DFIRHub

StartupFolders

Startup Folders

  • Windows
  • 2 paths
  • Per-user data
  • Version 1
  • Jason Ballard

Paths on disk

2 paths

Paths use Windows environment variable syntax

Notes

These programs will be executed under the context of the user and will have the account's associated permissions level.

This is a fairly common persistence mechanism

Placing a program or .lnk (shortcut) file in the System-wide startup folder will cause each program to execute when a user logs in, regardless of which user.

Placing a program or .lnk (shortcut) file in a user startup folder will cause that program to execute when that specific user logs in.

References

1 link