Implement UserAssist for use with modern Start Menu.
- https://www.scitepress.org/Papers/2017/64167/64167.pdf – Program Execution Analysis using UserAssist Key in Modern Windows
UserAssist keeps track of programs executed, running count, and last execution date/time in registry. UserAssist registry keys are saved in following locations:
Typical GUID's used in NT 5.x:
By default this logging is enabled and ROT-13 encrypted, although both options can be manually disabled via registry keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\Settings