The "Start" value has the following meanings: 
    0 = Boot (Loaded ntldr)  
    1 = System (Loaded at kernel init)  
    2 = Auto Load (Loaded automatically)   
    3 = Load on Demand (Loaded by process or user demand)   
    4 = Disabled (Driver is not started)   
    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Data\Linkage
    Export    REG_MULTI_SZ    .NET CLR Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Data\Performance
    Open    REG_SZ    OpenPerformanceData
    Collect    REG_SZ    CollectPerformanceData
    Close    REG_SZ    ClosePerformanceData
    Library    REG_SZ    netfxperf.dll
    Counter Types    REG_BINARY    3600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000000000
    Counter Names    REG_BINARY    530071006C0043006C00690065006E0074003A002000430075007200720065006E00740020002300200070006F006F006C0065006400200061006E00640020006E006F006E0070006F006F006C0065006400200063006F006E006E0065006300740069006F006E0073000000530071006C0043006C00690065006E0074003A002000430075007200720065006E00740020002300200070006F006F006C0065006400200063006F006E006E0065006300740069006F006E0073000000530071006C0043006C00690065006E0074003A002000430075007200720065006E00740020002300200063006F006E006E0065006300740069006F006E00200070006F006F006C0073000000530071006C0043006C00690065006E0074003A0020005000650061006B0020002300200070006F006F006C0065006400200063006F006E006E0065006300740069006F006E0073000000530071006C0043006C00690065006E0074003A00200054006F00740061006C002000230020006600610069006C0065006400200063006F006E006E0065006300740073000000530071006C0043006C00690065006E0074003A00200054006F00740061006C002000230020006600610069006C0065006400200063006F006D006D0061006E006400730000000000
    PerfIniFile    REG_SZ    _DataPerfCounters.ini
    Last Counter    REG_DWORD    0x86c
    Last Help    REG_DWORD    0x86d
    First Counter    REG_DWORD    0x860
    First Help    REG_DWORD    0x861
    Object List    REG_SZ    2144
    WbemAdapFileSignature    REG_BINARY    31FB4B337DD09BDF99429D7DBB5FDD48
    WbemAdapFileTime    REG_BINARY    BEA6C3731F62C701
    WbemAdapFileSize    REG_DWORD    0x8000
    WbemAdapStatus    REG_DWORD    0x0
    CategoryOptions    REG_DWORD    0x1
    IsMultiInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Linkage
    Export    REG_MULTI_SZ    .NET CLR Networking

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
    Open    REG_SZ    OpenPerformanceData
    Collect    REG_SZ    CollectPerformanceData
    Close    REG_SZ    ClosePerformanceData
    Library    REG_SZ    netfxperf.dll
    Counter Types    REG_BINARY    3600350035003300360000003600350037003900320000003600350037003900320000003600350035003300360000003600350035003300360000000000
    Counter Names    REG_BINARY    43006F006E006E0065006300740069006F006E0073002000450073007400610062006C00690073006800650064000000420079007400650073002000520065006300650069007600650064000000420079007400650073002000530065006E007400000044006100740061006700720061006D007300200052006500630065006900760065006400000044006100740061006700720061006D0073002000530065006E00740000000000
    PerfIniFile    REG_SZ    _Networkingperfcounters.ini
    Last Counter    REG_DWORD    0x878
    Last Help    REG_DWORD    0x879
    First Counter    REG_DWORD    0x86e
    First Help    REG_DWORD    0x86f
    Object List    REG_SZ    2158
    WbemAdapFileSignature    REG_BINARY    31FB4B337DD09BDF99429D7DBB5FDD48
    WbemAdapFileTime    REG_BINARY    BEA6C3731F62C701
    WbemAdapFileSize    REG_DWORD    0x8000
    WbemAdapStatus    REG_DWORD    0x0
    IsMultiInstance    REG_DWORD    0x1
    FileMappingSize    REG_DWORD    0x20000
    CategoryOptions    REG_DWORD    0x3

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for Oracle

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for Oracle\Linkage
    Export    REG_MULTI_SZ    .NET Data Provider for Oracle

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for Oracle\Performance
    CategoryOptions    REG_DWORD    0x3
    IsMultiInstance    REG_DWORD    0x1
    Counter Types    REG_BINARY    32003700320036003900360033003200300000003200370032003600390036003300320030000000320037003200360039003600330032003000000032003700320036003900360033003200300000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000000000
    Library    REG_SZ    netfxperf.dll
    Collect    REG_SZ    CollectPerformanceData
    FileMappingSize    REG_DWORD    0x20000
    Counter Names    REG_BINARY    480061007200640043006F006E006E0065006300740073005000650072005300650063006F006E0064000000480061007200640044006900730063006F006E006E0065006300740073005000650072005300650063006F006E006400000053006F006600740043006F006E006E0065006300740073005000650072005300650063006F006E006400000053006F006600740044006900730063006F006E006E0065006300740073005000650072005300650063006F006E00640000004E0075006D006200650072004F0066004E006F006E0050006F006F006C006500640043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F00660050006F006F006C006500640043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F00660041006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00470072006F0075007000730000004E0075006D006200650072004F00660049006E0061006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00470072006F0075007000730000004E0075006D006200650072004F00660041006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00730000004E0075006D006200650072004F00660049006E0061006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00730000004E0075006D006200650072004F00660041006300740069007600650043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F006600460072006500650043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F00660053007400610073006900730043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F0066005200650063006C00610069006D006500640043006F006E006E0065006300740069006F006E00730000000000
    Close    REG_SZ    ClosePerformanceData
    Open    REG_SZ    OpenPerformanceData
    PerfIniFile    REG_SZ    _DataOracleClientPerfCounters_shared12_neutral.ini
    Last Counter    REG_DWORD    0xec0
    Last Help    REG_DWORD    0xec1
    First Counter    REG_DWORD    0xea4
    First Help    REG_DWORD    0xea5
    Object List    REG_SZ    3748

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer\Linkage
    Export    REG_MULTI_SZ    .NET Data Provider for SqlServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer\Performance
    FileMappingSize    REG_DWORD    0x20000
    CategoryOptions    REG_DWORD    0x3
    IsMultiInstance    REG_DWORD    0x1
    Counter Names    REG_BINARY    480061007200640043006F006E006E0065006300740073005000650072005300650063006F006E0064000000480061007200640044006900730063006F006E006E0065006300740073005000650072005300650063006F006E006400000053006F006600740043006F006E006E0065006300740073005000650072005300650063006F006E006400000053006F006600740044006900730063006F006E006E0065006300740073005000650072005300650063006F006E00640000004E0075006D006200650072004F0066004E006F006E0050006F006F006C006500640043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F00660050006F006F006C006500640043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F00660041006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00470072006F0075007000730000004E0075006D006200650072004F00660049006E0061006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00470072006F0075007000730000004E0075006D006200650072004F00660041006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00730000004E0075006D006200650072004F00660049006E0061006300740069007600650043006F006E006E0065006300740069006F006E0050006F006F006C00730000004E0075006D006200650072004F00660041006300740069007600650043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F006600460072006500650043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F00660053007400610073006900730043006F006E006E0065006300740069006F006E00730000004E0075006D006200650072004F0066005200650063006C00610069006D006500640043006F006E006E0065006300740069006F006E00730000000000
    Counter Types    REG_BINARY    32003700320036003900360033003200300000003200370032003600390036003300320030000000320037003200360039003600330032003000000032003700320036003900360033003200300000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000003600350035003300360000000000
    Library    REG_SZ    netfxperf.dll
    Close    REG_SZ    ClosePerformanceData
    Collect    REG_SZ    CollectPerformanceData
    Open    REG_SZ    OpenPerformanceData
    PerfIniFile    REG_SZ    _dataperfcounters_shared12_neutral.ini
    Last Counter    REG_DWORD    0xede
    Last Help    REG_DWORD    0xedf
    First Counter    REG_DWORD    0xec2
    First Help    REG_DWORD    0xec3
    Object List    REG_SZ    3778

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NETFramework

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NETFramework\Performance
    Close    REG_SZ    CloseCtrs
    Collect    REG_SZ    CollectCtrs
    Open    REG_SZ    OpenCtrs
    Library    REG_SZ    mscoree.dll
    PerfIniFile    REG_SZ    corperfmonsymbols.ini
    Last Counter    REG_DWORD    0x928
    Last Help    REG_DWORD    0x929
    First Counter    REG_DWORD    0x87a
    First Help    REG_DWORD    0x87b
    WbemAdapFileSignature    REG_BINARY    B6805A214BE74F3D672BEF58AAF2BA41
    WbemAdapFileTime    REG_BINARY    1E819D731F62C701
    WbemAdapFileSize    REG_DWORD    0x42400
    WbemAdapStatus    REG_DWORD    0x0
    1008    REG_NONE    932A964933C4CA01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Abiosdsk
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Primary disk
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Boot Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Microsoft ACPI Driver
    ImagePath    REG_SZ    system32\DRIVERS\ACPI.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI\Enum
    0    REG_SZ    ACPI_HAL\PNP0C08\0
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPIEC
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Boot Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x5
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\actionagent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Veritas\VRTSobc\pal33\bin\vxpal.exe" -a actionagent
    DisplayName    REG_SZ    Veritas Action Agent
    DependOnService    REG_MULTI_SZ    VRTSpbx
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides Veritas Enterprise Action Agent Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\actionagent\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\actionagent\Enum
    0    REG_SZ    Root\LEGACY_ACTIONAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu160m
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3c
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu160m\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu160m\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu320
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3c
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu320\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu320\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc
    Description    REG_SZ    Processes application compatibility lookup requests for applications as they are launched.
    DisplayName    REG_SZ    Application Experience Lookup Service
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20
    FailureActions    REG_BINARY    05000000000000000000000002000000640020000100000060EA00000100000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\aelupsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc\Enum
    0    REG_SZ    Root\LEGACY_AELOOKUPSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afcnt
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afcnt\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afcnt\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD
    DisplayName    REG_SZ    AFD
    Description    REG_SZ    AFD Networking Support Environment
    Group    REG_SZ    TDI
    ImagePath    REG_SZ    \SystemRoot\System32\drivers\afd.sys
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters
    CitrixBackupDefaultSendWindow    REG_DWORD    0x0
    DefaultSendWindow    REG_DWORD    0xfc00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020060000400000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D01020001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Enum
    0    REG_SZ    Root\LEGACY_AFD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aic78u2
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x34
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aic78u2\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aic78u2\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aic78xx
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x1e
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aic78xx\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aic78xx\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k LocalService
    DisplayName    REG_SZ    Alerter
    DependOnService    REG_MULTI_SZ    LanmanWorkstation
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\alrsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\alg.exe
    DisplayName    REG_SZ    Application Layer Gateway Service
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG\Enum
    0    REG_SZ    Root\LEGACY_ALG\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AliIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AmdIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
    Description    REG_SZ    Processes installation, removal, and enumeration requests for Active Directory IntelliMirror group policy programs. If the service is disabled, users will be unable to install, remove, or enumerate any IntelliMirror programs. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Application Management
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\appmgmts.dll
    ServiceDllUnloadOnStop    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200780005000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000000018008D00000001020000000000052000000021020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt\Enum
    0    REG_SZ    Root\LEGACY_APPMGMT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arc
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x1e
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arc\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arc\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP\Performance
    Library    REG_SZ    aspperf.dll
    Open    REG_SZ    OpenASPPerformanceData
    Close    REG_SZ    CloseASPPerformanceData
    Collect    REG_SZ    CollectASPPerformanceData
    PerfIniFile    REG_SZ    axperf.ini
    Last Counter    REG_DWORD    0xaf0
    Last Help    REG_DWORD    0xaf1
    First Counter    REG_DWORD    0xaa0
    First Help    REG_DWORD    0xaa1
    Object List    REG_SZ    2720
    Library Validation Code    REG_BINARY    0002D51634A5C8010054000000000000
    2003    REG_NONE    EAFC33C18D0FCB01
    WbemAdapFileSignature    REG_BINARY    03811F58C6BFB7BE2829E884804C5267
    WbemAdapFileTime    REG_BINARY    2870F21534A5C801
    WbemAdapFileSize    REG_DWORD    0x5400
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET\Performance
    Library    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll
    Open    REG_SZ    OpenPerfCommonData
    Close    REG_SZ    ClosePerfCommonData
    Collect    REG_SZ    CollectPerfCommonData
    PerfIniFile    REG_SZ    aspnet_perf2.ini
    WbemAdapFileSignature    REG_BINARY    A54235D77F14C5DBA7931BE1EBFD1763
    WbemAdapFileTime    REG_BINARY    08AB66731F62C701
    WbemAdapFileSize    REG_DWORD    0x3f000
    WbemAdapStatus    REG_DWORD    0x0
    Last Counter    REG_DWORD    0x1dac
    Last Help    REG_DWORD    0x1dad
    First Counter    REG_DWORD    0x1cdc
    First Help    REG_DWORD    0x1cdd
    Object List    REG_SZ    7388 7390

