Step 11. Exploring the Registry — Opening Windows’ Vault

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 2–3 hours

Prerequisite: Step 10 complete. We will work in Windows PowerShell. An internet connection is needed only for the search step in the mission.

What you need: a Windows PC, PowerShell. Registry Editor (regedit) is used for viewing only in Section 3-4.
Caution: every exercise today is read-only. Not a single write command appears. Carelessly modifying the registry can render a computer unbootable, so this book contains no registry-editing exercises on your home computer, anywhere. Today’s exercises are 100% safe under that condition.

Forensics dramas always have a line like this: "This program is registered to run automatically at every boot." Where did the investigator see that? The registry — the database where every Windows setting lives. It’s also the place malware touches most often to "survive a reboot." Today we open that vault ourselves and perform, step for step, the check that sits on the first page of every incident investigation manual.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the registry as "a tree structure of keys and values"
Explain the difference between HKCU and HKLM and decide which one to inspect
Navigate the registry with Get-ChildItem and Get-ItemProperty
Query the startup program list in the Run key and follow a procedure to identify each entry
Confirm that regedit (GUI) and PowerShell are "two windows looking at the same data"

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language & environment	PowerShell 5.1 (built into Windows) + Registry Editor (regedit, GUI)
Today’s commands	`Get-ChildItem HKCU:\...` (explore key structure), `Get-ItemProperty "...Run"` (read values), `regedit` (view in GUI)
Concepts needed	The registry’s tree structure, keys and values, hives (HKCU/HKLM), Persistence

2-1. The Registry — Windows’ Settings Database

The registry is where the entire "memory" of Windows and its programs is stored. Wallpaper settings, the list of installed programs, even the auto-run roster — it’s all here. Its structure maps exactly onto File Explorer:

File Explorer	Registry
Folder	Key — a branch
File	Value — data hanging on a leaf
Path `C:\Users\Lee`	Path `HKCU:\Software\Microsoft\...`

At the top sit five large trunks (hives). Today we need two:

HKCU (HKEY_CURRENT_USER) — settings for the currently logged-in user
HKLM (HKEY_LOCAL_MACHINE) — settings for the entire computer. Some areas require administrator privileges even to read

Your account settings (HKCU) are yours to browse freely, but sensitive areas of the machine-wide settings (HKLM) are locked by the operating system. You’ll meet that lock firsthand in Section 3-6 and Wall 4.

This warehouse is a nearly 30-year-old system dating back to Windows 95, so "fossils" are mixed in — empty keys left behind by long-deleted programs. If you run into unfamiliar key names while exploring, most of them are harmless fossils. The problem is that malware mixes its own traces in among these fossils — which is why the fundamental question of any investigation never changes: "Do I recognize this? Does it match how things normally look?" That question is a master key that works beyond the registry, across processes, network connections, and logs alike.

2-2. Keys and Values — Branches and Leaves

Inside a key (the counterpart of a folder) hang values. A value is an name = data pair:

키: HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
  ├─ OneDrive   = "C:\...\OneDrive.exe" /background
  ├─ KakaoTalk  = "C:\...\KakaoTalk.exe" -bystartup
  └─ ...

What this key means: "At login, automatically run the programs on this list." Windows’ startup roster lives right here. On the left is the value’s name; on the right, the path of the program to run.

2-3. Why Attackers Target This Place — Persistence

Malware’s first survival strategy: it must run again even after the computer is turned off and on. In security terms, this is called persistence. The most classic method is to secretly slip one line — its own path — into the Run key.

The defender’s countermeasure is equally well established: look at the Run key and suspect anything you don’t recognize. Simple as it is, this check has caught countless pieces of malware. The question on the first page of an incident investigation manual is exactly this — "Is there anything in this key you don’t recognize?" Today you perform that check yourself.

