RMM
NVDA (Non-Visual Desktop Access)
NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a "Remote Access" feature that enables remote support and assistance capabilities.
Tool overview
- Category
- RMM
- Research authors
- Michael Haag
- Created
- 2026-01-15
- Last modified
- 2026-01-15
- Privileges
- User
- Free / availability
- Yes
- Verification required
- Open Source
- Supported platforms
Windows
Capabilities
Executables & installation paths
- Filename
- nvda.exe
- OriginalFileName
- Not recorded
- Description
- NVDA screen reader executable
- Filename
- nvda_service.exe
- OriginalFileName
- Not recorded
- Description
- NVDA service executable for secure screens
Installation paths
C:\Program Files (x86)\NVDA\nvda.exe
C:\Program Files\NVDA\nvda.exe
C:\Users\*\AppData\Roaming\nvda\*
C:\Users\*\AppData\Local\Temp\nvda_*\*
nvda.exe
nvda_service.exe
nvda_*.exe
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files (x86)\NVDA\nvda.exe
- Description
- NVDA installation directory
- OS
- Windows
- File
- C:\Program Files\NVDA\nvda.exe
- Description
- NVDA installation directory (64-bit)
- OS
- Windows
- File
- C:\Users\*\AppData\Roaming\nvda\nvda.log
- Description
- NVDA log file
- OS
- Windows
- File
- C:\Users\*\AppData\Roaming\nvda\nvda.ini
- Description
- NVDA configuration file
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 4688
- Description
- Process creation event for nvda.exe
- OS
- Windows
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- nvaccess.org
- *.nvaccess.org
- Ports
- 443
References
Acknowledgements
- Person
- 59e5aaf4
- Handle
- @59e5aaf4