I believe you're thinking of the BootExecute
value, located in this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
This is a REG_MULTI_SZ
value, i.e., it contains multiple strings. Each string contains an arbitrary identifier, the name of the executable to run, and the arguments to pass to the executable. For example, the default setting contains only one string:
autocheck autochk *
Here autocheck
is an arbitrary label, autochk
indicates that the executable to run is c:\windows\system32\autochk.exe
, and *
is the argument string passed to autochk.exe
.