DFIRHub

Windows registry artifactTeamViewer

Windows username of logged in user

  • Third Party Applications
  • 7 keys
  • NTUSERSOFTWARESYSTEM

Registry keys

7 keys that RECmd reads for this artifact

  • NTUSERMeeting_UserName
    Software\TeamViewer

    Windows username of logged in user

  • NTUSERBuddyLoginName
    Software\TeamViewer

    User's email associated with TeamViewer

  • NTUSERBuddyDisplayName
    Software\TeamViewer

    User specified TeamViewer display name

  • SOFTWAREOwningManagerAccountName
    WOW6432Node\TeamViewer

    Displays the name of the user logged into TeamViewer

  • SOFTWAREPermanentPasswordDate
    WOW6432Node\TeamViewer

    Displays the date the password was last set for the user within TeamViewer

  • SYSTEMrecursive
    CurrentControlSet\Services\TeamViewer

    Displays artifacts relating to TeamViewer

  • SYSTEMrecursive
    ControlSet00*\Services\TeamViewer

    Displays artifacts relating to TeamViewer

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)