App Paths

Where a program named without a path resolves, which can be pointed elsewhere.

Use it to find a program name repointed to another binary, so a launch by that name runs something else.

SOFTWARE
Persistence

What It Is

The App Paths key lets a program be found by its executable name alone, without a full path, when it is started through the ShellExecuteEx function. An example is the Run dialogue box. A subkey named after the program's executable has a (Default) value giving the full path, and an optional Path value added to PATH for that program. It can be set for all users in HKLM SOFTWARE or per user in the user's hive, which avoids changing the system-wide PATH.

What It Proves

An App Paths subkey gives the full path ShellExecuteEx uses for a program launched by name, such as from the Run box. It applies when no file of that name sits in the working folder, the Windows folders or the PATH. Repointing such a name, or adding one, sends that launch to another binary.

What It Does Not Prove

It only affects launches by name through ShellExecute, not a full path or an ordinary CreateProcess. Genuine installers add entries here, so judge by the target.

Where It Lives

App Paths lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\<program.exe>

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in App Paths, each with what it tells you
Registry Value	What It Tells You
`wmplayer.exe\(Default)` `REG_EXPAND_SZ%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe`	wmplayer.exe resolves to Windows Media Player in Program Files (x86), where Windows installs it. Compare each default with where the program really lives.
`chrome.exe\(Default)` `REG_SZC:\Program Files\Google\Chrome\Application\chrome.exe`	chrome.exe resolves to Chrome's real install path, a normal entry its installer added. A known name pointed at AppData would be the redirection.

How to Read It

List the program subkeys under App Paths in HKLM and HKCU, and read each default value, the resolved path. Compare each default with where that program really lives. A known name pointed at AppData or ProgramData, or an odd new name, is the signal.

When Windows Writes It: When a program is installed, or an entry is added or repointed.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows an entry added or repointed, not a launch. A known name pointed at a user folder is the signal.

KQLDefender XDR, Advanced hunting

// App Paths entries being added or repointedDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey contains @"\CurrentVersion\App Paths\"| project Timestamp, ActionType, RegistryKey, RegistryValueData, PreviousRegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what App Paths shows.

AmcacheGives the SHA-1 of the program the entry points to.
Program Starts From an Odd Path, Security Event 4688Not in the RegistryShows the program launching from the path set here, not its usual place.

Sources

The facts on this page come from these public pages, which say more on each point.