userassist vs prefetch execution gap detector — free browser tool | fatcousin

drop userassist csv and prefetch csv · identify executables in one artifact but absent from the other · detect selective artifact clearing targeting specific applications · surface what a user ran that was then hidden · runs locally

userassist csv

drop userassist csv

or click

Select file

prefetch csv

drop prefetch csv

or click

Select file

Registry Explorer / RECmd UserAssist decode · PECmd prefetch export · matched by executable basename

drop UserAssist csv + prefetch csv (PECmd)

ready