UserAssist keys are method that Microsoft uses to populate a user’s start menu with frequently used applications. They exist on Windows XP, Vista, and 7 and maintain counts of application usage. These values are located in each user’s NTUSER.DAT hive at SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist and are ROT-13 encoded.


  • Extracts SID, User Names, Indexes, Application Names, Run Counts, Session, and Last Run Time Attributes
  • Saves to CSV for additional analysis
  • Requirements: Microsoft .NET Framework v4.0
  • Free for both personal and commercial use

Permanent link to this article: