User Assist

Created: 01.06.2023

GUI-based programs launched from the desktop are tracked in the launcher on a Windows system.

Key πŸ”‘: NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count.

❗️All values are ROT13 encoded.

List of progs and applets that can be quicly started from the Start menu for usability, the most often used items. Shows a focus count for each entry. It means, how many time was the window switched to (that doesn’t include the time when the program is first run). Shows the last time that the program was executed, focus time, run count.

At the start of each entry between {} is the code for a location within file system. Registry Explorer will substitute these automatically, since these GUIDs are predefined.

This what a full filled User Assist key looks like. {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} is for programs that were lauched using their image files directly. {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} is for those, started with a shortcut.


The structure is quite simple:

  • At 0x04 offset starts the number of executions (4 bytes).
  • At 0xC offset starts the focus time (4 bytes)
  • At 0x3C offset starts the Last Execution time (8 bytes), which is a Win64-bit little-endian value (for Decode πŸ› ).

⚠️ πŸ”Ž I could not find this key on my Win10 VM.

⚠️ When the program was started via lnk file, the focus count will be 0.

GUIDs to note:


  1. 75048700 Active Desktop GUID for Win7-10
  2. CEBFF5CD Executable File Execution
  3. F4E57C4B Shortcut File Execution

Program Locations for Win7- 10 UserAssist

  1. ProgramFilesX64 6D809377-…
  2. ProgramFilesX86 7C5A40EF- . . .
  3. System 1AC14E77-…
  4. SystemX86 D65231BO-…
  5. Desktop B4BFCC3A-…
  6. Documents FDD39ADO-…
  7. Downloads 374DE290-…
  8. UserProfiles 0762D272-…


Expand… Something here