DFIRHub

Windows registry artifactTightVNC

Displays artifacts relating to TightVNC

  • Third Party Applications
  • 3 keys
  • SYSTEMNTUSER

Registry keys

3 keys that RECmd reads for this artifact

  • SYSTEMrecursive
    CurrentControlSet\Services\tvnserver

    Displays artifacts relating to TightVNC

  • NTUSERrecursive
    Software\TightVNC\Server

    Displays artifacts relating to TightVNC

  • SYSTEMrecursive
    ControlSet00*\Services\tvnserver

    Displays artifacts relating to TightVNC

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)