To find out which program is accessing the registry at the moment or accessed some time ago, you can use the special RegMon utility. The name of the program contains an abbreviation for the phrase Registry Monitor. It monitors registry changes by saving data to a log file. The utility is freely available and can be downloaded for free on the developer's website.
Necessary
RegMon software
Instructions
Step 1
Run the RegMon program. Press the key combination Crtl + L. In the RegMon Filter window that opens, you will see 3 fields: Include, Exclude, Highlight. In the Include field, enter the name of the application that you want to monitor in RegMon. If you do not know the exact name of the application, right-click on the application icon, select Properties. In the window that opens, go to the "Shortcut" tab, copy the file name from the "Object" field. After entering the file name in the Regmon Filter window, click the "OK" button.
Step 2
Click the Edit menu, then select Clear Display. The main program window will be cleared. Run the application. The main window of the program will display a lot of records about the program's access to the operating system registry.
Step 3
When you close the experimental application in the main RegMon window, you will notice the appearance of new registry keys, which are displayed when you close this application. Scroll through the list of all keys and find frequent repetitions - this is the key that the application is constantly referring to. If this is a standard program of the Windows operating system, then the path to the key will look like this HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionApplets. In this key, programs store their settings.
Step 4
All keys can be exported to Excel and Access files for detailed analysis or verification.
