Tracking Program Execution with a Little Known Registry Key
MentionsMicrosoftMicrosoft Windows
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
In this episode, we’ll take a look at another obscure, registry-based execution artifact that may help you fill in yet another piece of the puzzle. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:33 - About Registry Hives 02:10 - Demo 🛠 Resources FeatureUsage — Evidence of Execution: https://upadhyayraj.medium.com/featureusage-evidence-of-execution-appswitched-8df98ac0ddc2 The Windows Forensic Journey — “AppSwitched”: https://medium.com/@boutnaru/the-windows-forensic-journey-appswitched-55abc690f0f0…
Description from 13Cubed.