DFIRHub

Windows registry artifactStartup Programs

Displays list of programs that start up upon system boot

  • Autoruns
  • 6 keys
  • NTUSERSOFTWARE

Registry keys

6 keys that RECmd reads for this artifact

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run

    Displays list of programs that start up upon system boot

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32

    Displays list of programs that start up upon system boot

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder

    Displays list of programs that start up upon system boot

  • SOFTWARErecursive
    Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run

    Displays list of programs that start up upon system boot

  • SOFTWARErecursive
    Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32

    Displays list of programs that start up upon system boot

  • SOFTWARErecursive
    Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder

    Displays list of programs that start up upon system boot

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)