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_1.1.4322

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_1.1.4322\Names

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_1.1.4322\Performance
    Library    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
    Open    REG_SZ    OpenVersionedPerfData
    Close    REG_SZ    CloseVersionedPerfData
    Collect    REG_SZ    CollectVersionedPerfData
    PerfIniFile    REG_SZ    aspnet_perf.ini
    Last Counter    REG_DWORD    0xb78
    Last Help    REG_DWORD    0xb79
    First Counter    REG_DWORD    0xaf2
    First Help    REG_DWORD    0xaf3
    Object List    REG_SZ    2802 2804
    WbemAdapFileSignature    REG_BINARY    A54235D77F14C5DBA7931BE1EBFD1763
    WbemAdapFileTime    REG_BINARY    08AB66731F62C701
    WbemAdapFileSize    REG_DWORD    0x3f000
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_2.0.50727

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_2.0.50727\Names

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_2.0.50727\Performance
    Library    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll
    Open    REG_SZ    OpenVersionedPerfData
    Close    REG_SZ    CloseVersionedPerfData
    Collect    REG_SZ    CollectVersionedPerfData
    PerfIniFile    REG_SZ    aspnet_perf.ini
    Last Counter    REG_DWORD    0x1cda
    Last Help    REG_DWORD    0x1cdb
    First Counter    REG_DWORD    0x1c0a
    First Help    REG_DWORD    0x1c0b
    Object List    REG_SZ    7178 7180

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
    DisplayName    REG_SZ    ASP.NET State Service
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state\Parameters
    Port    REG_DWORD    0xa5b8
    AllowRemoteConnection    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state\Performance
    Library    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll
    Open    REG_SZ    OpenStateServicePerfData
    Close    REG_SZ    CloseStateServicePerfData
    Collect    REG_SZ    CollectStateServicePerfData
    PerfIniFile    REG_SZ    aspnet_state_perf.ini
    Last Counter    REG_DWORD    0x1c08
    Last Help    REG_DWORD    0x1c09
    First Counter    REG_DWORD    0x1b30
    First Help    REG_DWORD    0x1b31
    Object List    REG_SZ    6960

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AsyncMac
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\asyncmac.sys
    DisplayName    REG_SZ    RAS Asynchronous Media Driver
    Description    REG_SZ    RAS Asynchronous Media Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AsyncMac\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x19
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Standard IDE/ESDI Hard Disk Controller
    ImagePath    REG_SZ    system32\DRIVERS\atapi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Parameters
    LegacyDetection    REG_DWORD    0x1
    GhostSlave    REG_MULTI_SZ    SunDisk 
    UseCheckPowerForFlush    REG_MULTI_SZ    SAMSUNG WNR-31601A (1600MB)             \0SAMSUNG WNR-31601A (1.6GB)              \0IBM-DTCA-24090                          TC6OAA2A\0IBM-DTCA-24090                          TC6IAA2A\0IBM-DPLA-25120                          PL8OAA2A\0IBM-DPLA-25120                          PL8IAA2A\0IBM-DPLA-25120                          PL8IAA4A\0IBM-DTCA-23240                          TC5OAA2A\0IBM-DTCA-23240                          TC5IAA2A\0IBM-DPLA-24480                          PL7OAA2A\0IBM-DPLA-24480                          PL7IAA2A
    NoFlushDevice    REG_MULTI_SZ    QUANTUM_LPS525A                         \0SCR-730                                 
    PioOnlyDevice    REG_MULTI_SZ        Conner Peripherals 425MB - CFS425A  \0MATSHITA CR-581                         \0FX600S                                  \0CD-44E                                  \0QUANTUM TRB850A                         \0QUANTUM MARVERICK 540A                  \0 MAXTOR MXT-540  AT                     \0Maxtor 71260 AT                         \0Maxtor 7850 AV                          \0Maxtor 7540 AV                          \0Maxtor 7213 AT                          \0Maxtor 7345                             \0Maxtor 7245 AT                          \0Maxtor 7245                             \0Maxtor 7211AU                           \0Maxtor 7171 AT                          \0CD-316E                                 \0SAMSUNG_SCR-2430\0CR-2801TE
    NonRemovableMedia    REG_MULTI_SZ    Kingston Technology DataPak 340         \0SunDisk SDP5A-10                        \0SunDisk SDCFB-10                        \0SunDisk SDP3B-20                        \0SunDisk SDP3B-175                       \0SunDisk SDP5-2.5                        \0Calluna Technology CT260MC              \0BN-S004AC-S 1.00\0Calluna Technology CT520RM\0Hitachi CV 5.1.1\0      ATA_FLASH \0Mitsubishi ATA Card \0LEXAR ATA_FLASH\0Micron MTCF004A\0Micron MTCF008A\0SunDisk SDP3B-110\0SunDisk SDCFB-4\0BN-CAB-T\0MEMORYSTICK\0MEMORYSTICK   8M  8K
    NoPowerDownDevice    REG_MULTI_SZ    RD-DRC001-M                             \0CS-R37 0                                
    AutoEjectZipDevice    REG_MULTI_SZ    IOMEGA  ZIP 100       ATAPI             23.D    \0IOMEGA  ZIP 100       ATAPI             21.D    \0IOMEGA  ZIP 100       ATAPI             20.D    \0IOMEGA  ZIP 100       ATAPI             91.D    \0IOMEGA  ZIP 100                         B.29    \0IOMEGA  ZIP 100                         B.22    
    NeedIdentDevice    REG_MULTI_SZ    QUANTUM FIREBALL
    DefaultPioAtapiDevice    REG_MULTI_SZ    TORiSAN DVD-ROM DRD-N216\0IDE-CD R/RW 2x2x24

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Enum
    0    REG_SZ    PCIIDE\IDEChannel\4&23a0739c&0&0
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    PCIIDE\IDEChannel\4&23a0739c&0&1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Atdisk
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Primary disk
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    Tag    REG_DWORD    0x2
    ImagePath    REG_SZ    system32\DRIVERS\ati2mtag.sys
    Group    REG_SZ    Video

