Windows registry artifactAdd/Remove Programs Entries
Displays installed software
- Installed Software
- 3 keys
SOFTWARENTUSER
Registry keys
3 keys that RECmd reads for this artifact
SOFTWAREMicrosoft\Windows\CurrentVersion\UninstallDisplays installed software
SOFTWAREWOW6432Node\Microsoft\Windows\CurrentVersion\UninstallDisplays installed software
NTUSERSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallDisplays installed software
References
4 links
- github.comUninstall plugin(opens in new tab)
- community.idera.com/database-tools/powershell/powertips/b/tips/posts/find-installed-software(opens in new tab)
- advancedinstaller.com/user-guide/registry-wow6432-node.html(opens in new tab)
- docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)