I would suggest the following implementation.
If the program is initially started create an encrypted and authenticated file containing either a timestamp or counter to have a starting value.
It is important not to use the basic user displayed and changeable time/clock, because otherwise your customer could just set the system time into the past.
When you run the program start a timer or increment the counter to measure the usage and update the encrypted an authenticated file periodically.
The location where the file is stored is unimportant, but you need to use the following things to accomplish reasonable security:
Use existing cryptographic functions, which are well tested and provide both encryption and authentication. To put it simple, encryption protects you from somebody trying to figure out the content, authentication from manipulation
Generate a random key for the encryption, no hard coding. Everything that is hard coded can be found through reverse engineering with more or less effort. Also reusing keys is always a bad idea
Store the key some place save where it can be automatically accessed by your program. This is the tricky part, as you have to trust the OS to properly handle it, as things need to be working without you entering things manually. My suggestion would be using DPAPI (assuming you develop for C# .NET on Windows).
You can easily store your key, and could as well be changing your key once in a while without big hassle.
So if the user either deletes, exchanges the file with an old version or manipulates the file, you are able to recognize it.
I hope this give some ideas how you could do it.
I was not correct regarding the replay attack, if the user is able to access both files then indeed he would be able to replace both with old versions.
My suggestion regarding your comment would be the following:
Have a file that contains a timestamp, the counter for usage, shutdown flag.
You will need a windows service running on start-up. Set a registry entry on the very first start-up.
The service checks for if the file is existent and if it is the very first time the service runs. If there is registry entry says that it runs for the first time, create the file containing the current timestamp (non-dependend on system clock, if possible), the counter for usage should be zero and shutdown flag false. The file is encrypted and the key encrypted through the DPAPI (use a fixed additional entropy). The registry entry is updated as from now on, all consecutive writes will be updates.
Now the service needs to update the file in a fixed interval, e.g. every 10 minutes. This means unprotecting the key with DPAPI and decrypting the file. Here is where we protect against replay attacks. The timestamp in the file is check and may not deviate more than e.g. 30 minutes (should be more than the update interval in case of failed update). If it does deviate more, manipulation is suspected (or heavy error from the application or hardware or OS). Otherwise, if everything is fine, the timestamp gets updated to the current time. If your service/program was used in the meantime, the usage counter gets updated as well. Generate a new key, encrypt the file and store the key after protecting it with the DPAPI.
When the user shutsdown the computer and starts it later on, you would have the problem, that the timestamp exceeds the allowed limit. That is why the file should contain the shutdown flag. This flag should be set when the user shutsdown the computers. When the service is stopped, it's final action is to update the file, with the shutdown flag set to true.
On a start-up the file is read and if the shutdown flag is true, set it to false and update the timestamp again.
This is how I would do it. It isn't bullet proof but more than enough to protect against fraudulent customers. I wouldn't even go that far and simply use the DPAPI and file combination and store the output of DPAPI in the registry. No normal person is his right mind would spend his time searching the entire registry. After all they are your customers not prisoners. With physical access to the computer there is no way to absolutely secure it.
The Isolated Storage is not very useful either, I just have read about it the first time. The user and also other programs with administrator/system privileges will be able to read these files.