3. Follow Along

3-1. Registry Drives — Exploring HKCU:\

PowerShell lets you navigate the registry like a drive. Just as there’s a C: drive, HKCU: and HKLM: drives are ready for you:

Get-ChildItem HKCU:\

    Hive: HKEY_CURRENT_USER

Name                           Property
----                           --------
AppEvents
Console                        ForceV2         : 1
Control Panel
Environment                    Path             : C:\Users\dlqht\...
Software
System
Uninstall
Volatile Environment           USERNAME         : dlqht
...

(Verified on 2026-09-09. Some entries are omitted, and the list on your computer will differ depending on installed programs.)

How to read the output: the same shape as Get-ChildItem C:\ from Step 2 — just keys listed instead of folders. The Property column on the right shows values hanging directly at that spot.

Let’s go one level deeper:

Get-ChildItem "HKCU:\Software" | Select-Object -First 12 Name

Name
----
HKEY_CURRENT_USER\Software\01d4acb0-867c-5bbe-9589-216e6e9d5452
HKEY_CURRENT_USER\Software\Android Open Source Project
HKEY_CURRENT_USER\Software\ArcBrowser
HKEY_CURRENT_USER\Software\Autodesk
HKEY_CURRENT_USER\Software\BraveSoftware
HKEY_CURRENT_USER\Software\Canon
HKEY_CURRENT_USER\Software\Canonical
HKEY_CURRENT_USER\Software\Chromium
...

(Verified on 2026-09-09.)

How to read the output: among familiar program names, you can see a random-string key like 01d4acb0-867c-.... That’s one of the "fossils" from Section 2-1 — a trace some program created with its own identifier, and mostly harmless. But it’s excellent training material: even a perfectly normal computer contains plenty of unfamiliar names. That’s why investigation works not on "unfamiliar = malicious" but on "unfamiliar = needs verification."

Why do this: to feel the registry not as a "scary expert-only zone" but as "a folder structure you can navigate" — that’s today’s first goal.

3-2. The Startup Roster — Reading the Run Key

Now for today’s main event:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

OneDrive                                                 : "C:\Users\dlqht\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
KakaoTalk                                                : "C:\Program Files\Kakao\KakaoTalk\KakaoTalk.exe" -bystartup
CodexKeepAwake                                           : powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\CodexKeepAwake\keep-awake.ps1"
GoogleChromeAutoLaunch_B5498C29EBA26FB9960CE41FE2DA9313  : "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
MicrosoftEdgeAutoLaunch_D985833385C246E943C561610E88F5AE : "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
...

(Verified on 2026-09-09. Your results will differ depending on what programs you have installed.)

How to read the output: the left column is the value name; the right is the data (the path of the program to run, with its options). This list runs automatically at every login. Entries starting with PS, like PSPath and PSChildName, are extra information PowerShell attaches — safe to ignore.

Why do this: the point is to know this list in advance, while things are normal. Jot down your computer’s current list. If someday an unknown entry sneaks in here — that’s where an investigation begins.

3-3. Key View vs. Value View — The Difference Between Two Commands

You can look at the same place with a different command:

Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

(No output at all — verified on 2026-09-09)

The difference between the two commands, summarized:

Command	What it shows	File Explorer counterpart
`Get-ChildItem`	The structure of subkeys (branches)	Folders inside a folder
`Get-ItemProperty`	The values hanging there (name=data)	File contents inside a folder

How to read the output: the nothing you just saw is not an error. The Run key has no subkeys, only values, so Get-ChildItem — which shows subkeys — has nothing to show. "Empty" is structural information, too.

Why distinguish: "when you’re curious about structure" and "when you’re curious about contents" call for different tools. For deep structures like Software, explore first with Get-ChildItem; for places like Run where values are the goal, Get-ItemProperty is the answer.

3-4. Seeing It with Your Eyes — regedit

Let’s view the same thing in a GUI:

regedit

Registry Editor opens (if a warning appears, read it and proceed — today is viewing only). In the tree on the left, expand this path:

HKEY_CURRENT_USER → Software → Microsoft → Windows → CurrentVersion → Run

Click Run and the right pane shows the same list you saw in PowerShell a moment ago.

