volatility3/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json

{
    "WINDOWS10_GENERIC": {
        "Count": null,
        "Focus Count": null,
        "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
        "Hive Offset": 213323048636416,
        "ID": null,
        "Last Updated": null,
        "Last Write Time": "2025-03-06T17:57:09+00:00",
        "Name": null,
        "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
        "Raw Data": "",
        "Time Focused": null,
        "Type": "Key",
        "__children": [
            {
                "Count": 7,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-05T18:34:13+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 90 86 6b 31 ..............k1\nfd 8d db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.507000",
                "Type": "Value",
                "__children": []
            },
            {
                "Count": 1,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-06T12:46:34+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Registry Editor.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff f0 82 cf ca ................\n95 8e db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.501000",
                "Type": "Value",
                "__children": []
            },
            {
                "Count": 4,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-06T17:36:33+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 10 67 cf 4d .............g.M\nbe 8e db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.504000",
                "Type": "Value",
                "__children": []
            },
            {
                "Count": 1,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-06T17:51:44+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff d0 99 66 6c ..............fl\nc0 8e db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.501000",
                "Type": "Value",
                "__children": []
            },
            {
                "Count": 1,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-06T17:52:33+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 00 62 ba 89 .............b..\nc0 8e db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.501000",
                "Type": "Value",
                "__children": []
            },
            {
                "Count": 2,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-06T17:56:50+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff b0 24 49 23 .............$I#\nc1 8e db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.502000",
                "Type": "Value",
                "__children": []
            },
            {
                "Count": 1,
                "Focus Count": 0,
                "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
                "Hive Offset": 213323048636416,
                "ID": null,
                "Last Updated": "2025-03-06T17:57:09+00:00",
                "Last Write Time": "2025-03-06T17:57:09+00:00",
                "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk",
                "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
                "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 60 3d 89 2e ............`=..\nc1 8e db 01 00 00 00 00                         ........        \"",
                "Time Focused": "0:00:00.501000",
                "Type": "Value",
                "__children": []
            }
        ]
    }
}