event log source registration tampering detector — free browser tool | fatcousin

drop registry export · detect modified event log source registrations · identify providers removed or added to hide or inject events · surface manipulation of the event provider registry · runs locally

registry export

drop registry + optional mft (multi-file)

or click

Select file

HKLM\EventLog\{Channel}\{Source} · EventMessageFile · WINEVT\Publishers\{GUID} · optional MFT for DLL exists check

drop registry export(s) from EventLog and WINEVT\Publishers

ready