Why do this: in real investigations, the two tools are used side by side — the GUI for grasping the overall structure, PowerShell for searching, recording, and automation. Get a feel for them as "two windows onto the same data." Do not double-click or modify anything here. Look, then close.

3-5. Playing Investigator — How to Find Suspicious Entries

Now let’s re-examine the list from 3-2 with a defender’s eyes. For each entry, ask:

Do I recognize this program? (Unknown names are top-priority investigation targets)
Is the path ordinary? (Under Program Files or Windows is generally normal. Temporary folders like Temp are suspicious)
Is the way it runs awkward? (Random-looking filenames, hidden-window execution, etc.)

Let’s do exactly this with the list from the verification computer. OneDrive, KakaoTalk, and the Chrome/Edge auto-launchers are clearly identified. But what about this entry?

CodexKeepAwake : powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\CodexKeepAwake\keep-awake.ps1"

An unknown name (violating question 1), what runs is a PowerShell script (question 3), and it carries both a hidden window (-WindowStyle Hidden) and a policy bypass (-ExecutionPolicy Bypass) — the very bypass option you learned in Step 9. Three warning signals on a single entry — in a real investigation, this would be the first thing to verify.

The verification procedure is simple: search the name in a search engine, and open the folder (C:\ProgramData\CodexKeepAwake\) to see what the file is. In this case, it turned out to be a "keep-awake" script installed by a development tool — suspicious-looking but explainable. What if a search turns up nothing, the file location is odd, and you have no memory of when it appeared? Then it becomes an unexplainable case, and a real response begins (record, isolate, and investigate — before deleting anything).

Now review each entry in your own list with these three questions. The reason this review takes only ten seconds is that you know the list from normal times.

3-6. The Whole Computer’s Roster — The HKLM Run Key

If HKCU is "my account’s startup programs," HKLM separately holds "startup programs applied to every user of this computer":

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

SecurityHealth              : C:\WINDOWS\system32\SecurityHealthSystray.exe
MaximAudioSvc               : C:\Windows\System32\MaximAudioService64.exe
RtkAudUService              : "C:\WINDOWS\System32\DriverStore\...\RtkAudUService64.exe" -background
Autodesk Access             : "C:\Program Files\Autodesk\...\AdskAccessCore.exe" --minimizedUi --autoLaunch
ALNotify                    : "C:\Program Files (x86)\ESTsoft\ALToolsManager\alnotify.exe"
wizvera-veraport-x64        : "C:\Program Files\Wizvera\Veraport20\veraport-x64.exe" wizvera-veraport://...
Logitech Download Assistant : C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
...

(Verified on 2026-09-09.)

How to read the output: you’ll see the Windows security icon (SecurityHealth), audio drivers (Maxim, Realtek), and helpers for installed programs (Autodesk, ALTools, Logitech). As befits a Korean PC, there’s also a security program for banking and government-site access (Wizvera). All of these "must come up together with the system" — which is why they’re registered in the machine-wide area.

Why distinguish: once malware gains administrator privileges, it prefers this side (HKLM). It applies to every user and is hard for ordinary users to remove. So when auditing, look at both. The investigation question stays the same — "Do I recognize this?"

4. Missions & Exercises

Mission — My Computer’s Startup Program Audit Report

Using what you learned today, create a simple audit report:

Save the results of the HKCU Run key to a file (the Out-File technique from Step 4)
Save the HKLM Run key the same way
Next to each entry in the saved list (using Notepad), write its "identity" like a comment
If even one entry is unknown, search its name in a search engine and confirm its identity — this is the real investigation procedure
Keep the file, and make a plan to compare it against a freshly saved list a month from now — has anything new appeared?

Exercises

Question 1. Explain the difference between Get-ChildItem and Get-ItemProperty, and describe when to use each.

Question 2. How do the HKCU Run key and the HKLM Run key differ? Which would malware with administrator privileges prefer, and why?

