DFIRHub

Windows registry artifactWinSCP

WinSCP

  • Third Party Applications
  • 4 keys
  • NTUSERSOFTWAREDEFAULTUser

Registry keys

4 keys that RECmd reads for this artifact

  • NTUSERrecursive
    Software\Martin Prikryl

    WinSCP

  • SOFTWARErecursive
    WOW6432Node\Martin Prikryl

    WinSCP

  • DEFAULTrecursive
    Software\Martin Prikryl

    WinSCP

  • Userrecursive
    Software\Martin Prikryl

    WinSCP Windows Store Version

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)