Why are there extra characters at the end of reg_sz registry values when viewed through CB Live Response?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why are there extra characters at the end of reg_sz (string) registry values when viewed through CB Live Response?

Environment

• EDR Server: 6.2.4 and Higher
• CB Live Response

Resolution

When viewing registry keys through a 'Go Live' CB Live Response session, reg_sz (string) values will have a comma separated numerical value at the end, which represents the number of characters in that field.

Additional Information

These numerical values are added to show that there may be spaces or non-printable characters in fields unexpectedly.