Autoruns

• Demo: https://channel9.msdn.com/events/Ignite/Microsoft-Ignite-Orlando-2017/BRK3148?term=sysinternals%20gems
• Has VirusTotal integration. sends a SHA 256 Hash.

there is a command line version of autoruns: autorunsc.exe

data is saved with an .arn extension

What Links Here

• Sysinternals ‎ (← links | edit)
• List of entities ‎ (← links | edit)