Have you looked at the UserAssist, MUICache, and other artifacts for the user that might indicate program execution? That might provide indications of the application used...
↧