Implement UserAssist

Implement UserAssist for use with modern Start Menu.

References:

• https://www.scitepress.org/Papers/2017/64167/64167.pdf – Program Execution Analysis using UserAssist Key in Modern Windows

UserAssist keeps track of programs executed, running count, and last execution date/time in registry. UserAssist registry keys are saved in following locations:

HKEY_USERS\{SID}\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

Typical GUID's used in NT 5.x:

{75048700-EF1F-11D0-9888-006097DEACF9}

{5E6AB780-7743-11CF-A12B-00AA004AE837}

By default this logging is enabled and ROT-13 encrypted, although both options can be manually disabled via registry keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\Settings