UAParser

What is UserAssist Artifacts ?

This is the artifacts which is inside the NTUSER.DAT file [ HKCU Registry ]. It will contain the information about what programs are executed inside the system.

Where UserAssist is located ?

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

Infomration provided by Artifact:

This can provide which program is executed on system.
Provide the detail if the program is executed via lnk or the executable.
Provide the number of times the program is executed.
Provide the the last Modification Time
Also provide the details like focus seconds of the executed program, path of the exectubale or lnk.