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device0
    InstalledDisplayDrivers    REG_MULTI_SZ    ati2dvag
    MultiFunctionSupported    REG_DWORD    0x1
    GCOOPTION_DisableGPIOPowerSaveMode    REG_DWORD    0x1
    ReleaseVersion    REG_SZ    8.24.50.4-090401a-078900C-HP
    BuildNumber    REG_SZ    78900
    drv    REG_SZ    ati2dvag.dll
    DALGameGammaScale    REG_DWORD    0x646464
    UseNewOGLRegPath    REG_DWORD    0x1
    DALRULE_DYNAMICFIXEDDISPLAYMODEREPORTING    REG_DWORD    0x1
    GXOPPUseExclusiveExecution    REG_DWORD    0x1
    DALDefaultModeBCD    REG_BINARY    1024076800320060
    DALRULE_GETVGAEXPANSIONATBOOT    REG_DWORD    0x0
    DALRULE_ALLOWNONDDCCRTALLMODESUPTO1600x1200    REG_DWORD    0x1
    VideoOverlay_NA    REG_SZ    1
    DisableHotPlugDFP    REG_DWORD    0x1
    ExtEvent_EnableAlpsMouseOrientation    REG_DWORD    0x0
    DALRULE_DISABLEPSEUDOLARGEDESKTOP    REG_DWORD    0x1
    OvlTheaterMode    REG_BINARY    00000000
    DisableOvlTheaterMode    REG_DWORD    0x0
    UseVMRPitch    REG_DWORD    0x1
    DisableMMSnifferCode    REG_DWORD    0x0
    DisableProgPCILatency    REG_DWORD    0x0
    DALRULE_GetTVFakeEDID    REG_DWORD    0x0
    Catalyst_Version    REG_SZ    0
    DALRULE_REGISTRYACCESS    REG_DWORD    0x0
    DALRULE_RESTRICTCRTANALOGDETECTIONONEDIDMISMATCH    REG_DWORD    0x0
    DALRULE_ENABLEDRIVERMODEPRUNNING    REG_DWORD    0x0
    GCORULE_ENABLETILEDMEMORYCALCULATION    REG_DWORD    0x1
    DALRULE_MACROVISIONINFOREPORT    REG_DWORD    0x0
    DALRULE_BANDWIDTHMODEENUM    REG_DWORD    0x1
    ExtEvent_LCDSetNativeModeOnResume    REG_DWORD    0x0
    DALRULE_LIMITTMDSMODES    REG_DWORD    0x0
    DALRULE_RESTRICT640x480MODE    REG_DWORD    0x0
    DALRULE_RESTRICT8BPPON2NDDRV    REG_DWORD    0x0
    TVForceDetection    REG_DWORD    0x0
    DALRULE_ADAPTERBANDWIDTHMODEENUM    REG_DWORD    0x0
    GCOOPTION_MinMemEff    REG_DWORD    0x0
    GCORULE_IncreaseMinMemEff    REG_DWORD    0x0
    DALRULE_DISABLECWDDEDETECTION    REG_DWORD    0x0
    DALRULE_SELECTION_SCHEME    REG_DWORD    0x1
    DALRULE_NOCRTANDDFPACTIVESIMULTANEOUSLY    REG_DWORD    0x0
    DisableTabletPCRotation    REG_DWORD    0x1
    ExtEvent_EnableMultiSessions    REG_DWORD    0x1
    TVEnableOverscan    REG_DWORD    0x1
    DALRULE_SETCRTANDDFPTYPESONPRIMARYCONTROLLER    REG_DWORD    0x1
    DALRULE_DYNAMICMODESUPPORT    REG_DWORD    0x1
    DALRULE_ALLOWMONITORRANGELIMITMODESCRT    REG_DWORD    0x1
    GCOOPTION_DigitalCrtInfo    REG_BINARY    A33861C1A33861B1
    DisableDirectPath    REG_DWORD    0x1
    SMOOTHVISION_NAME    REG_SZ    SMOOTHVISION
    DisableOpenGL    REG_DWORD    0x1
    3to2Pulldown_NA    REG_SZ    1
    Transcode_NA    REG_SZ    1
    DALRULE_RESTRICT2ACTIVEDISPLAYS    REG_DWORD    0x0
    CRTRULE_FORCECRTDACTYPESDETECTED    REG_DWORD    0x1
    Acceleration.Level    REG_DWORD    0x0
    Device Description    REG_SZ    ATI ES1000
    DDC2Disabled    REG_DWORD    0x0
    DisableBlockWrite    REG_DWORD    0x1
    DisableDMACopy    REG_DWORD    0x0
    TestEnv    REG_DWORD    0x0
    TimingSelection    REG_DWORD    0x0
    VgaCompatible    REG_DWORD    0x0
    Adaptive De-interlacing    REG_DWORD    0x1
    VPE Adaptive De-interlacing    REG_DWORD    0x1
    SwapEffect_NA    REG_SZ    1
    DefaultSettings.BitsPerPel    REG_DWORD    0x20
    DefaultSettings.XResolution    REG_DWORD    0x400
    DefaultSettings.YResolution    REG_DWORD    0x300
    DefaultSettings.VRefresh    REG_DWORD    0x3c
    DisableTimeStampWriteBack    REG_DWORD    0x0
    DisplaysManagerRotation_NA    REG_SZ    1
    DisableTiling    REG_DWORD    0x0
    ExtEvent_EnableHotPlug    REG_DWORD    0x0
    ExtEvent_EnableMouseRotation    REG_DWORD    0x0
    DFPRULE_HotplugSupported    REG_DWORD    0x1
    DALRULE_NOTVANDCRTONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_NOCRTANDLCDONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_DISPLAYSRESTRICTMODES    REG_DWORD    0x0
    VPURecover_NA    REG_SZ    1
    DisableSmartSave_DEF    REG_DWORD    0x1
    VPUEnableSubmissionBox_DEF    REG_SZ    0
    DALOPTION_MinResBCD    REG_BINARY    0000000000000060
    AutoColorDepthReduction_NA    REG_DWORD    0x1
    DisableD3D    REG_SZ    1
    DisableLCD    REG_DWORD    0x1
    GCORULE_HIGHDISPRI    REG_DWORD    0x1
    DisableFullAdapterInit    REG_DWORD    0x0
    DALNonStandardModesBCD1    REG_BINARY    14400900000000001280076800000000
    DALRestrictedModesBCD1    REG_BINARY    16001200000800801600120000080085160012000008008816001200000800901600120000080100160012000008012016001200000801401600120000080150
    DALRestrictedModesBCD2    REG_BINARY    16001200000801601600120000080180160012000008020016001200001600801600120000160085160012000016008816001200001600901600120000160100
    DALRestrictedModesBCD3    REG_BINARY    160012000016012016001200001601401600120000160150160012000016016016001200001601801600120000160200
    DisableDualView    REG_DWORD    0x1
    DALRULE_NOCRTANDDFPONSAMECONTROLLER    REG_DWORD    0x0
    GCORULE_IntTMDSReduceBlankTiming    REG_DWORD    0x0
    GCORULE_DISABLETMDSREDUCEDBLANKING    REG_DWORD    0x1
    TVM6Flag    REG_DWORD    0x0
    GCORule_ForceSingleController    REG_DWORD    0x1
    DALOPTION_MaxResBCD    REG_BINARY    1600120000000000
    DisableDynamicEnableMode    REG_DWORD    0x1
    DALRestrictedModesBCD    REG_BINARY    1600120000320000
    DisableDirectDraw    REG_DWORD    0x1
    DisableVideoUSWC    REG_DWORD    0x1
    WmVidMemSize    REG_DWORD    0x800000
    AntiAlias_DEF    REG_SZ    1
    AntiAliasSamples_DEF    REG_SZ    0
    FSAAPerfMode_DEF    REG_SZ    0
    AnisoDegree_DEF    REG_SZ    0
    TextureOpt_DEF    REG_SZ    0
    TextureLod_DEF    REG_SZ    0
    TruformMode_DEF    REG_SZ    0
    VSyncControl_DEF    REG_SZ    1
    SwapEffect_DEF    REG_SZ    0
    DitherAlpha_DEF    REG_SZ    0
    ExportCompressedTex_DEF    REG_SZ    1
    PixelCenter_DEF    REG_SZ    0
    ZFormats_DEF    REG_SZ    7
    ForceZBufferDepth_DEF    REG_SZ    0
    EnableTripleBuffering_DEF    REG_SZ    0
    ColourDesktopGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourDesktopBrightness_DEF    REG_SZ    0 0 0
    ColourDesktopContrast_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenBrightness_DEF    REG_SZ    0 0 0
    ColourFullscreenContrast_DEF    REG_SZ    1.0 1.0 1.0
    3D_Refresh_Rate_Override_DEF    REG_DWORD    0x0
    Display_Detection_DEF    REG_DWORD    0x0
    Panning_Mode_DEF    REG_DWORD    0x0
    Mouse_Track_Orientation_DEF    REG_DWORD    0x1
    Force_TV_Detection_DEF    REG_DWORD    0x0
    DisableEnumAllChilds    REG_DWORD    0x1
    DALRULE_NOFORCEBOOT    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device0\ATI WDM Configurations
    PnP ID Version    REG_SZ    34

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device1
    InstalledDisplayDrivers    REG_MULTI_SZ    ati2dvag
    MultiFunctionSupported    REG_DWORD    0x1
    GCOOPTION_DisableGPIOPowerSaveMode    REG_DWORD    0x1
    ReleaseVersion    REG_SZ    8.24.50.2-071025a-055776C-HP
    BuildNumber    REG_SZ    55776
    drv    REG_SZ    ati2dvag.dll
    DALGameGammaScale    REG_DWORD    0x646464
    UseNewOGLRegPath    REG_DWORD    0x1
    DALRULE_DYNAMICFIXEDDISPLAYMODEREPORTING    REG_DWORD    0x1
    GXOPPUseExclusiveExecution    REG_DWORD    0x1
    DALDefaultModeBCD    REG_BINARY    1024076800320060
    DALRULE_GETVGAEXPANSIONATBOOT    REG_DWORD    0x0
    DALRULE_ALLOWNONDDCCRTALLMODESUPTO1600x1200    REG_DWORD    0x1
    VideoOverlay_NA    REG_SZ    1
    DisableHotPlugDFP    REG_DWORD    0x1
    ExtEvent_EnableAlpsMouseOrientation    REG_DWORD    0x0
    DALRULE_DISABLEPSEUDOLARGEDESKTOP    REG_DWORD    0x1
    OvlTheaterMode    REG_BINARY    00000000
    DisableOvlTheaterMode    REG_DWORD    0x0
    UseVMRPitch    REG_DWORD    0x1
    DisableMMSnifferCode    REG_DWORD    0x0
    DisableProgPCILatency    REG_DWORD    0x0
    DALRULE_GetTVFakeEDID    REG_DWORD    0x0
    Catalyst_Version    REG_SZ    0
    DALRULE_REGISTRYACCESS    REG_DWORD    0x0
    DALRULE_RESTRICTCRTANALOGDETECTIONONEDIDMISMATCH    REG_DWORD    0x0
    DALRULE_ENABLEDRIVERMODEPRUNNING    REG_DWORD    0x0
    GCORULE_ENABLETILEDMEMORYCALCULATION    REG_DWORD    0x1
    DALRULE_MACROVISIONINFOREPORT    REG_DWORD    0x0
    DALRULE_BANDWIDTHMODEENUM    REG_DWORD    0x1
    ExtEvent_LCDSetNativeModeOnResume    REG_DWORD    0x0
    DALRULE_LIMITTMDSMODES    REG_DWORD    0x0
    DALRULE_RESTRICT640x480MODE    REG_DWORD    0x0
    DALRULE_RESTRICT8BPPON2NDDRV    REG_DWORD    0x0
    TVForceDetection    REG_DWORD    0x0
    DALRULE_ADAPTERBANDWIDTHMODEENUM    REG_DWORD    0x0
    GCOOPTION_MinMemEff    REG_DWORD    0x0
    GCORULE_IncreaseMinMemEff    REG_DWORD    0x0
    DALRULE_DISABLECWDDEDETECTION    REG_DWORD    0x0
    DALRULE_SELECTION_SCHEME    REG_DWORD    0x1
    DALRULE_NOCRTANDDFPACTIVESIMULTANEOUSLY    REG_DWORD    0x0
    DisableTabletPCRotation    REG_DWORD    0x1
    ExtEvent_EnableMultiSessions    REG_DWORD    0x1
    TVEnableOverscan    REG_DWORD    0x1
    DALRULE_SETCRTANDDFPTYPESONPRIMARYCONTROLLER    REG_DWORD    0x1
    DALRULE_DYNAMICMODESUPPORT    REG_DWORD    0x1
    DALRULE_ALLOWMONITORRANGELIMITMODESCRT    REG_DWORD    0x1
    GCOOPTION_DigitalCrtInfo    REG_BINARY    A33861C1A33861B1
    DisableDirectPath    REG_DWORD    0x1
    SMOOTHVISION_NAME    REG_SZ    SMOOTHVISION
    DisableOpenGL    REG_DWORD    0x1
    3to2Pulldown_NA    REG_SZ    1
    Transcode_NA    REG_SZ    1
    DALRULE_RESTRICT2ACTIVEDISPLAYS    REG_DWORD    0x0
    CRTRULE_FORCECRTDACTYPESDETECTED    REG_DWORD    0x1
    Acceleration.Level    REG_DWORD    0x0
    Device Description    REG_SZ    ATI ES1000
    DDC2Disabled    REG_DWORD    0x0
    DisableBlockWrite    REG_DWORD    0x1
    DisableDMACopy    REG_DWORD    0x0
    TestEnv    REG_DWORD    0x0
    TimingSelection    REG_DWORD    0x0
    VgaCompatible    REG_DWORD    0x0
    Adaptive De-interlacing    REG_DWORD    0x1
    VPE Adaptive De-interlacing    REG_DWORD    0x1
    SwapEffect_NA    REG_SZ    1
    DefaultSettings.BitsPerPel    REG_DWORD    0x20
    DefaultSettings.XResolution    REG_DWORD    0x400
    DefaultSettings.YResolution    REG_DWORD    0x300
    DefaultSettings.VRefresh    REG_DWORD    0x3c
    DisableTimeStampWriteBack    REG_DWORD    0x0
    DisplaysManagerRotation_NA    REG_SZ    1
    DisableTiling    REG_DWORD    0x0
    ExtEvent_EnableHotPlug    REG_DWORD    0x0
    ExtEvent_EnableMouseRotation    REG_DWORD    0x0
    DFPRULE_HotplugSupported    REG_DWORD    0x1
    DALRULE_NOTVANDCRTONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_NOCRTANDLCDONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_DISPLAYSRESTRICTMODES    REG_DWORD    0x0
    VPURecover_NA    REG_SZ    1
    DisableSmartSave_DEF    REG_DWORD    0x1
    VPUEnableSubmissionBox_DEF    REG_SZ    0
    DALOPTION_MinResBCD    REG_BINARY    0000000000000060
    AutoColorDepthReduction_NA    REG_DWORD    0x1
    DisableD3D    REG_SZ    1
    DisableLCD    REG_DWORD    0x1
    GCORULE_HIGHDISPRI    REG_DWORD    0x1
    DisableFullAdapterInit    REG_DWORD    0x0
    DALNonStandardModesBCD1    REG_BINARY    14400900000000001280076800000000
    DALRestrictedModesBCD1    REG_BINARY    16001200000800801600120000080085160012000008008816001200000800901600120000080100160012000008012016001200000801401600120000080150
    DALRestrictedModesBCD2    REG_BINARY    16001200000801601600120000080180160012000008020016001200001600801600120000160085160012000016008816001200001600901600120000160100
    DALRestrictedModesBCD3    REG_BINARY    160012000016012016001200001601401600120000160150160012000016016016001200001601801600120000160200
    DisableDualView    REG_DWORD    0x0
    DALRULE_NOCRTANDDFPONSAMECONTROLLER    REG_DWORD    0x0
    GCORULE_IntTMDSReduceBlankTiming    REG_DWORD    0x0
    GCORULE_DISABLETMDSREDUCEDBLANKING    REG_DWORD    0x1
    TVM6Flag    REG_DWORD    0x0
    DALOPTION_MaxResBCD    REG_BINARY    1600120000000000
    DisableDynamicEnableMode    REG_DWORD    0x1
    DALRestrictedModesBCD    REG_BINARY    1600120000320000
    DisableDirectDraw    REG_DWORD    0x1
    AntiAlias_DEF    REG_SZ    1
    AntiAliasSamples_DEF    REG_SZ    0
    FSAAPerfMode_DEF    REG_SZ    0
    AnisoDegree_DEF    REG_SZ    0
    TextureOpt_DEF    REG_SZ    0
    TextureLod_DEF    REG_SZ    0
    TruformMode_DEF    REG_SZ    0
    VSyncControl_DEF    REG_SZ    1
    SwapEffect_DEF    REG_SZ    0
    DitherAlpha_DEF    REG_SZ    0
    ExportCompressedTex_DEF    REG_SZ    1
    PixelCenter_DEF    REG_SZ    0
    ZFormats_DEF    REG_SZ    7
    ForceZBufferDepth_DEF    REG_SZ    0
    EnableTripleBuffering_DEF    REG_SZ    0
    ColourDesktopGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourDesktopBrightness_DEF    REG_SZ    0 0 0
    ColourDesktopContrast_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenBrightness_DEF    REG_SZ    0 0 0
    ColourFullscreenContrast_DEF    REG_SZ    1.0 1.0 1.0
    3D_Refresh_Rate_Override_DEF    REG_DWORD    0x0
    Display_Detection_DEF    REG_DWORD    0x0
    Panning_Mode_DEF    REG_DWORD    0x0
    Mouse_Track_Orientation_DEF    REG_DWORD    0x1
    Force_TV_Detection_DEF    REG_DWORD    0x0
    DisableEnumAllChilds    REG_DWORD    0x1
    DALRULE_NOFORCEBOOT    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device1\ATI WDM Configurations
    PnP ID Version    REG_SZ    34