Question 3. You ran Get-ChildItem on the Run key and got no output at all. Is that an error? What does it mean?

Question 4. In the Run key list you discover the path C:\Users\Lee\AppData\Local\Temp\updt.exe. Why should you be suspicious?

5. Model Answers & Completion Criteria

Mission Model Answer

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File startup-audit.txt
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File startup-audit.txt -Append

Open startup-audit.txt in Notepad and annotate each entry with its identity. An example from the verification computer:

OneDrive        — MS 클라우드 동기화. 내가 씀
KakaoTalk       — 내가 쓰는 메신저. 로그인 시 자동 실행 동의함
CodexKeepAwake  — 개발 도구가 설치한 절전 방지 스크립트. 검색·폴드 확인으로 정체 확인
SecurityHealth  — 윈도우 보안 센터 아이콘. 시스템 기본 구성
wizvera-veraport-x64 — 은행 접속용 보안 프로그램. 내가 설치 동의함
ALNotify        — 알툴즈 업데이트 알림. 내가 설치한 프로그램의 부속

How to verify: open the saved file with notepad startup-audit.txt and confirm the list is there. When every entry carries a comment and the number of "unknown entries" reaches zero (you’ve identified them all), you’re done. If any unknown entry remains, open its path folder yourself and search — reaching a confirmed identity is the entirety of this mission.

Advanced: auto-start locations number in the dozens, not just the one Run key (services, Task Scheduler, other registry locations). Microsoft’s official free tool Autoruns gathers them all onto one screen. It’s an essential of real malware investigation; for now, just know it exists. The principle is exactly today’s — "a place you register to survive a reboot."

Exercise Answers

Answer 1. Get-ChildItem shows the subkeys (structure, branches) at a location, while Get-ItemProperty shows the values (name=data, leaves) hanging there. Use the former when exploring which keys exist, as with Software, and the latter when the content is the goal, as with the Run key’s startup list.

Answer 2. HKCU Run applies only to the currently logged-in user; HKLM Run applies to every user of the computer. Malware with administrator privileges prefers HKLM — it runs for all users and is difficult to remove with ordinary user rights. That’s why an audit must query both.

Answer 3. It’s not an error. The Run key has no subkeys, only values, so Get-ChildItem — which displays subkeys — has nothing to display. "Empty" is structural information, too. To see the values, use Get-ItemProperty.

Answer 4. A temporary folder (Temp) is, as the name says, a place where "temporary" files come and go — not somewhere a legitimate program makes its home base for repeated execution. It’s also where downloaded files pause briefly, so malware frequently uses it as a registration path right after running. A name like updt.exe that "pretends to be update" is another classic trick. This is a top-priority suspect that requires identity verification.

Completion Criteria Checklist

[ ] I can explain the registry as "a tree of keys and values"
[ ] I can explain the difference between HKCU and HKLM
[ ] I can explore key structure with Get-ChildItem HKCU:\...
[ ] I can query the Run key’s startup program list with Get-ItemProperty
[ ] I know the difference between the two commands (viewing keys vs. viewing values)
[ ] I can find the same location in regedit (viewing only)
[ ] I can review entries with the three questions (do I know it / is the path ordinary / is the execution style awkward)
[ ] Mission: I completed startup-audit.txt

6. Common Pitfalls & Fixes

Wall 1. Confusing HKCU with HKLM

Symptom: a program that is definitely registered doesn’t appear in the list.
Cause: HKCU (current user) and HKLM (entire computer) are separate spaces. Your account’s startup programs and the system-wide startup programs live apart.
Fix: make a habit of querying both. Alternate between Sections 3-2 and 3-6.

Wall 2. Get-ChildItem doesn’t show the information I want

Symptom: nothing comes out on the Run key.
Cause: values must be viewed with Get-ItemProperty. Get-ChildItem shows subkeys, and the Run key has no subkeys (verified on 2026-09-09).
Fix: remember the table from Section 3-3 — ChildItem for structure, ItemProperty for contents. Alternate between them and the feel will come.

