HKEY_DYN_DATA

HKDD is a fake key--it doesn't really exist. It serves as a convenient doorway to device driver, Win32 application, and native NT performance counters via the Registry API. When a Win32 program queries a value or key in HKDD, the request gets routed as an I/O request to the appropriate driver or Win32 program, which returns information that looks like the result of an authentic Registry access. The Performance Monitor (Perfmon) program accesses this root key to provide the intricate performance information it displays.