mru.run
#
$ target-query <path/to/target> -f mru.run
Module |
|
Output |
|
Module documentation
Return MRU data stored at various registry keys.
The Windows registry contains various keys about Most Recently Used (MRU) files.
- References:
Function documentation
Return the RunMRU data.
The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
registry key contains information
about the most recent commands that have been performed by the Run application