Wall 3. "Path not found" error when typing a path

Symptom: a red error appears (verified on 2026-09-09):

Get-ItemProperty : 'HKCU:\Software\Microsoft\Windows\CurrentVersoin\Run' 경로는 존재하지 않으므로 찾을 수 없습니다.
    + CategoryInfo          : ObjectNotFound: (HKCU:\Software\...rentVersoin\Run:String) [Get-ItemProperty], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetItemPropertyCommand

Cause: 99% of the time it’s a typo. Registry paths are long and spelling is unforgiving — in the example above, CurrentVersion was typed as CurrentVersoin.
Fix: don’t fight typos; climb down the tree instead. Get-ChildItem HKCU:\Software → check the next level’s name → proceed step by step. Tab-key auto-completion works on registry paths, too.

Wall 4. Access-denied error when querying HKLM

Symptom: a red error appears (verified on 2026-09-09, Get-ChildItem "HKLM:\SAM"):

Get-ChildItem : 요청한 레지스트리에 액세스할 수 없습니다.
    + CategoryInfo          : PermissionDenied: (HKEY_LOCAL_MACHINE\SAM\SAM:String) [Get-ChildItem], SecurityException

Cause: some areas of HKLM require administrator privileges (some require even system privileges) to read. SAM in the example above is Windows’ account password database — a place the operating system keeps firmly locked. It’s a lock with a reason.
Fix: if you truly need to read a location, try again from an elevated PowerShell (right-click the Start button → "Terminal (Admin)"). But just because a privilege lets you open something does not mean you may write to it — today’s "viewing only" rule still stands. And for places like SAM, it’s normal to have no reason to peek in the first place.

Wall 5. I think I clicked something wrong in regedit and I’m nervous

Symptom: you double-clicked a value and an edit window opened.
Cause: double-clicking a value opens the "modify" window — nothing has changed yet.
Fix: press Cancel. Changes are saved only when you press "OK." If you’re uneasy, just close regedit — a change you never confirmed does not exist.

7. Summary

Today’s Concepts

Concept	One-line description
Registry	A tree-structured database holding all of Windows’ settings
Key / Value	Counterparts of folder / file — a value is `name = data`
Hives (HKCU / HKLM)	Current-user area / machine-wide area
Run key	The auto-run roster at login — a classic vehicle for malware persistence
Persistence	Registration to survive reboots — both an attacker’s goal and an investigator’s clue

Today’s Commands

Command	What it does
`Get-ChildItem HKCU:\...`	Explores key structure (subkeys)
`Get-ItemProperty "HKCU:\...\Run"`	Reads values (the startup program list)
`Get-ItemProperty "HKLM:\...\Run"`	Reads machine-wide startup programs
`... \| Out-File file.txt`	Saves results to a file (Step 4 review)
`regedit`	Views the same thing in a GUI (viewing only!)

A Sense That Matters More Than Commands

For malware to survive a reboot, it must register itself somewhere, and the most popular spot is the Run key you saw today. The single-line question "Is there anything in this key I don’t recognize?" sits on the first page of real incident investigations — and from today, you can ask that question yourself.

And one more thing. The standard of investigation is not "unfamiliar = malicious" but "unfamiliar = needs verification." As you saw in today’s real measurements, even a normal computer holds many unfamiliar names, and most suspicious-looking entries turn out to be explainable once identified. Deleting without verification is not investigation, and neither is leaving things alone without verification — record, verify, then judge. That sequence is the backbone of every security investigation.

Finally, if you ever do need to modify the registry in a lab environment, there’s one iron rule: export (back up) the key before modifying it. In regedit, right-click the key → "Export" to save a .reg file, and if anything goes wrong, a single double-click restores it. "Secure the means of rollback first, then make the change" — exactly the same philosophy as Step 10’s -WhatIf, and a principle that applies to every system change.

Once every box is checked, Step 11 is complete. Click the checkbox in the sidebar to save your progress.