DFIRHub

Windows registry artifactRemoteUtilities

Displays artifacts relating to RemoteUtilities

  • Third Party Applications
  • 7 keys
  • SYSTEMNTUSER

Registry keys

7 keys that RECmd reads for this artifact

  • SYSTEMrecursive
    CurrentControlSet\Services\RManService

    Displays artifacts relating to RemoteUtilities

  • SYSTEMrecursive
    ControlSet00*\Services\RManService

    Displays artifacts relating to RemoteUtilities

  • SYSTEMrecursive
    Usoris\Remote Utilities\RManService\Host\Parameters

    Displays artifacts relating to RemoteUtilities Configuration - Base64 decode output

  • NTUSERGeneral
    Software\Usoris\Remote Utilities\RManService\Host\Parameters

    Displays artifacts relating to Portable RemoteUtilities Configuration

  • NTUSERInternetId
    Software\Usoris\Remote Utilities\RManService\Host\Parameters

    Displays artifacts relating to RemoteUtilities Configuration - Base64 decode output

  • NTUSERSecurity
    Software\Usoris\Remote Utilities\RManService\Host\Parameters

    Displays artifacts relating to RemoteUtilities Configuration - Base64 decode output

  • NTUSERFUSClientPath
    Software\Usoris\Remote Utilities\RManService\Host\Parameters

    Displays artifacts relating to RemoteUtilities Configuration

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)