Useful Registry Keys (Continuously Updated)

WARNING
Editing the registry carries risks — proceed with caution. Incorrect changes can cause serious system failures, or even require a full system reinstall.

NOTE
Thanks to Disa for the additions.

Auto-start#

Run: runs at every boot.
RunOnce: runs only once, then deletes itself after execution.

User-level#

1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
4
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
5
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
6
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
7
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

System-level#

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup
4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
9
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
10
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce

Image File Execution Options#

Image hijacking#

When you launch the target program, the hijacking program runs instead of the original one.

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Option

Create a subkey named after the target process, and inside it add a debugger value set to the hijacking program.

SilentProcessExit#

When ReportingMode is set to 1, the system runs the program specified in MonitorProcess when the monitored process exits.

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit

Create a subkey named after the target process, add a MonitorProcess value set to the hijacking program, and a ReportingMode value set to 1.

MinimumStackCommitInBytes#

Setting MinimumStackCommitInBytes to a large enough value makes the specified program crash with a stack overflow.

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[Target Process]\MinimumStackCommitInBytes

Scheduled Tasks#

Hierarchy information#

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree

If the index is 0, the task is not visible in taskschd.msc.

Task details#

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks

Deleting Files After Reboot#

1
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

Each operation consists of a pair of strings:

The first string is the path of the source file or directory.
The second string is the path of the target file or directory (empty for a delete operation).

For example:

1
\??\C:\OldFile.txt
2
\??\C:\NewFile.txt

This renames C:\OldFile.txt to C:\NewFile.txt.