Windows registry artifactWordWheelQuery
User Searches
- User Activity
- 2 keys
NTUSERUser
Registry keys
2 keys that RECmd reads for this artifact
NTUSERrecursiveSoftware\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQueryUser Searches
UserrecursiveSoftware\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQueryUser Searches - Windows Store UWP
References
3 links
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)