve.LOG2']

Also, current Usrclass.dat (and transaction logs) only collects the current user's usrclass and not the other user account's data. I'd propose a change to the path more in line with how NTuser.dat is collected, like the following:

- '%%users.userprofile%%\AppData\Local\Microsoft\Windows\UsrClass.dat'

Thank you for putting this together, it's extremely helpful

[joachimmetz]

Hello, can we add the AMCache transaction logs to the windows.yaml file?

Yes just propose changes in a PR.

Also, current Usrclass.dat (and transaction logs) only collects the current user's usrclass and not the other user account's data.

This is a limitation in your tool not in the definition.

[JorahTheExplorer]

Thank you, I'll check my code.

[JorahTheExplorer]

Thanks again!