-
Notifications
You must be signed in to change notification settings - Fork 0
UserAssist
BenWare-FED edited this page Apr 9, 2025
·
1 revision
User specific
Proves an application was ran
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Data is scrambled with Ceaser ROT 13
Important subfolders
CEBFF5CD-ACE2-4F4F-9187-9926F41749EA: The folder for executables the user double clicked
F4E57C4B-2036-45F0-A9AB-443CFE33D9F: The folder for executables the user accessed through a lnk file