AutoRuns

Field name

Data type

Description

id_snapshot

number

Identifier of the network snapshot.

server_name

string

Netbios name of the server without the two preceding backslash characters.

AutoType

number

See appendix 1

Name

string

Name of the program start item (Registry value name or shortcut name

ExecutableFile

string

Path to the executable file

Arguments

string

Arguments provided to the executable

AccountName

string

Account concerned for AutoType 2, 5, 7(user auto runs)

Number

Symbolic name

Description

0

HKLM / Run

Programs started by the machine Run key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

1

HKLM / Run 64 bits

Programs started by the 64 bits machine Run key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

2

HKCU / Run

Programs started by the user Run key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

3

HKLM / RunOnce

Programs started by the machine RunOnce key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

4

HKLM / RunOnce 64 bits

Programs started by the 64 bits machine RunOnce key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

5

HKCU / Runonce

Programs started by the user RunOnce key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

6

Startup folder (Common)

Programs started by the machine startup folder
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

7

Startup folder (User)

Programs started by the user startup folder
C:\Documents and Settings\%AccountName%\Start Menu\Programs\Startup