DFIRHub

Windows registry artifactLogMeIn

LogMeIn GoToMeeting

  • Third Party Applications
  • 3 keys
  • NTUSERSYSTEM

Registry keys

3 keys that RECmd reads for this artifact

  • NTUSERrecursive
    Software\LogMeIn

    LogMeIn GoToMeeting

  • SYSTEMrecursive
    CurrentControlSet\Services\LogMeIn

    Displays artifacts relating to LogMeIn

  • SYSTEMrecursive
    ControlSet00*\Services\LogMeIn

    Displays artifacts relating to LogMeIn

References

3 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)