Forensic journey: Breaking down the UserAssist artifact structure

A Kaspersky GERT expert describes the UserAssist Windows artifact, including previously undocumented binary data structure, and shares a useful parsing tool.