The ProcMon log was indeed retrieved the normal way. But it did not contain useful data. That's what I meant. Maybe it didn't because some of the mentioned programs affected it somehow.
