Tracing Registry Keys
Last updated
Last updated
Windows 11
✅
Server 2019
✅
Windows 10
✅
Server 2016
✅
Windows 8
✅
File: %SystemRoot%\System32\Config\SOFTWARE
Key: SOFTWARE\Microsoft\Tracing
RegistryExplorer (Eric Zimmerman)
Within the SOFTWARE\Microsoft\Tracing key, there may be multiple subkeys with the following name formats of interest:
{EXECUTABLE_FILENAME}_RASMANCS
{EXECUTABLE_FILENAME}_RASAPI32
These filenames will not include the executable extension .exe.
The Last Write Timestamp of the registry key provides the first time an executable has loaded rasapi32.dll and rasman.dll in order to establish a remote network connection, typically to download a file.
Subsequent activity of this nature will not update the Last Write Timestamp of the registry key.
Server 2012
✅
Windows 7
✅
Server 2008
✅
Windows Vista
❓
Server 2003
❓
Windows XP
❌