Execution
UserAssist
UserAssist cheat sheet: NTUSER.DAT GUID keys, ROT13 value names, run count, focus time and last run FILETIME for programs a user launched from Explorer.
- Location
- NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
- Proves
- A user launched a program or shortcut through Explorer, how often and when last
- Timestamps
- Last run time per entry and Count key LastWrite as FILETIME, UTC; value names are ROT13-encoded
- Retention
- No small fixed limit, accumulates for the life of the profile; stops if Start_TrackProgs = 0; cleaners delete the Count keys
- Access
- Per-user NTUSER.DAT, locked while the user is logged on: collect via raw NTFS (KAPE) or VSS; reg export for the current user
- Evidence of
- ExecutionUser activity
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesUser
- Velociraptor
- Windows.Triage.Targets:RegistryHivesUser
Tools
Compare all toolsWhat it is
UserAssist is a per-user registry record that Explorer keeps of the programs and shortcuts a user launches from the graphical shell (Start menu, desktop, taskbar, double-click in Explorer). Windows uses it to build "most used" lists. For investigators it is user-attributed evidence of execution, with a run count and a last-run time, stored in the user's NTUSER.DAT.
Location
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
| Windows version | GUID | Tracks |
|---|---|---|
| 7 / 8 / 10 / 11 | {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} | Executable files launched |
| 7 / 8 / 10 / 11 | {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} | Shortcut (.lnk) files launched |
| XP / Vista | {75048700-EF1F-11D0-9888-006097DEACF9} | Programs and shortcuts launched |
| XP / Vista | {5E6AB780-7743-11CF-A12B-00AA004AE837} | Internet Explorer toolbar items |
Value names are ROT13-encoded. On Windows 7 and later, well-known folders inside the name are replaced by known-folder GUIDs, for example {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7} for System32 and {6D809377-6AF0-444B-8957-A3773F02200E} for Program Files on 64-bit systems.
What it proves
- The user whose NTUSER.DAT holds the key launched the program or shortcut through the Explorer shell.
- How many times, and when it was last launched; on Windows 7 and later also how long the window had focus.
- It does not capture programs started from a command prompt, a script, a service or a scheduled task: absence in UserAssist does not mean the program never ran.
Key fields
Windows 7 and later (72-byte value data):
| Field | Meaning |
|---|---|
| Value name (ROT13) | Executable path, shortcut path or AppUserModelID |
| Run count (offset 4) | Number of launches |
| Focus count (offset 8) | Number of times the window received focus |
| Focus time (offset 12) | Total focus duration in milliseconds |
| Last run (offset 60) | Last launch time, FILETIME |
Windows XP (16-byte value data): session ID, run count (which starts at 5, so subtract 5), last run FILETIME at offset 8.
Special values such as UEME_CTLSESSION and UEME_CTLCUACount:ctor are bookkeeping entries, not programs.
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Last run time (value data) | The user launches the item via Explorer | FILETIME, UTC | Some entries have a run count but a zero last-run time; focus-only updates do not change it |
Count key LastWrite | Any UserAssist value updated | FILETIME, UTC | Points to the most recent update across all entries |
Retention and clearing
- There is no small fixed limit; entries accumulate for the life of the profile.
- Tracking stops when the user turns off "Let Windows track app launches" (value
Start_TrackProgs= 0 under...\Explorer\Advanced), and privacy cleaners commonly delete theCountkeys. - Deleted values may remain recoverable from unallocated space in the hive and from shadow-copy NTUSER.DAT files.
Collection
- KAPE target:
RegistryHivesUser(NTUSER.DAT and UsrClass.dat with logs) - Velociraptor (
Windows.Triage.Targets):RegistryHivesUser;Windows.Registry.UserAssistdecodes it live. - Built-in (current user only; the hive of a logged-on user is locked):
reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" E:\case\userassist.reg
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): decodes ROT13, known-folder GUIDs, counts and times.
- RegRipper:
userassistplugin. - UserAssistView (NirSoft): quick decoder for the live system.
- Velociraptor:
Windows.Registry.UserAssist.
Investigation tips
- Look for administration and exfiltration tools launched by double-click (
rclone.exe,WinSCP.exe,mstsc.exe, archivers) and for shortcuts to scripts. - A high focus time shows the user actually worked in the application, not just opened it.
- Combine with BAM/DAM and Prefetch for execution times, and with Jump Lists for the files opened in the same program.
mstsc.exein UserAssist plus the Terminal Server Client keys (RDP connections) shows outgoing RDP by that user.- Always decode on a copy that includes transaction logs; recent launches may only be in
.LOG1/.LOG2.
Related artifacts
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- LNK shortcut filesLNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
- Jump ListsJump Lists cheat sheet: AutomaticDestinations and CustomDestinations, AppIDs, DestList entries with last access, access count and pin status, and JLECmd.
- RunMRURunMRU cheat sheet: commands typed in the Windows Run dialog (Win+R) in NTUSER.DAT, MRUList order, the LastWrite time and LOLBin or UNC patterns to hunt.
Glossary terms
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.
- NTUSER.DATThe per-user registry hive stored in each Windows profile and loaded as HKEY_CURRENT_USER, rich in user activity and persistence traces.
- FILETIMEThe 64-bit Windows timestamp format counting 100-nanosecond intervals since 1 January 1601 UTC, used by NTFS, the registry and many artifacts.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.