Windows Registry

Question 1

Windows Registry

Answer 1

A collection of databases that contains the system’s configuration data. This configuration data can be about the hardware, the software, or the user’s information. It also includes data about the recently used files, programs used, or devices connected to the system.

Question 2

Registry Keys

Answer 2

The folders you see within the Registry

Question 3

Registry Hive

Answer 3

A group of Keys, subkeys, and values stored in a single file on the disk.

Question 4

HKEY_CURRENT_USER

Answer 4

Contains the root of the configuration information for the user who is currently logged on. The user’s folders, screen colors, and Control Panel settings are stored here. This information is associated with the user’s profile. This key is sometimes abbreviated as HKCU.

Question 5

HKEY_USERS

Answer 5

Contains all the actively loaded user profiles on the computer. HKEY_CURRENT_USER is a subkey of HKEY_USERS. HKEY_USERS is sometimes abbreviated as HKU.

Question 6

HKEY_LOCAL_MACHINE

Answer 6

Contains configuration information particular to the computer (for any user). This key is sometimes abbreviated as HKLM.

Question 7

HKEY_CLASSES_ROOT

Answer 7

The information that is stored here makes sure that the correct program opens when you open a file by using Windows Explorer. This key is sometimes abbreviated as HKCR.

Question 8

HKEY_CURRENT_CONFIG

Answer 8

Contains information about the hardware profile that is used by the local computer at system startup.

Question 9

UserAssist

Answer 9

Registry keys that contain information about the programs launched, the time of their launch, and the number of times they were executed.

Question 10

ShimCache

Answer 10

A mechanism used to keep track of application compatibility with the OS and tracks all applications launched on the machine. Its main purpose in Windows is to ensure backward compatibility of applications. It is also called Application Compatibility Cache (AppCompatCache)

Question 11

AmCache

Answer 11

An artifact related to ShimCache. This performs a similar function to ShimCache, and stores additional data related to program executions. This data includes execution path, installation, execution and deletion times, and SHA1 hashes of the executed programs.

Question 12

BAM

Answer 12

Background Activity Monitor
Keeps a tab on the activity of background applications.