UserAssist - BenWare-FED/FOR230 GitHub Wiki

User specific

Proves an application was ran

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Data is scrambled with Ceaser ROT 13

Important subfolders

CEBFF5CD-ACE2-4F4F-9187-9926F41749EA: The folder for executables the user double clicked

F4E57C4B-2036-45F0-A9AB-443CFE33D9F: The folder for executables the user accessed through a lnk file