UserAssist Forensics 2025

Cyber Triage guide to the UserAssist registry artifact.

UserAssist logs GUI program launches with run counts and last execution time, ROT13 encoded in the registry. The post covers locations, decoding and interpretation.

Why it's useful

Quick evidence of which apps a user actually launched.

Category: DFIR
Pricing: Free
Tags: dfir, windows, registry, artifacts
Link: www.cybertriage.com