Windows registry artifactWindows App List
Displays all Windows applications installed on this system
- Installed Software
- 1 key
UsrClass
Registry keys
1 key that RECmd reads for this artifact
UsrClassLocal Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\RepositoryDisplays all Windows applications installed on this system
References
3 links
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)