drop ntuser.dat or paste userassist registry values · decode rot13 · execution counts · timestamps · program history · runs locally
hive file
drop NTUSER.DAT / hive
or click
registry export paste
status
drop ntuser.dat (hive) or paste regedit export containing UserAssist\\…\\Count