UAParser

What is UserAssist Artifacts ?

This is the artifacts which is inside the NTUSER.DAT file [ HKCU Registry ]. It will contain the information about what programs are executed inside the system.

Where UserAssist is located ?

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

Infomration provided by Artifact:

• This can provide which program is executed on system.
• Provide the detail if the program is executed via lnk or the executable.
• Provide the number of times the program is executed.
• Provide the the last Modification Time
• Also provide the details like focus seconds of the executed program, path of the exectubale or lnk.

Usage

python3 main.py -f <Exported HKCU>

Result

References

Program Execution Analysis using UserAssist Key in Modern Window

Windows 7 UserAssist Registry Keys Analysis

Windows userassist keys