{
	"id": "5ff269b8-8eea-4d55-be1b-1f6fd6ac2e8d",
	"created_at": "2026-04-06T00:21:44.933745Z",
	"updated_at": "2026-04-10T03:22:06.402122Z",
	"deleted_at": null,
	"sha1_hash": "d519c922f82fbefcade0d0f41b24fc25fa0442f4",
	"title": "32-bit and 64-bit Application Data in the Registry - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 36073,
	"plain_text": "32-bit and 64-bit Application Data in the Registry - Win32 apps\r\nBy stevewhims\r\nArchived: 2026-04-05 18:23:19 UTC\r\nOn 64-bit Windows, portions of the registry entries are stored separately for 32-bit application and 64-bit\r\napplications and mapped into separate logical registry views using the registry redirector and registry reflection,\r\nbecause the 64-bit version of an application may use different registry keys and values than the 32-bit version.\r\nThere are also shared registry keys that are not redirected or reflected.\r\nThe parent of each 64-bit registry node is the Image-Specific Node or ISN. The registry redirector transparently\r\ndirects an application's registry access to the appropriate ISN subnode. Redirection subnodes in the registry tree\r\nare created automatically by the WOW64 component using the name Wow6432Node. As a result, it is essential\r\nnot to name any registry key you create Wow6432Node.\r\nThe KEY_WOW64_64KEY and KEY_WOW64_32KEY flags enable explicit access to the 64-bit registry view\r\nand the 32-bit view, respectively. For more information, see Accessing an Alternate Registry View.\r\nTo disable and enable registry reflection for a particular key, use the RegDisableReflectionKey and\r\nRegEnableReflectionKey functions. Applications should disable reflection only for the registry keys that they\r\ncreate and not attempt to disable reflection for the predefined keys such as HKEY_LOCAL_MACHINE or\r\nHKEY_CURRENT_USER. To determine which keys are on the reflection list, use the RegQueryReflectionKey\r\nfunction.\r\nRelated topics\r\nregistry redirector\r\nregistry reflection\r\nSource: https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry\r\nhttps://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry"
	],
	"report_names": [
		"32-bit-and-64-bit-application-data-in-the-registry"
	],
	"threat_actors": [],
	"ts_created_at": 1775434904,
	"ts_updated_at": 1775791326,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d519c922f82fbefcade0d0f41b24fc25fa0442f4.pdf",
		"text": "https://archive.orkl.eu/d519c922f82fbefcade0d0f41b24fc25fa0442f4.txt",
		"img": "https://archive.orkl.eu/d519c922f82fbefcade0d0f41b24fc25fa0442f4.jpg"
	}
}