Recent Apps

Description: GUI Program execution launched on the Win10 system is tracked in the RecentApps key.

Location:

• C:\Users\<username>\NTUSER.DAT
  • NTUSER.DAT\Software\Microsoft\Windows\Current Version\Search\RecentApps

Notes: Each GUID key points to a recent application:

• AppID == Name of Application
• LastAccessTime == Last execution time in UTC
• LaunchCount == Number of times executed

Analysis:
Coming Soon!