drop ntuser.dat reg export · detect cleared userassist entries · identify gaps in user program execution history · surface clearing events and suspicious absences · runs locally
artifacts
drop ntuser .reg / userassist csv · optional execution artifact csv
or click
UserAssist Count · ROT13 decode · timeline gaps · prefetch / shimcache / 4688 cross-reference
drop ntuser.dat reg export · optional prefetch / shimcache / 4688 csv for cross-ref