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device2
    InstalledDisplayDrivers    REG_MULTI_SZ    ati2dvag
    MultiFunctionSupported    REG_DWORD    0x1
    GCOOPTION_DisableGPIOPowerSaveMode    REG_DWORD    0x1
    ReleaseVersion    REG_SZ    8.24.50.2-071025a-055776C-HP
    BuildNumber    REG_SZ    55776
    drv    REG_SZ    ati2dvag.dll
    DALGameGammaScale    REG_DWORD    0x646464
    UseNewOGLRegPath    REG_DWORD    0x1
    DALRULE_DYNAMICFIXEDDISPLAYMODEREPORTING    REG_DWORD    0x1
    GXOPPUseExclusiveExecution    REG_DWORD    0x1
    DALDefaultModeBCD    REG_BINARY    1024076800320060
    DALRULE_GETVGAEXPANSIONATBOOT    REG_DWORD    0x0
    DALRULE_ALLOWNONDDCCRTALLMODESUPTO1600x1200    REG_DWORD    0x1
    VideoOverlay_NA    REG_SZ    1
    DisableHotPlugDFP    REG_DWORD    0x1
    ExtEvent_EnableAlpsMouseOrientation    REG_DWORD    0x0
    DALRULE_DISABLEPSEUDOLARGEDESKTOP    REG_DWORD    0x1
    OvlTheaterMode    REG_BINARY    00000000
    DisableOvlTheaterMode    REG_DWORD    0x0
    UseVMRPitch    REG_DWORD    0x1
    DisableMMSnifferCode    REG_DWORD    0x0
    DisableProgPCILatency    REG_DWORD    0x0
    DALRULE_GetTVFakeEDID    REG_DWORD    0x0
    Catalyst_Version    REG_SZ    0
    DALRULE_REGISTRYACCESS    REG_DWORD    0x0
    DALRULE_RESTRICTCRTANALOGDETECTIONONEDIDMISMATCH    REG_DWORD    0x0
    DALRULE_ENABLEDRIVERMODEPRUNNING    REG_DWORD    0x0
    GCORULE_ENABLETILEDMEMORYCALCULATION    REG_DWORD    0x1
    DALRULE_MACROVISIONINFOREPORT    REG_DWORD    0x0
    DALRULE_BANDWIDTHMODEENUM    REG_DWORD    0x1
    ExtEvent_LCDSetNativeModeOnResume    REG_DWORD    0x0
    DALRULE_LIMITTMDSMODES    REG_DWORD    0x0
    DALRULE_RESTRICT640x480MODE    REG_DWORD    0x0
    DALRULE_RESTRICT8BPPON2NDDRV    REG_DWORD    0x0
    TVForceDetection    REG_DWORD    0x0
    DALRULE_ADAPTERBANDWIDTHMODEENUM    REG_DWORD    0x0
    GCOOPTION_MinMemEff    REG_DWORD    0x0
    GCORULE_IncreaseMinMemEff    REG_DWORD    0x0
    DALRULE_DISABLECWDDEDETECTION    REG_DWORD    0x0
    DALRULE_SELECTION_SCHEME    REG_DWORD    0x1
    DALRULE_NOCRTANDDFPACTIVESIMULTANEOUSLY    REG_DWORD    0x0
    DisableTabletPCRotation    REG_DWORD    0x1
    ExtEvent_EnableMultiSessions    REG_DWORD    0x1
    TVEnableOverscan    REG_DWORD    0x1
    DALRULE_SETCRTANDDFPTYPESONPRIMARYCONTROLLER    REG_DWORD    0x1
    DALRULE_DYNAMICMODESUPPORT    REG_DWORD    0x1
    DALRULE_ALLOWMONITORRANGELIMITMODESCRT    REG_DWORD    0x1
    GCOOPTION_DigitalCrtInfo    REG_BINARY    A33861C1A33861B1
    DisableDirectPath    REG_DWORD    0x1
    SMOOTHVISION_NAME    REG_SZ    SMOOTHVISION
    DisableOpenGL    REG_DWORD    0x1
    3to2Pulldown_NA    REG_SZ    1
    Transcode_NA    REG_SZ    1
    DALRULE_RESTRICT2ACTIVEDISPLAYS    REG_DWORD    0x0
    CRTRULE_FORCECRTDACTYPESDETECTED    REG_DWORD    0x1
    Acceleration.Level    REG_DWORD    0x0
    Device Description    REG_SZ    ATI ES1000
    DDC2Disabled    REG_DWORD    0x0
    DisableBlockWrite    REG_DWORD    0x1
    DisableDMACopy    REG_DWORD    0x0
    TestEnv    REG_DWORD    0x0
    TimingSelection    REG_DWORD    0x0
    VgaCompatible    REG_DWORD    0x0
    Adaptive De-interlacing    REG_DWORD    0x1
    VPE Adaptive De-interlacing    REG_DWORD    0x1
    SwapEffect_NA    REG_SZ    1
    DefaultSettings.BitsPerPel    REG_DWORD    0x20
    DefaultSettings.XResolution    REG_DWORD    0x400
    DefaultSettings.YResolution    REG_DWORD    0x300
    DefaultSettings.VRefresh    REG_DWORD    0x3c
    DisableTimeStampWriteBack    REG_DWORD    0x0
    DisplaysManagerRotation_NA    REG_SZ    1
    DisableTiling    REG_DWORD    0x0
    ExtEvent_EnableHotPlug    REG_DWORD    0x0
    ExtEvent_EnableMouseRotation    REG_DWORD    0x0
    DFPRULE_HotplugSupported    REG_DWORD    0x1
    DALRULE_NOTVANDCRTONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_NOCRTANDLCDONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_DISPLAYSRESTRICTMODES    REG_DWORD    0x0
    VPURecover_NA    REG_SZ    1
    DisableSmartSave_DEF    REG_DWORD    0x1
    VPUEnableSubmissionBox_DEF    REG_SZ    0
    DALOPTION_MinResBCD    REG_BINARY    0000000000000060
    AutoColorDepthReduction_NA    REG_DWORD    0x1
    DisableD3D    REG_SZ    1
    DisableLCD    REG_DWORD    0x1
    GCORULE_HIGHDISPRI    REG_DWORD    0x1
    DisableFullAdapterInit    REG_DWORD    0x0
    DALNonStandardModesBCD1    REG_BINARY    14400900000000001280076800000000
    DALRestrictedModesBCD1    REG_BINARY    16001200000800801600120000080085160012000008008816001200000800901600120000080100160012000008012016001200000801401600120000080150
    DALRestrictedModesBCD2    REG_BINARY    16001200000801601600120000080180160012000008020016001200001600801600120000160085160012000016008816001200001600901600120000160100
    DALRestrictedModesBCD3    REG_BINARY    160012000016012016001200001601401600120000160150160012000016016016001200001601801600120000160200
    DisableDualView    REG_DWORD    0x0
    DALRULE_NOCRTANDDFPONSAMECONTROLLER    REG_DWORD    0x0
    GCORULE_IntTMDSReduceBlankTiming    REG_DWORD    0x0
    GCORULE_DISABLETMDSREDUCEDBLANKING    REG_DWORD    0x1
    TVM6Flag    REG_DWORD    0x0
    DALOPTION_MaxResBCD    REG_BINARY    1600120000000000
    DisableDynamicEnableMode    REG_DWORD    0x1
    DALRestrictedModesBCD    REG_BINARY    1600120000320000
    DisableDirectDraw    REG_DWORD    0x1
    AntiAlias_DEF    REG_SZ    1
    AntiAliasSamples_DEF    REG_SZ    0
    FSAAPerfMode_DEF    REG_SZ    0
    AnisoDegree_DEF    REG_SZ    0
    TextureOpt_DEF    REG_SZ    0
    TextureLod_DEF    REG_SZ    0
    TruformMode_DEF    REG_SZ    0
    VSyncControl_DEF    REG_SZ    1
    SwapEffect_DEF    REG_SZ    0
    DitherAlpha_DEF    REG_SZ    0
    ExportCompressedTex_DEF    REG_SZ    1
    PixelCenter_DEF    REG_SZ    0
    ZFormats_DEF    REG_SZ    7
    ForceZBufferDepth_DEF    REG_SZ    0
    EnableTripleBuffering_DEF    REG_SZ    0
    ColourDesktopGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourDesktopBrightness_DEF    REG_SZ    0 0 0
    ColourDesktopContrast_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenBrightness_DEF    REG_SZ    0 0 0
    ColourFullscreenContrast_DEF    REG_SZ    1.0 1.0 1.0
    3D_Refresh_Rate_Override_DEF    REG_DWORD    0x0
    Display_Detection_DEF    REG_DWORD    0x0
    Panning_Mode_DEF    REG_DWORD    0x0
    Mouse_Track_Orientation_DEF    REG_DWORD    0x1
    Force_TV_Detection_DEF    REG_DWORD    0x0
    DisableEnumAllChilds    REG_DWORD    0x1
    DALRULE_NOFORCEBOOT    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device2\ATI WDM Configurations
    PnP ID Version    REG_SZ    34

