Windows also uses it for metadata, e.g. if you edit the "Comment" of a DLL file. The problem with NTFS alternate streams it's that they are very easy to find if

Windows also uses it for metadata, e.g. if you edit the "Comment" of a DLL file. The problem with NTFS alternate streams it's that they are very easy to find if you know what you're looking for. It might be better to hide data in plain sight in the middle of existing registry keys. Or actually you can create inaccessible registry keys (depending on the API you use, you can actually put NULLs in registry key names, making them inaccessible for regedit... but there are programs to easily detect this as it's known since a long time, see https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull https://docs.microsoft.com/en-us/sysinternals/downloads/regd...)