SharpHide.exe

SharpHide is a Windows C# utility that creates or deletes one hidden value under the standard HKCU or HKLM Run key. At the pinned upstream commit it uses NtSetValueKey and a fixed value name beginning with two NUL characters to confuse DFIR inspection. Creation stores the supplied executable path as a quoted REG_SZ command value and appends optional arguments. The source selects HKLM when running as SYSTEM or when its built-in Administrators owner check succeeds, and HKCU otherwise. The value is intended to launch the referenced program at logon; this obscures the value name from some inspection tools but does not hide the registry change or guarantee payload execution.