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device3
    InstalledDisplayDrivers    REG_MULTI_SZ    ati2dvag
    MultiFunctionSupported    REG_DWORD    0x1
    GCOOPTION_DisableGPIOPowerSaveMode    REG_DWORD    0x1
    ReleaseVersion    REG_SZ    8.24.50.2-071025a-055776C-HP
    BuildNumber    REG_SZ    55776
    drv    REG_SZ    ati2dvag.dll
    DALGameGammaScale    REG_DWORD    0x646464
    UseNewOGLRegPath    REG_DWORD    0x1
    DALRULE_DYNAMICFIXEDDISPLAYMODEREPORTING    REG_DWORD    0x1
    GXOPPUseExclusiveExecution    REG_DWORD    0x1
    DALDefaultModeBCD    REG_BINARY    1024076800320060
    DALRULE_GETVGAEXPANSIONATBOOT    REG_DWORD    0x0
    DALRULE_ALLOWNONDDCCRTALLMODESUPTO1600x1200    REG_DWORD    0x1
    VideoOverlay_NA    REG_SZ    1
    DisableHotPlugDFP    REG_DWORD    0x1
    ExtEvent_EnableAlpsMouseOrientation    REG_DWORD    0x0
    DALRULE_DISABLEPSEUDOLARGEDESKTOP    REG_DWORD    0x1
    OvlTheaterMode    REG_BINARY    00000000
    DisableOvlTheaterMode    REG_DWORD    0x0
    UseVMRPitch    REG_DWORD    0x1
    DisableMMSnifferCode    REG_DWORD    0x0
    DisableProgPCILatency    REG_DWORD    0x0
    DALRULE_GetTVFakeEDID    REG_DWORD    0x0
    Catalyst_Version    REG_SZ    0
    DALRULE_REGISTRYACCESS    REG_DWORD    0x0
    DALRULE_RESTRICTCRTANALOGDETECTIONONEDIDMISMATCH    REG_DWORD    0x0
    DALRULE_ENABLEDRIVERMODEPRUNNING    REG_DWORD    0x0
    GCORULE_ENABLETILEDMEMORYCALCULATION    REG_DWORD    0x1
    DALRULE_MACROVISIONINFOREPORT    REG_DWORD    0x0
    DALRULE_BANDWIDTHMODEENUM    REG_DWORD    0x1
    ExtEvent_LCDSetNativeModeOnResume    REG_DWORD    0x0
    DALRULE_LIMITTMDSMODES    REG_DWORD    0x0
    DALRULE_RESTRICT640x480MODE    REG_DWORD    0x0
    DALRULE_RESTRICT8BPPON2NDDRV    REG_DWORD    0x0
    TVForceDetection    REG_DWORD    0x0
    DALRULE_ADAPTERBANDWIDTHMODEENUM    REG_DWORD    0x0
    GCOOPTION_MinMemEff    REG_DWORD    0x0
    GCORULE_IncreaseMinMemEff    REG_DWORD    0x0
    DALRULE_DISABLECWDDEDETECTION    REG_DWORD    0x0
    DALRULE_SELECTION_SCHEME    REG_DWORD    0x1
    DALRULE_NOCRTANDDFPACTIVESIMULTANEOUSLY    REG_DWORD    0x0
    DisableTabletPCRotation    REG_DWORD    0x1
    ExtEvent_EnableMultiSessions    REG_DWORD    0x1
    TVEnableOverscan    REG_DWORD    0x1
    DALRULE_SETCRTANDDFPTYPESONPRIMARYCONTROLLER    REG_DWORD    0x1
    DALRULE_DYNAMICMODESUPPORT    REG_DWORD    0x1
    DALRULE_ALLOWMONITORRANGELIMITMODESCRT    REG_DWORD    0x1
    GCOOPTION_DigitalCrtInfo    REG_BINARY    A33861C1A33861B1
    DisableDirectPath    REG_DWORD    0x1
    SMOOTHVISION_NAME    REG_SZ    SMOOTHVISION
    DisableOpenGL    REG_DWORD    0x1
    3to2Pulldown_NA    REG_SZ    1
    Transcode_NA    REG_SZ    1
    DALRULE_RESTRICT2ACTIVEDISPLAYS    REG_DWORD    0x0
    CRTRULE_FORCECRTDACTYPESDETECTED    REG_DWORD    0x1
    Acceleration.Level    REG_DWORD    0x0
    Device Description    REG_SZ    ATI ES1000
    DDC2Disabled    REG_DWORD    0x0
    DisableBlockWrite    REG_DWORD    0x1
    DisableDMACopy    REG_DWORD    0x0
    TestEnv    REG_DWORD    0x0
    TimingSelection    REG_DWORD    0x0
    VgaCompatible    REG_DWORD    0x0
    Adaptive De-interlacing    REG_DWORD    0x1
    VPE Adaptive De-interlacing    REG_DWORD    0x1
    SwapEffect_NA    REG_SZ    1
    DefaultSettings.BitsPerPel    REG_DWORD    0x20
    DefaultSettings.XResolution    REG_DWORD    0x400
    DefaultSettings.YResolution    REG_DWORD    0x300
    DefaultSettings.VRefresh    REG_DWORD    0x3c
    DisableTimeStampWriteBack    REG_DWORD    0x0
    DisplaysManagerRotation_NA    REG_SZ    1
    DisableTiling    REG_DWORD    0x0
    ExtEvent_EnableHotPlug    REG_DWORD    0x0
    ExtEvent_EnableMouseRotation    REG_DWORD    0x0
    DFPRULE_HotplugSupported    REG_DWORD    0x1
    DALRULE_NOTVANDCRTONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_NOCRTANDLCDONSAMECONTROLLER    REG_DWORD    0x0
    DALRULE_DISPLAYSRESTRICTMODES    REG_DWORD    0x0
    VPURecover_NA    REG_SZ    1
    DisableSmartSave_DEF    REG_DWORD    0x1
    VPUEnableSubmissionBox_DEF    REG_SZ    0
    DALOPTION_MinResBCD    REG_BINARY    0000000000000060
    AutoColorDepthReduction_NA    REG_DWORD    0x1
    DisableD3D    REG_SZ    1
    DisableLCD    REG_DWORD    0x1
    GCORULE_HIGHDISPRI    REG_DWORD    0x1
    DisableFullAdapterInit    REG_DWORD    0x0
    DALNonStandardModesBCD1    REG_BINARY    14400900000000001280076800000000
    DALRestrictedModesBCD1    REG_BINARY    16001200000800801600120000080085160012000008008816001200000800901600120000080100160012000008012016001200000801401600120000080150
    DALRestrictedModesBCD2    REG_BINARY    16001200000801601600120000080180160012000008020016001200001600801600120000160085160012000016008816001200001600901600120000160100
    DALRestrictedModesBCD3    REG_BINARY    160012000016012016001200001601401600120000160150160012000016016016001200001601801600120000160200
    DisableDualView    REG_DWORD    0x0
    DALRULE_NOCRTANDDFPONSAMECONTROLLER    REG_DWORD    0x0
    GCORULE_IntTMDSReduceBlankTiming    REG_DWORD    0x0
    GCORULE_DISABLETMDSREDUCEDBLANKING    REG_DWORD    0x1
    TVM6Flag    REG_DWORD    0x0
    DALOPTION_MaxResBCD    REG_BINARY    1600120000000000
    DisableDynamicEnableMode    REG_DWORD    0x1
    DALRestrictedModesBCD    REG_BINARY    1600120000320000
    DisableDirectDraw    REG_DWORD    0x1
    AntiAlias_DEF    REG_SZ    1
    AntiAliasSamples_DEF    REG_SZ    0
    FSAAPerfMode_DEF    REG_SZ    0
    AnisoDegree_DEF    REG_SZ    0
    TextureOpt_DEF    REG_SZ    0
    TextureLod_DEF    REG_SZ    0
    TruformMode_DEF    REG_SZ    0
    VSyncControl_DEF    REG_SZ    1
    SwapEffect_DEF    REG_SZ    0
    DitherAlpha_DEF    REG_SZ    0
    ExportCompressedTex_DEF    REG_SZ    1
    PixelCenter_DEF    REG_SZ    0
    ZFormats_DEF    REG_SZ    7
    ForceZBufferDepth_DEF    REG_SZ    0
    EnableTripleBuffering_DEF    REG_SZ    0
    ColourDesktopGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourDesktopBrightness_DEF    REG_SZ    0 0 0
    ColourDesktopContrast_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenGamma_DEF    REG_SZ    1.0 1.0 1.0
    ColourFullscreenBrightness_DEF    REG_SZ    0 0 0
    ColourFullscreenContrast_DEF    REG_SZ    1.0 1.0 1.0
    3D_Refresh_Rate_Override_DEF    REG_DWORD    0x0
    Display_Detection_DEF    REG_DWORD    0x0
    Panning_Mode_DEF    REG_DWORD    0x0
    Mouse_Track_Orientation_DEF    REG_DWORD    0x1
    Force_TV_Detection_DEF    REG_DWORD    0x0
    DisableEnumAllChilds    REG_DWORD    0x1
    DALRULE_NOFORCEBOOT    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Device3\ATI WDM Configurations
    PnP ID Version    REG_SZ    34

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag\Enum
    0    REG_SZ    PCI\VEN_1002&DEV_515E&SUBSYS_31FB103C&REV_02\4&21887ae&0&1848
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Atierecord
    eRecordEnable    REG_DWORD    0x1
    eRecordEnablePopups    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Atmarpc
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0xb
    ImagePath    REG_SZ    system32\DRIVERS\atmarpc.sys
    DisplayName    REG_SZ    ATM ARP Client Protocol
    Group    REG_SZ    NDIS
    DependOnService    REG_MULTI_SZ    Tcpip
    Description    REG_SZ    ATM ARP Client Protocol

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Atmarpc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv
    DependOnService    REG_MULTI_SZ    PlugPlay\0RpcSs
    Description    REG_SZ    Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Windows Audio
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    AudioGroup
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\audiosrv.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\audstub
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\audstub.sys
    DisplayName    REG_SZ    Audio Stub Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\audstub\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\audstub\Enum
    0    REG_SZ    Root\MEDIA\MS_MMACM
    Count    REG_DWORD    0x5
    NextInstance    REG_DWORD    0x5
    1    REG_SZ    Root\MEDIA\MS_MMDRV
    2    REG_SZ    Root\MEDIA\MS_MMMCI
    3    REG_SZ    Root\MEDIA\MS_MMVCD
    4    REG_SZ    Root\MEDIA\MS_MMVID

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x13
    ImagePath    REG_SZ    system32\DRIVERS\bxvbdx.sys
    DisplayName    REG_SZ    HP Virtual Bus Device
    Group    REG_SZ    base
    product_version    REG_SZ    12.4.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv\Parameters\Wdf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv\Enum
    0    REG_SZ    PCI\VEN_14E4&DEV_164A&SUBSYS_1709103C&REV_02\4&9c889e9&0&0880
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    PCI\VEN_14E4&DEV_164A&SUBSYS_1709103C&REV_02\4&9c889e9&0&1080

