User Assist Forensics 2: Cal Poly FAST CTF Challenge 19

Question: When was the last date ProcMon.exe was run? FORMAT: YYYY-MM-DD
Points: 200
Download File from: https://github.com/mfput/CTF-Questions/raw/master/NTUSER.DAT
Hint: None
Answer: 2017-04-18
Note: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssit\GUID\Count

Like my work? Donate here: https://buymeacoffee.com/forensicnoobsecurity