Skip main navigation

Other Program Execution Artefacts

Article detailing the basics 'UserAssist' Windows registry keys and values.
© PA Knowledge Ltd | 7Safe Training

Other program execution aretfacts of interest

There are several locations on a computer with Windows 10 installed that contain aretafcts indicating a previous process execution. An example of of one of these locations is detailed below:

UserAssit

This aretfact is a registry key that relates to the execution of GUI programs launched via the Desktop. The key location is:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\<GUID>\Count

An example of this registry key is detailed below:

Example of 'UserAssit' registry sub-keys and values.

Note the 2 Count GUIDs highlighted above. These GUIDs relate to:

  • CEBFF5CD Executable File Executed
  • F4E57C4B Shortcut File Executed

It can be seen that the content of the keys do not appear to make any sense. This is because the characters are ROT13 encoded. This encoding is a simple caesar substitution cipher. Let’s use Cyber Chef to decode the first highlighted entry ‘abgrcnq.rkr’:

Screenshot of CyberChef decoding ROT13 encoded file name.

It can be seen that that each character will be rotated 13 times (to the left). The file ‘abgrcnq.rkr’ is then decoded to ‘notepad.exe’.

How cool is Cyber Chef?

Additional information…

Remember any data that is encoded can still be processed by a computer providing the encoding scheme is known. Encrypted data however, cannot be processed without a key.

The following are examples of publicly available encoding schemes in use today:

• HTML Encoding

• URL Encoding

• Unicode Encoding

• Base64 Encoding

• Hex Encoding

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education