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BattC
    MofImagePath    REG_SZ    System32\Drivers\battc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Beep
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Base
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x2
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Beep\Enum
    0    REG_SZ    Root\LEGACY_BEEP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BGS_SDService
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\perform\Patrol3\BEST1\7.4.10\bgs\bin\BGS_SDservice.exe"
    DisplayName    REG_SZ    BGS_SDService
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    The Perform service daemon is used to start the Perform agent and collect requests. The integrated manager daemon component is used for receiving console alert and status information.
    FailureActions    REG_BINARY    A0860100000000000000000003000000530065000100000060EA00000100000060EA00000000000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BGS_SDService\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BGS_SDService\Enum
    0    REG_SZ    Root\LEGACY_BGS_SDSERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Background Intelligent Transfer Service
    DependOnService    REG_MULTI_SZ    RpcSs\0EventSystem
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Transfers data between clients and servers in the background. If BITS is disabled, features such as Windows Update will not work correctly.
    FailureActions    REG_BINARY    0000000000000000000000000300000068E30C000100000060EA00000100000060EA00000100000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\qmgr.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Computer Browser
    DependOnService    REG_MULTI_SZ    LanmanWorkstation\0LanmanServer
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters
    IsDomainMaster    REG_SZ    FALSE
    MaintainServerList    REG_SZ    Yes
    ServiceDll    REG_SZ    C:\WINNT\System32\browser.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Enum
    0    REG_SZ    Root\LEGACY_BROWSER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CA Unicenter AutoSys Remote Agent (S01)
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\autosys.S01\Autosys\bin\autosysd.exe -I S01 -a C:\apps_srv\autosys.S01\Autosys\bin\auto_remote.exe
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CA Unicenter AutoSys Remote Agent (S01)\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CA Unicenter AutoSys Remote Agent (S01)\Enum
    0    REG_SZ    Root\LEGACY_CA_UNICENTER_AUTOSYS_REMOTE_AGENT_(S01)\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CA Unicenter AutoSys Remote Command Service
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\autosys.common\bin\asrcssrv.exe -I S01
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CA Unicenter AutoSys Remote Command Service\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CA Unicenter AutoSys Remote Command Service\Enum
    0    REG_SZ    Root\LEGACY_CA_UNICENTER_AUTOSYS_REMOTE_COMMAND_SERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\casclient
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\guardium\guardium_stap\guardium_stap\cas\bin\wrapper.exe" -s "C:\Program Files\guardium\guardium_stap\guardium_stap\cas\bin\..\conf\wrapper.conf"
    DisplayName    REG_SZ    Change Audit System Client
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Change Audit System Client

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\casclient\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\casclient\Enum
    0    REG_SZ    Root\LEGACY_CASCLIENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cbidf2k
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x19
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cbidf2k\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cbidf2k\Parameters\PnpInterface
    1    REG_DWORD    0x1
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cd20xrnt
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3a
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cd20xrnt\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cd20xrnt\Parameters\PnpInterface
    1    REG_DWORD    0x11

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdfs
    DependOnGroup    REG_MULTI_SZ    SCSI CDROM Class
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    File system
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdfs\Enum
    0    REG_SZ    Root\LEGACY_CDFS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom
    DependOnGroup    REG_MULTI_SZ    SCSI miniport
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI CDROM Class
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x2
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    CD-ROM Driver
    ImagePath    REG_SZ    system32\DRIVERS\cdrom.sys
    AutoRun    REG_DWORD    0x0
    AutoRunAlwaysDisable    REG_MULTI_SZ    NEC     MBR-7   \0NEC     MBR-7.4 \0PIONEER CHANGR DRM-1804X\0PIONEER CD-ROM DRM-6324X\0PIONEER CD-ROM DRM-624X \0TORiSAN CD-ROM CDR_C36

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum
    0    REG_SZ    IDE\CdRomTSSTcorp_DVD-ROM_TS-L332A_______________HG00____\5&2270d2f8&0&0.0.0
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Changer
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Filter
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x5
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CIMnotify
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\CIMntfy\cimntfy.exe
    DisplayName    REG_SZ    HP Insight Event Notifier
    DependOnService    REG_MULTI_SZ    TcpIp
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    HP Insight Event Notifier

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CIMnotify\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cissesrv
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\HP\Cissesrv\cissesrv.exe"
    DisplayName    REG_SZ    HP Smart Array SAS/SATA Event Notification Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    The HP Smart Array SAS/SATA Event Notification Service provides event notification to the Windows system event log, HP ProLiant Integrated Management Log and HP Integrity System Event Log for systems using the HP Smart Array SAS/SATA controller driver.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cissesrv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cissesrv\Enum
    0    REG_SZ    Root\LEGACY_CISSESRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cissesrv\Logs
    ArrayControllerCount    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cissesrv\Logs\Controller001
    CurrentFiFoIndex    REG_DWORD    0x0
    EventCount    REG_DWORD    0x0
    ExternalSASControllerCount    REG_DWORD    0x0
    ScsiPortNumber    REG_DWORD    0x6
    WrapBoundary    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cissesrv\Parameters
    PollingInterval    REG_DWORD    0x1e
    MaxNumberLogEntries    REG_DWORD    0x20
    WindowsEventLoggingEnabled    REG_DWORD    0x1
    IMLLoggingEnabled    REG_DWORD    0x1
    SerialOutputBufferLogSize    REG_DWORD    0x40000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CiSvc
    DependOnService    REG_MULTI_SZ    RPCSS
    Description    REG_SZ    Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.
    DisplayName    REG_SZ    Indexing Service
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\cisvc.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CITMDRV
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    \??\C:\WINNT\System32\drivers\CITMDRV.SYS
    DisplayName    REG_SZ    CITMDRV

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CITMDRV\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CITMDRV\Enum
    0    REG_SZ    Root\LEGACY_CITMDRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv
    DependOnService    REG_MULTI_SZ    NetDDE
    Description    REG_SZ    Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    ClipBook
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\clipsrv.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv\Enum
    0    REG_SZ    Root\LEGACY_CLIPSRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    DisplayName    REG_SZ    .NET Runtime Optimization Service v2.0.50727_X86
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Microsoft .NET Framework NGEN
    FailureActions    REG_BINARY    8051010000000000000000000400000055004B000100000060EA00000100000000A60E00010000000060EA000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32\Enum
    0    REG_SZ    Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClusDisk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x7
    ImagePath    REG_SZ    system32\DRIVERS\ClusDisk.sys
    DisplayName    REG_SZ    Cluster Disk Driver
    Group    REG_SZ    Filter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClusDisk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CmdIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    DisplayName    REG_SZ    COM+ System Application
    DependOnService    REG_MULTI_SZ    rpcss\0eventsystem
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    FailureActions    REG_BINARY    1E0000000000000000000000030000005300650001000000E8030000010000008813000000000000E8030000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp\Enum
    0    REG_SZ    Root\LEGACY_COMSYSAPP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContentFilter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContentFilter\Linkage
    Bind    REG_SZ    \Dummy
    Export    REG_SZ    \Dummy
    Route    REG_SZ    \Dummy

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContentFilter\Performance
    Close    REG_SZ    DoneFILTERPerformanceData
    Collect    REG_SZ    CollectFILTERPerformanceData
    Open    REG_SZ    InitializeFILTERPerformanceData
    Library    REG_SZ    C:\WINNT\System32\query.dll
    PerfIniFile    REG_SZ    perffilt.ini
    WbemAdapFileSignature    REG_BINARY    589936DA5DB61D530F04311BC323DB44
    WbemAdapFileTime    REG_BINARY    D4DC89B95862C701
    WbemAdapFileSize    REG_DWORD    0x15dc00
    WbemAdapStatus    REG_DWORD    0x0
    Last Counter    REG_DWORD    0x24f4
    Last Help    REG_DWORD    0x24f5
    First Counter    REG_DWORD    0x24ee
    First Help    REG_DWORD    0x24ef
    Object List    REG_SZ    9454

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContentIndex

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContentIndex\Linkage
    Bind    REG_SZ    \Dummy
    Export    REG_SZ    \Dummy
    Route    REG_SZ    \Dummy

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContentIndex\Performance
    Close    REG_SZ    DoneCIPerformanceData
    Collect    REG_SZ    CollectCIPerformanceData
    Open    REG_SZ    InitializeCIPerformanceData
    Library    REG_SZ    C:\WINNT\System32\query.dll
    PerfIniFile    REG_SZ    perfci.ini
    WbemAdapFileSignature    REG_BINARY    589936DA5DB61D530F04311BC323DB44
    WbemAdapFileTime    REG_BINARY    D4DC89B95862C701
    WbemAdapFileSize    REG_DWORD    0x15dc00
    WbemAdapStatus    REG_DWORD    0x0
    Last Counter    REG_DWORD    0x24ec
    Last Help    REG_DWORD    0x24ed
    First Counter    REG_DWORD    0x24d6
    First Help    REG_DWORD    0x24d7
    Object List    REG_SZ    9430

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cpqarray
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x100
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cpqarray\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cpqarray\Parameters\PnpInterface
    2    REG_DWORD    0x1
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqarry2
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3e
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqarry2\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqarry2\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqCiDrv
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\cpqcidrv.sys
    DisplayName    REG_SZ    HP iLO Management Channel Interface Driver
    Connections    REG_DWORD    0x40
    ReservedMemorySize    REG_DWORD    0x100
    UseOnlyReservedMemory    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqCiDrv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqCiDrv\Enum
    0    REG_SZ    PCI\VEN_0E11&DEV_B204&SUBSYS_3305103C&REV_03\4&21887ae&0&2248
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqcissm
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3e
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqcissm\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqcissm\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqfcalm
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x2c
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqfcalm\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqfcalm\Parameters\PnpInterface
    2    REG_DWORD    0x1
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\CPQNiMgt\cpqnimgt.exe
    DisplayName    REG_SZ    HP Insight NIC Agents
    DependOnService    REG_MULTI_SZ    SNMP
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    HP Insight NIC Agents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt\CPQNICS
    DisplayName    REG_SZ    NIC Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt\CPQNISNMP
    DisplayName    REG_SZ    NIC SNMP Extension Agent
    Pathname    REG_SZ    C:\WINNT\system32\CpqNiMgt\CPQNIMIB.DLL
    SetsEnabled    REG_DWORD    0x1
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt\Parameters
    Debug    REG_DWORD    0x0
    SubServices    REG_MULTI_SZ    CPQNICS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt\Parameters\NICMIB
    Pathname    REG_SZ    C:\WINNT\system32\CpqNiMgt\NICMIB.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNicMgmt\Enum
    0    REG_SZ    Root\LEGACY_CPQNICMGMT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqRcmc
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\cpqrcmc.exe
    DisplayName    REG_SZ    HP ProLiant Remote Monitor Service
    DependOnService    REG_MULTI_SZ    RpcSs
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides support for the HP ProLiant Integrated Management Log Viewer.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqRcmc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqRcmc\Enum
    0    REG_SZ    Root\LEGACY_CPQRCMC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0xd
    ImagePath    REG_SZ    system32\DRIVERS\cpqteam.sys
    DisplayName    REG_SZ    HP Network Configuration Utility
    Group    REG_SZ    NDIS
    Description    REG_SZ    HP Network Configuration Utility

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam\Linkage
    Bind    REG_MULTI_SZ    \Device\{EE812484-03FC-4739-9BC2-B9D094470C3D}\0\Device\{DF7DB703-FE56-4F72-89FB-371431019CD1}
    Route    REG_MULTI_SZ    "{EE812484-03FC-4739-9BC2-B9D094470C3D}"\0"{DF7DB703-FE56-4F72-89FB-371431019CD1}"
    Export    REG_MULTI_SZ    \Device\CPQTeam_{EE812484-03FC-4739-9BC2-B9D094470C3D}\0\Device\CPQTeam_{DF7DB703-FE56-4F72-89FB-371431019CD1}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam\Parameters\Adapters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam\Parameters\Adapters\{DF7DB703-FE56-4F72-89FB-371431019CD1}
    StaticSLB    REG_DWORD    0x0
    LcdToeEnabled    REG_DWORD    0x0
    LcdRssEnabled    REG_DWORD    0x0
    Member    REG_DWORD    0x0
    TeamID    REG_DWORD    0x0
    UpperBindings    REG_MULTI_SZ    \Device\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    NICType    REG_DWORD    0xb5706
    PreferredPrimaryRanking    REG_DWORD    0x0
    AggregationGroupID    REG_DWORD    0x0
    PortCost    REG_DWORD    0x0
    OriginalBindings    REG_SZ    ms_tcpip ms_pppoe ms_ndisuio

