Securelist Follow Forensic journey: Breaking down the UserAssist artifact structure A Kaspersky GERT expert describes the UserAssist Windows artifact, including previously undocumented binary data structure, and shares a useful parsing tool. https://securelist.com/userassist-artifact-forensic-value-for-incident-response/116911/ securelist.com
