################ HKEY_LOCAL_MACHINE STRING, "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProductId" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganizatio n" STRING,

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeT ext" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomai nName" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserN ame" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassw ord" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AltDefaultDo mainName" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AltDefaultUs erName" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShutdownWith outLogon" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\1\Descri ption" STRING, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2\Descri ption" DWORD, "HKLM\SOFTWARE\Microsoft\TelnetServer\1.0\NTLM" DWORD, "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnection s" STRING, "HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\Compute rName" STRING, "HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName\C omputerName" DWORD, "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\AutoShar eServer" STRING, "HKLM\SYSTEM\ControlSet\Services\VxD\MSTCP\HostName" DWORD, "HKLM\SYSTEM\CurrentControlSet\Control\LSA\RestrictAnonymous" STRING, "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96D-E325-11CE-BFC1-08 002BE10318}\0000\DriverDesc" STRING, "HKLM\SYSTEM\ControlSet001\Services\VxD\MSTCP\HostName" STRING, "HKLM\SYSTEM\ControlSet002\Services\VxD\MSTCP\HostName" STRING, "HKLM\SYSTEM\ControlSet003\Services\VxD\MSTCP\HostName" DWORD, STRING, DWORD, STRING, DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz" "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier" "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz" "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier" "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q147222\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q252795\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q267843\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q276471\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q285156\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q285851\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q295688\Install

ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD, ed" DWORD,

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q296185\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q298012\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q299553\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q299687\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q299796\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q299956\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q300845\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q302755\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q311967\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q313450\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q313582\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q313829\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q314147\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q318138\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q320176\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q320206\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q322842\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q323172\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q324380\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q326830\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q326886\Install "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\SP2SRP1\Install "HKLM\SOFTWARE\Microsoft\Updates\Windows XP\SP1\Q315000\Installed"

BINARY, "HKLM\SOFTWARE\ORL\WinVNC3\Default\Password" STRING, "HKLM\SOFTWARE\Microsoft\MSSQLServer\SQLServerAgent\HostPassword" STRING, "HKLM\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\CurrentVersion\Register edOwner" STRING, "HKLM\SOFTWARE\Napster\CurrentUser" STRING, "HKLM\SOFTWARE\Nico Mak Computing\WinZip\WinIni\Name" STRING, "HKLM\SOFTWARE\Symantec\Norton AntiVirus\CurrentVersion" ################ HKEY_USERS STRING, "HKU\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP

Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet User Name" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet User Name" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet User Name" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet User Name" STRING, "HKU\Software\Microsoft\Internet Server" STRING, "HKU\Software\Microsoft\Internet Display Name" STRING, "HKU\Software\Microsoft\Internet Email Address"

Account Manager\Accounts\00000001\SMTP Account Manager\Accounts\00000001\SMTP Account Manager\Accounts\00000001\POP3 Account Manager\Accounts\00000001\POP3 Account Manager\Accounts\00000001\NNTP Account Manager\Accounts\00000001\NNTP Account Manager\Accounts\00000002\SMTP Account Manager\Accounts\00000002\SMTP Account Manager\Accounts\00000002\SMTP Account Manager\Accounts\00000002\POP3 Account Manager\Accounts\00000002\POP3 Account Manager\Accounts\00000002\NNTP Account Manager\Accounts\00000002\NNTP Account Manager\Accounts\00000003\SMTP Account Manager\Accounts\00000003\SMTP Account Manager\Accounts\00000003\SMTP Account Manager\Accounts\00000003\POP3 Account Manager\Accounts\00000003\POP3 Account Manager\Accounts\00000003\NNTP Account Manager\Accounts\00000003\NNTP Account Manager\Accounts\00000004\SMTP Account Manager\Accounts\00000004\SMTP Account Manager\Accounts\00000004\SMTP Account Manager\Accounts\00000004\POP3 Account Manager\Accounts\00000004\POP3 Account Manager\Accounts\00000004\NNTP Account Manager\Accounts\00000004\NNTP

STRING, "HKU\Software\Microsoft\Exchange\UserName"

STRING, STRING, STRING, BINARY, STRING, STRING, STRING, STRING, STRING, STRING, STRING,

"HKU\Software\Microsoft\Exchange\LogonDomain" "HKU\Software\Kazaa\UserDetails\Email" "HKU\Software\Kazaa\UserDetails\UserName" "HKU\Software\ORL\WinVNC3\Password" "HKU\Software\Microsoft\Fax\UserInfo\FullName" "HKU\Software\Microsoft\Fax\UserInfo\HomePhone" "HKU\Software\Microsoft\Fax\UserInfo\OfficePhone" "HKU\Software\Microsoft\User "HKU\Software\Microsoft\User "HKU\Software\Microsoft\User "HKU\Software\Microsoft\User Location Location Location Location Service\Client\Email Name" Service\Client\First Name" Service\Client\Last Name" Service\Client\User Name"

STRING, "HKU\Software\Morpheus\UserDetails\UserName"