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam\Parameters\Adapters\{EE812484-03FC-4739-9BC2-B9D094470C3D}
    StaticSLB    REG_DWORD    0x0
    LcdToeEnabled    REG_DWORD    0x0
    LcdRssEnabled    REG_DWORD    0x0
    Member    REG_DWORD    0x1
    TeamID    REG_DWORD    0x0
    UpperBindings    REG_MULTI_SZ    \Device\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    NICType    REG_DWORD    0xb5706
    PreferredPrimaryRanking    REG_DWORD    0x1
    AggregationGroupID    REG_DWORD    0x0
    PortCost    REG_DWORD    0x0
    OriginalBindings    REG_SZ    ms_tcpip ms_pppoe ms_ndisuio

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeamMP
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0xe
    ImagePath    REG_SZ    system32\DRIVERS\cpqteam.sys
    DisplayName    REG_SZ    HP Network Teaming Virtual Miniport Driver
    Group    REG_SZ    NDIS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeamMP\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeamMP\Enum
    0    REG_SZ    Root\CQ_CPQTEAMMP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqvcagent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
    DisplayName    REG_SZ    HP Version Control Agent
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Collects data and allows management of ProLiant software and firmware.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqvcagent\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqvcagent\Enum
    0    REG_SZ    Root\LEGACY_CPQVCAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\CpqMgmt\cqmghost\cqmghost.exe
    DisplayName    REG_SZ    HP Insight Foundation Agents
    DependOnService    REG_MULTI_SZ    CqMgServ\0CqMgStor\0CpqNicMgmt\0SNMP
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    HP Insight Foundation Agents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\apptrap
    Debugger    REG_SZ    drwtsn32 -p %%ld -e %%ld -g

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQCLUS
    DisplayName    REG_SZ    Clustering Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQMHOST
    DisplayName    REG_SZ    Host Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQPERF
    DisplayName    REG_SZ    Performance Monitor
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQSNMP
    DisplayName    REG_SZ    Host SNMP Extension Agent
    Pathname    REG_SZ    C:\WINNT\system32\CpqMgmt\Cqmghost\hostmib.dll
    SetsEnabled    REG_DWORD    0x1
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQSTAT
    DisplayName    REG_SZ    External Status Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQSTAT\ExternalMibs
    ExternalMib000    REG_BINARY    00000000FFFFFFFF0C000000010000000300000006000000010000000400000001000000A900000008000000010000000100000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF3200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000
    ExternalMib001    REG_BINARY    01000000FFFFFFFF0B000000010000000300000006000000010000000400000001000000E80000008D000000010000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF3200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQSWV
    DisplayName    REG_SZ    Software Version
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\CPQTHRSH
    DisplayName    REG_SZ    Threshold Support
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\HOSTALRT
    DisplayName    REG_SZ    Host Remote Alerter
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\HOSTALRT\EventDef
    EventDef000    REG_BINARY    51043544070000000100FF0000000000000000004C000000FEFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef001    REG_BINARY    52043544070000000100FF0000000000000000004E000000FEFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef002    REG_BINARY    8E043584070000000100FF0000000000000000007C000000FEFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef003    REG_BINARY    93043584070000000400FFFF000000000000000064000701FFFF00000300000000000000040000000000000000000000000000000000000000000000FF80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef004    REG_BINARY    940435C4070000000400FFFF000000000000000064000701FFFF00000400000000000000040000000000000000000000000000000000000000000000FF80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef005    REG_BINARY    8F043584070000000400FFFF000000000000000065000107FFFF00000300000000000000040000000000000000000000000000000000000000000000FF80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef006    REG_BINARY    900435C4070000000400FFFF000000000000000065000107FFFF00000400000000000000040000000000000000000000000000000000000000000000FF80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef007    REG_BINARY    91043584070000000400FFFF00000000000000007D000903FFFF00000300000000000000040000000000000000000000000000000000000000000000FF80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef008    REG_BINARY    920435C4070000000400FFFF00000000000000007D000903FFFF00000400000000000000040000000000000000000000000000000000000000000000FF80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef009    REG_BINARY    95043584070000000400FFFFFFFF00000000000086007C00FFFF0000030000000000000004004800000000000000000000000000000000000000000040800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef00A    REG_BINARY    960435C4070000000400FFFFFFFF00000000000086007C00FFFF0000040000000000000004004800000000000000000000000000000000000000000040800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef00B    REG_BINARY    97043584070000000400FFFFFFFF00000000000088006C00FFFF0000030000000000000004004400000000000000000000000000000000000000000040800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef00C    REG_BINARY    980435C4070000000400FFFFFFFF00000000000088006C00FFFF0000040000000000000004004400000000000000000000000000000000000000000040800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef00D    REG_BINARY    99043584070000000400FFFFFFFF00000000000089006800FFFF0000030000000000000004004400000000000000000000000000000000000000000040800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef00E    REG_BINARY    9A0435C4070000000400FFFFFFFF00000000000089006800FFFF0000040000000000000004004400000000000000000000000000000000000000000040800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef00F    REG_BINARY    9B043584070000000400FFFFFFFF0000000000008B003401FFFF0000030000000000000004001001000000000000000000000000000000000000000000810400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef010    REG_BINARY    9C0435C4070000000400FFFFFFFF0000000000008B003401FFFF0000040000000000000004001001000000000000000000000000000000000000000000810400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef011    REG_BINARY    9D0435C4070000000100FFFFFFFF00000000000094000000FFFFFEFF01000000000000000100000000000000000000000000000000000000000000000082FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\Linkage

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\Linkage\Disabled

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\Parameters
    Debug    REG_DWORD    0x0
    AsynchActive    REG_DWORD    0x0
    Destination    REG_SZ    
    Domain    REG_SZ    
    Password    REG_BINARY    00
    PhoneBookEntry    REG_SZ    
    PhoneNumber    REG_SZ    
    ProcMon    REG_BINARY    00
    Retry    REG_DWORD    0x1
    Username    REG_SZ    
    SubServices    REG_MULTI_SZ    CPQMHOST\0CPQPERF\0CPQSTAT\0CPQSWV\0CPQTHRSH\0HOSTALRT

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\Parameters\CPQMIB1K
    Pathname    REG_SZ    C:\WINNT\system32\CPQMgmt\CqMgHost\CPQMIB1K.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgHost\Enum
    0    REG_SZ    Root\LEGACY_CQMGHOST\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\CpqMgmt\cqmgserv\cqmgserv.exe
    DisplayName    REG_SZ    HP Insight Server Agents
    DependOnService    REG_MULTI_SZ    SNMP
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    HP Insight Server Agents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\CPQHLTH
    DisplayName    REG_SZ    System Information
    CPQBSSA    REG_SZ    C:\WINNT\system32\CpqMgmt\Cqmgserv\cpqbssa.txt
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\CPQRACK
    DisplayName    REG_SZ    Rack Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\CPQSM2
    DisplayName    REG_SZ    Remote Insight Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\CPQSNMP
    DisplayName    REG_SZ    Server SNMP Extension Agent
    Pathname    REG_SZ    C:\WINNT\system32\CpqMgmt\Cqmgserv\servmib.dll
    SetsEnabled    REG_DWORD    0x1
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\Linkage

