Find Quick Assist tell tales in event log

[string]$QA = (Join-Path ([Environment]::GetFolderPath( [System.Environment+SpecialFolder]::System )) -ChildPath 'quickassist.exe') ; Get-WinEvent -FilterHashtable @{ ProviderName = 'Microsoft-Windows-Crypto-NCrypt' ; Id = 9 }|Where-Object { $_.Properties[5].value -eq $QA }