UserAssist keys are method that Microsoft uses to populate a user’s start menu with frequently used applications. They exist on Windows XP, Vista, and 7 and maintain counts of application usage. These values are located in each user’s NTUSER.DAT hive at SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist and are ROT-13 encoded.
Features
- Extracts SID, User Names, Indexes, Application Names, Run Counts, Session, and Last Run Time Attributes
- Saves to CSV for additional analysis
- Requirements: Microsoft .NET Framework v4.0
- Free for both personal and commercial use
