Decode ROT13 obfuscated executable paths and extract critical evidence of execution from Windows Registry UserAssist keys. Parses 72-byte binary structures to recover execution counts, user focus duration, and exact 64-bit FILETIME last execution timestamps.
hex:, and raw byte dumps.
0 characters
| # | Program / Executable Path | Run Count | Focus Count | Focus Duration | Last Executed (UTC) | Local System Time | Classification |
|---|
In Windows endpoint forensics, establishing proof of program execution is essential for reconstructing an attacker's lateral movement, credential access, or data exfiltration activities. The UserAssist registry keys provide investigators with conclusive evidence that a specific executable or shortcut was launched by an interactive user.
UserAssist records reside in each user's personal registry hive: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. The two common sub-GUIDs are {CEBFF5CD-ACE2-4F4B-9178-9926F47FB9BA} (for applications and executables) and {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} (for shortcut files).
Windows obfuscates the value names of the UserAssist Count key with standard ROT-13 substitution. For example, pzq.rkr translates to cmd.exe, and cbjrefuryy.rkr translates to powershell.exe.
Bytes 4–7 hold the Run Count, Bytes 8–11 hold the Focus Count, Bytes 12–15 hold Focus Time in milliseconds, and Bytes 60–67 store the exact Last Execution Time as a 64-bit Windows FILETIME.
Windows replaces system directories with KnownFolder GUIDs inside UserAssist: {1AC14E77-...} resolves to C:\Windows\System32, and {D65231B0-...} resolves to System32\WindowsPowerShell\v1.0.
Adversaries may attempt to delete the Count subkey or set a DWORD named NoLog = 1 in the UserAssist root to disable tracking. In such cases, examiners correlate with Prefetch, Amcache, and Shimcache.
| Byte Offset | Data Type | Field Name | Forensic Significance |
|---|---|---|---|
0x00 - 0x03 |
DWORD (4 Bytes) | Session ID | Tracks the GUI logon session identifier. |
0x04 - 0x07 |
DWORD (4 Bytes) | Run Count | Total number of times the program was executed by the user. |
0x08 - 0x0B |
DWORD (4 Bytes) | Focus Count | Number of times the user switched focus to the window. |
0x0C - 0x0F |
DWORD (4 Bytes) | Focus Duration | Total time (in milliseconds) the program had active user focus. |
0x3C - 0x43 |
FILETIME (8 Bytes) | Last Execution Timestamp | 64-bit UTC timestamp recording the exact last launch time. |
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. The two common sub-GUIDs are {CEBFF5CD-ACE2-4F4B-9178-9926F47FB9BA} (for applications and executables) and {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} (for shortcut files).