> For the complete documentation index, see [llms.txt](https://manuals.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query.md).

# Registry Query

- [Query Information from the Registry on Recentdocs, Recentapps](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-information-from-the-registry-on-recentdocs-recentapps.md): AID2112301441.YAML
- [Query Registry for a list of mounted USB storage devices, including external memory cards](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-registry-for-a-list-of-mounted-usb-storage-devices-including-external-memory-cards.md): AID2112302000.YAML
- [Query the Most Recently Used items from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-most-recently-used-items-from-the-registry.md): AID2112302008.YAML
- [Query the Most Recently Open and Saved File information from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-most-recently-open-and-saved-file-information-from-the-registry.md): AID2112302009.YAML
- [Query all Run, RunOnce, and RunOnceEx Registry Keys](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-all-run-runonce-and-runonceex-registry-keys.md): AID2112302012.YAML
- [Query Command list from the MRU Registry List](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-command-list-from-the-mru-registry-list.md): AID2112302013.YAML
- [Query Startup Services from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-startup-services-from-the-registry.md): AID2112302014.YAML
- [Query Map Network Drives from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-map-network-drives-from-the-registry.md): AID2112302017.YAML
- [Query Shell Folders and User Shell Folders from both the HKLM and HKU Registry Information](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-shell-folders-and-user-shell-folders-from-both-the-hklm-and-hku-registry-information.md)
- [Query Typed Urls from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-typed-urls-from-the-registry.md): AID2112302023.YAML
- [Query Current Control Set Services information from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-current-control-set-services-information-from-the-registry.md): AID2112302027.YAML
- [Query Accessibility Features from Image File Execution Options from the Registry](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-accessibility-features-from-image-file-execution-options-from-the-registry.md): AID2112302043.YAML
- [Query the Registry for Commands that are automatically executed each time cmd.exe is run](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-commands-that-are-automatically-executed-each-time-cmd.exe-is-run.md): AID2112302048.YAML
- [Query the Registry for Mounted Device information](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-mounted-device-information.md): AID2112302049.YAML
- [Query the Registry for Browser Helper Objects (BHO)](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-browser-helper-objects-bho.md): AID2112302103.YAML
- [Query the Registry for Explore Run commands](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-explore-run-commands.md): AID2112302128.YAML
- [Query the Registry for Winlogon Helper Dll's](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-winlogon-helper-dlls.md): AID2112302152.YAML
- [Query the Registry for Active Setup information](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-active-setup-information.md): AID2201032000.YAML
- [Query the Registry for Bypassing UAC Mechanisms from the User-Accessible information](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-bypassing-uac-mechanisms-from-the-user-accessible-information.md): AID2201032010.YAML
- [Query the Registry for User-Logon, and Startup Scripts](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-user-logon-and-startup-scripts.md): AID2201032020.YAML
- [Query the Registry for the most common MRU information for All User Hives, including offline users](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-the-most-common-mru-information-for-all-user-hives-including-offline-users.md): AID2201202337.YAML
- [Query the Registry for any user, using the SysInternals Tools](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-any-user-using-the-sysinternals-tools.md)