WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-20 13:42:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
bugfix/missing_modules
volatility3/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json
T
David McDonald 0b1bbb87ee Windows Tests: Update userassist JSON output 
The new layer data type renders the output a little differently, and the
plugin also seems to render 'N/A' for a missing value where previously
it was an empty string.
2025-04-02 09:36:07 -05:00

124 lines
7.4 KiB
JSON
Raw Permalink Blame History

{
"WINDOWS10_GENERIC": {
"Count": null,
"Focus Count": null,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": null,
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": null,
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "N/A",
"Time Focused": null,
"Type": "Key",
"__children": [
{
"Count": 7,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-05T18:34:13+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 90 86 6b 31 fd 8d db 01 00 00 00 00",
"Time Focused": "0:00:00.507000",
"Type": "Value",
"__children": []
},
{
"Count": 1,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-06T12:46:34+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Registry Editor.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff f0 82 cf ca 95 8e db 01 00 00 00 00",
"Time Focused": "0:00:00.501000",
"Type": "Value",
"__children": []
},
{
"Count": 4,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-06T17:36:33+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 10 67 cf 4d be 8e db 01 00 00 00 00",
"Time Focused": "0:00:00.504000",
"Type": "Value",
"__children": []
},
{
"Count": 1,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-06T17:51:44+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff d0 99 66 6c c0 8e db 01 00 00 00 00",
"Time Focused": "0:00:00.501000",
"Type": "Value",
"__children": []
},
{
"Count": 1,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-06T17:52:33+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 00 62 ba 89 c0 8e db 01 00 00 00 00",
"Time Focused": "0:00:00.501000",
"Type": "Value",
"__children": []
},
{
"Count": 2,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-06T17:56:50+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff b0 24 49 23 c1 8e db 01 00 00 00 00",
"Time Focused": "0:00:00.502000",
"Type": "Value",
"__children": []
},
{
"Count": 1,
"Focus Count": 0,
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
"Hive Offset": 213323048636416,
"ID": null,
"Last Updated": "2025-03-06T17:57:09+00:00",
"Last Write Time": "2025-03-06T17:57:09+00:00",
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk",
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
"Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 60 3d 89 2e c1 8e db 01 00 00 00 00",
"Time Focused": "0:00:00.501000",
"Type": "Value",
"__children": []
}
]
}
}
Reference in New Issue View Git Blame Copy Permalink