Search notes:

Registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

The values under this registry key show which commands a user entered into the run box (Win+R).

Index