> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/evidence-of-execution/userassist.md).

# UserAssist

{% embed url="<https://forensafe.com/blogs/UserAssist.html>" %}

{% embed url="<https://imphash.medium.com/userassist-with-a-pinch-of-salt-as-an-evidence-of-execution-4dc4e9640a77>" %}

### Forensic Value:

* Last Run Time (UTC)
* Run Count
* Application Name
* Focus Time: Total time an application window was active, expressed in miliseconds.
* Focus Count: Total number of times a window was the active window in the GUI.

### File Location:

* NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

<figure><img src="/files/p14gwuLVWCHw97FcLtqw" alt=""><figcaption></figcaption></figure>

### Parsing Data

Use Registry Explorer for nice output. For scalable analysis RECmd is best.

<figure><img src="/files/KwXdBXnPyUXm0rUIg5Nx" alt=""><figcaption></figcaption></figure>

### Facts

* CEB GUID tracks application execution.

  * Directly clicking .exe
  * Shell extensions
  * The start menu
  * Double clicking document leading to a viewer (wordpad).

* F4E GUID tracks LNK file execution.

* ROT 13 encoded&#x20;

<figure><img src="/files/pniiT6uMnJguBOxMea7S" alt=""><figcaption></figcaption></figure>

### Considerations

* Bogus start times usually relate to automatic execution of programs under the current user context. Does not mean user explicitly started the program.
* Pathnames can be obscured with KNOWNFOLDERID name.

<figure><img src="/files/2UpPiwk3ocIEjHFcZHHB" alt=""><figcaption></figcaption></figure>

* Entries can be added during installation.
* Entries can be added by clicking "Open File Location"
* Missing run counts and last run time for programs automatically started by Windows.

<figure><img src="/files/mm3VLPPv6LI4KY2WQvzI" alt=""><figcaption></figcaption></figure>

### Anti-Forensics

* Deletion