Tracks the executable and directory location that an application uses to open files that are documented in the OpenSaveMRU key.
"The MRU in MRU lists stands for "Most Recently Used." The MRU list is a Windows-based application that includes registry of recently opened webpages, documents, files, images and other applications. For example, when a computer user opens Microsoft Word, she may see a list of previously opened Word documents within the application. That would be an MRU List. The lists serve no other purpose than to track application use and do not perform any basic function on their own." - https://itstillworks.com/mru-list-12213731.html
"The MRU in MRU lists stands for "Most Recently Used." The MRU list is a Windows-based application that includes registry of recently opened webpages, documents, files, images and other applications. For example, when a computer user opens Microsoft Word, she may see a list of previously opened Word documents within the application. That would be an MRU List. The lists serve no other purpose than to track application use and do not perform any basic function on their own." - https://itstillworks.com/mru-list-12213731.html
SANS Forensic Artifact 7: Last Visited MRU
http://sploited.blogspot.com/2013/01/sans-forensic-artifact-7-last-visited.html
OpenSaveMRU and LastVisitedMRU
https://digital-forensics.sans.org/blog/2010/04/02/openrunsavemru-lastvisitedmru/
Registry Analysis (Windows Forensic Analysis) Part 8
http://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-8/
Windows registry in forensic analysis
https://www.andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/
http://sploited.blogspot.com/2013/01/sans-forensic-artifact-7-last-visited.html
OpenSaveMRU and LastVisitedMRU
https://digital-forensics.sans.org/blog/2010/04/02/openrunsavemru-lastvisitedmru/
Registry Analysis (Windows Forensic Analysis) Part 8
http://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-8/
Windows registry in forensic analysis
https://www.andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/