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\Linkage\Disabled

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\Parameters
    (Default)    REG_SZ    
    Debug    REG_DWORD    0x0
    Destination    REG_SZ    
    SubServices    REG_MULTI_SZ    CPQHLTH\0SERVALRT\0CPQSM2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\SERVALRT
    DisplayName    REG_SZ    Server Remote Alerter
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\SERVALRT\EventDef
    EventDef000    REG_BINARY    2F043584070001000100FF0000000000000000002F001B01FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef001    REG_BINARY    30043584070000000100FF0000000000000000002F000801FFFF00000300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef002    REG_BINARY    3A0435C4070000000100FF00000000000000000027001100FFFF00000400000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef003    REG_BINARY    3B0435840F0000000100FF00000000000000000027001100FFFF000003000000000000000100000000000000000000000000000000000000000000000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef004    REG_BINARY    3C0435440F0000000100FF00000000000000000027001100FFFFFEFF0200000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef005    REG_BINARY    3D0435C4070000000100FF00000000000000000027001300FFFF00000400000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef006    REG_BINARY    3E043584070000000100FF00000000000000000027001300FFFF000003000000000000000100000000000000000000000000000000000000000000000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef007    REG_BINARY    3F043544070000000100FF00000000000000000027001300FFFFFEFF0200000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef008    REG_BINARY    400435C4070000000100FF00000000000000000027001200FFFF00000400000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef009    REG_BINARY    41043544070000000100FF00000000000000000027001200FFFFFEFF0200000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef00A    REG_BINARY    42043544070003000400FFFFFFFF00000000000034001500FFFFFDFF0000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef00B    REG_BINARY    43043544070000000100FF00000000000000000027001000FFFFFDFF0100000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef00C    REG_BINARY    63043584070001000100FF0000000000000000002F000F01FFFFFDFF0000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef00D    REG_BINARY    4F043584070000000100FF00000000000000000049000200FFFF00000300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef00E    REG_BINARY    54043584070000000400FFFFFFFF00000000000020003D00FFFF000001000000000000003900000000000000000000000000000000000000000000000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef00F    REG_BINARY    550435C4070000000400FFFFFFFF00000000000020001900FFFF00000300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef010    REG_BINARY    560435C4070001000400FFFFFFFF00000000000020002900FFFF000000000000000000002900000000000000000000000000000000000000000000000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef011    REG_BINARY    570435C4070000000400FFFFFFFF00000000000020005900FFFF00000300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef012    REG_BINARY    58043584070000000400FFFFFFFF00000000000020001900FFFF00000400000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef013    REG_BINARY    59043584070000000400FFFFFFFF00000000000020005D00FFFFFEFF0300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef014    REG_BINARY    5A043584070000000100FF00000000000000000004001B01FFFF0000010000000000000004001601080112011C01000000000000000000000000000004000400040004000400FFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef015    REG_BINARY    5B0435840F0000000100FF0000000000000000005A000000FFFF00000200000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef016    REG_BINARY    64043584070000000400FFFFFFFF0000000000005D000400FFFF0000030000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef017    REG_BINARY    650435C4070000000400FFFFFFFF0000000000005D009900FFFF0000040000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef018    REG_BINARY    66043584070001000100FF0000000000000000005D005E00FFFFFEFF000000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef019    REG_BINARY    67043544070000000100FF0000000000000000005D000200FFFFFEFF030000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef01A    REG_BINARY    68043584070000000100FF0000000000000000005D000200FFFFFEFF020000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef01B    REG_BINARY    69043584070000000100FF0000000000000000005E000800FFFF0000030000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef01C    REG_BINARY    6A0435C4070000000100FF0000000000000000005E000800FFFF0000040000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef01D    REG_BINARY    6B043584070001000100FF0000000000000000005E000900FFFFFEFF000000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef01E    REG_BINARY    6C043544070000000100FF0000000000000000005E000300FFFFFEFF030000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef01F    REG_BINARY    6D043584070000000100FF0000000000000000005E000300FFFFFEFF020000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef020    REG_BINARY    6E0435C4070000000100FF0000000000000000005F000B00FFFF0000040000000000000000000200000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef021    REG_BINARY    6F043584070000000100FF0000000000000000005F000B00FFFF00000300000000000000000002000C00000000000000000000000000000000000000010001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef022    REG_BINARY    70043544070000000100FF0000000000000000005F000B00FFFFFEFF020000000000000000000200000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef023    REG_BINARY    71043584070000000100FF00000000000000000060000700FFFF0000030000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef024    REG_BINARY    720435C4070000000100FF00000000000000000060000700FFFF0000040000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef025    REG_BINARY    73043584070000000100FF00000000000000000060000500FFFFFEFF020000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef026    REG_BINARY    74043584070000000100FF00000000000000000062000800FFFFFEFF030000000000000000000400000000000000000000000000000000000000000004000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef027    REG_BINARY    75043544070000000100FF00000000000000000062000800FFFFFEFF020000000000000000000400000000000000000000000000000000000000000004000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef028    REG_BINARY    000435C4070001000100FF0000000000000000002F002702FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef029    REG_BINARY    5C043584070000000400FFFFFFFF00000000000020007600FFFFFEFF0300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef02A    REG_BINARY    5D043584070000000400FFFFFFFF00000000000020007E00FFFFFEFF0300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef02B    REG_BINARY    01043584070001000400FFFFFFFF0000000000002F003C02FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef02C    REG_BINARY    5E043544070000000400FFFFFFFF0000000000005D000400FFFFFEFF020000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef02D    REG_BINARY    77043544070001000100FF00000000000000000019001400FFFF000000000000000000001500350055000400000000000000000000000000000000002080208020800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef02E    REG_BINARY    78043544070001000400FFFFFFFF0000000000001A003C00FFFF00000000000000000000A801C8010801C8004800A8004400000000000000000000002080208020802080208020800400FFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef02F    REG_BINARY    79043544070000000400FFFFFFFF0000000000001A004000FFFF00000200000000000000A801C80108014800C800A8004400000000000000000000002080208020802080208020800400FFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef030    REG_BINARY    7A043544070000000400FFFFFFFF0000000000001A004000FFFF00000300000000000000A801C80108014800C800A8004400000000000000000000002080208020802080208020800400FFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef031    REG_BINARY    7B0435C4070000000400FFFFFFFF0000000000001B001400FFFF00000400000000000000A000C000200080004000E0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef032    REG_BINARY    7C043584070000000400FFFFFFFF0000000000001B001400FFFF00000300000000000000A000C000200080004000E0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef033    REG_BINARY    7D043544070000000400FFFFFFFF0000000000001B001400FFFFFEFF0200000000000000A000C000200080004000E0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef034    REG_BINARY    7E0435C4070000000400FFFFFFFF0000000000001C001800FFFF00000400000000000000E00000012000C0004000A0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef035    REG_BINARY    7F043584070000000400FFFFFFFF0000000000001C001800FFFF00000300000000000000E00000012000C0004000A0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef036    REG_BINARY    80043544070000000400FFFFFFFF0000000000001C001800FFFFFEFF0200000000000000E00000012000C0004000A0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef037    REG_BINARY    81043584070000000400FFFFFFFF0000000000001C000C00FFFFFEFF0200000000000000E00000012000C0004000A0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef038    REG_BINARY    82043544070000000400FFFFFFFF0000000000001C000C00FFFFFEFF0300000000000000E00000012000C0004000A0001C00000000000000000000002080208020802080408020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef039    REG_BINARY    830435C4070000000400FFFFFFFF0000000000002A003801FFFF00000400000000000000F4001401540074001400D400B40034003000000000000000208020802080208004002080208020800400FFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef03A    REG_BINARY    84043584070000000400FFFFFFFF0000000000002A003801FFFF00000300000000000000F4001401540074001400D400B40034003000000000000000208020802080208004002080208020800400FFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef03B    REG_BINARY    85043544070000000400FFFFFFFF0000000000002A003801FFFF00000200000000000000F4001401540074001400D400B40034003000000000000000208020802080208004002080208020800400FFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef03C    REG_BINARY    86043584070000000400FFFFFFFF0000000000002A003401FFFF00000200000000000000F4001401540074001400D400B40034003000000000000000208020802080208004002080208020800400FFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef03D    REG_BINARY    87043544070000000400FFFFFFFF0000000000002A003401FFFF00000300000000000000F4001401540074001400D400B40034003000000000000000208020802080208004002080208020800400FFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef03E    REG_BINARY    88043584070000000400FFFFFFFF00000000000025000800FFFFFEFF02000000000000009C00BC003C007C001C00000000000000000000000000000020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef03F    REG_BINARY    89043584070001000400FFFFFFFF0000000000002A002400FFFF00000100000000000000F400140154001400D4002400B40034003000000000000000208020802080040020800400208020800400FFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef040    REG_BINARY    8A043584070001000400FFFFFFFF00000000000025002000FFFF000000000000000000009C00BC003C00DC007C001C00000000000000000000000000208020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef041    REG_BINARY    8B0435C4070001000400FFFFFFFF00000000000029003000FFFF00000000000000000000EC000C016C000C00AC00CC004800000000000000000000002080208020800400208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef042    REG_BINARY    8C0435C4070001000400FFFFFFFF00000000000029003400FFFF00000000000000000000EC000C016C000C00AC00CC004800000000000000000000002080208020800400208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef043    REG_BINARY    8D0435C4070001000400FFFFFFFF00000000000029003800FFFF00000000000000000000EC000C016C000C00AC00CC004800000000000000000000002080208020800400208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef044    REG_BINARY    8E0435C4070001000400FFFFFFFF00000000000029003C00FFFF00000000000000000000EC000C016C000C00AC00CC004800000000000000000000002080208020800400208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef045    REG_BINARY    8F0435C4070001000400FFFFFFFF00000000000029004000FFFF00000000000000000000EC000C016C000C00AC00CC004800000000000000000000002080208020800400208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef046    REG_BINARY    90043584070001000400FFFFFFFF00000000000029004400FFFF00000000000000000000EC000C016C000C00AC00CC004800000000000000000000002080208020800400208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef047    REG_BINARY    91043584070001000400FFFFFFFF0000000000001D001000FFFF000002000000000000007800980018003800B800D8001400000000000000000000002080208020804080208020800400FFFFFFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef048    REG_BINARY    92043584070000000400FFFFFFFF00000000000029001C00FFFF00000200000000000000EC000C016C004C000C00AC00CC004800000000000000000020802080208020800400208020800400FFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef049    REG_BINARY    93043544070000000400FFFFFFFF00000000000029001C00FFFFFEFF0300000000000000EC000C016C004C000C00AC00CC004800000000000000000020802080208020800400208020800400FFFFFFFFFFFFFFFF0100030000000400080000000400040004000000000000000000000000000000000000000000000000000000
    EventDef04A    REG_BINARY    94043584070000000400FFFFFFFF00000000000025000C00FFFF000002000000000000009C00BC003C007C00DC001C00000000000000000000000000208020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef04B    REG_BINARY    95043584070001000400FFFFFFFF0000000000001A00E801FFFF00000000000000000000A801C8010801C800A8004400000000000000000000000000208020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef04C    REG_BINARY    96043584070001000400FFFFFFFF00000000000025002800FFFF000000000000000000009C00BC003C007C00DC001C00000000000000000000000000208020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef04D    REG_BINARY    97043584070001000400FFFFFFFF00000000000025002C00FFFF000000000000000000009C00BC007C001C00000000000000000000000000000000002080208020800400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef04E    REG_BINARY    98043584070001000400FFFFFFFF00000000000025003000FFFF000000000000000000009C00BC003C007C00DC001C00000000000000000000000000208020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef04F    REG_BINARY    99043584070001000400FFFFFFFF00000000000025003400FFFF000000000000000000009C00BC003C007C001C00000000000000000000000000000020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef050    REG_BINARY    9A043584070001000400FFFFFFFF00000000000025003800FFFF000000000000000000009C00BC003C007C00DC001C00000000000000000000000000208020802080208020800400FFFFFFFFFFFFFFFFFFFFFFFF0100020000000400000000000400040000000000000000000000000000000000000000000000000000000000
    EventDef051    REG_BINARY    02043584070001000400FFFFFFFF0000000000002F004002FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef052    REG_BINARY    03043584070001000400FFFFFFFF0000000000002F004402FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef053    REG_BINARY    04043584070001000400FFFFFFFF0000000000002F004802FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef054    REG_BINARY    05043544070000000100FF0000000000000000005D005E00FFFFFEFF000000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef055    REG_BINARY    06043544070000000100FF0000000000000000005E000900FFFFFEFF000000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100020000000100000000000100010000000000000000000000000000000000000000000000000000000000
    EventDef056    REG_BINARY    0B043584070000000100FFFFFFFF00000000000088002F03FFFF00000300000000000000040008000C001000200114003504000000000000000000000400040004000400008104000980FFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef057    REG_BINARY    0C043544070000000100FFFFFFFF00000000000089001000FFFFFEFF0300000000000000040008000C00000000000000000000000000000000000000040004000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef058    REG_BINARY    0D043544070000000100FFFFFFFF00000000000089001000FFFFFEFF0200000000000000040008000C00000000000000000000000000000000000000040004000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef059    REG_BINARY    0E0435C4070000000100FFFFFFFF00000000000089001400FFFFFEFF0600000000000000040008000C00000000000000000000000000000000000000040004000400FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100010000000000000000000400000000000000000000000000000000000000000000000000000000000000
    EventDef05A    REG_BINARY    0F043584070001000400FFFFFFFF0000000000002F006002FFFF00000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef05B    REG_BINARY    9B043584070000000100FF00000000000000000084000000FFFFFEFF0300000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef05C    REG_BINARY    9C043504070000000100FF00000000000000000084000000FFFFFEFF01000000000000000000000000000000000000000000000000000000000000000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef05D    REG_BINARY    9D043584070000000100FF00000000000000000084000000FFFFFEFF02000000000000000000000000000000000000000000000000000000000000000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef05E    REG_BINARY    9E043544070000000100FF0000000000000000008500A000FFFFFEFF020000000000000000002000000000000000000000000000000000000000000020808080FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef05F    REG_BINARY    9F043544070000000100FF0000000000000000008500A000FFFFFEFF030000000000000000002000000000000000000000000000000000000000000020808080FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    EventDef060    REG_BINARY    A00435C4070000000400FFFFFFFF0000000000005D009900FFFF0000630000000000000000000100000000000000000000000000000000000000000001000100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000020000000100000000000100010000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgServ\Enum
    0    REG_SZ    Root\LEGACY_CQMGSERV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\CpqMgmt\cqmgstor\cqmgstor.exe
    DisplayName    REG_SZ    HP Insight Storage Agents
    DependOnService    REG_MULTI_SZ    SNMP
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    HP Insight Storage Agents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQFCA
    DisplayName    REG_SZ    Fibre Array Information
    DisableFlags    REG_DWORD    0x0
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQIDE
    DisplayName    REG_SZ    IDE Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQISCSI
    DisplayName    REG_SZ    iSCSI Information
    Pathname    REG_SZ    C:\WINNT\system32\CpqMgmt\CqmgStor\iscsimib.dll
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQMIDA
    DisplayName    REG_SZ    Drive Array Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQMSCSI
    DisplayName    REG_SZ    SCSI Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQSAS
    DisplayName    REG_SZ    SAS Information
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\CPQSNMP
    DisplayName    REG_SZ    Storage SNMP Extension Agent
    Pathname    REG_SZ    C:\WINNT\system32\CpqMgmt\Cqmgstor\stormib.dll
    SetsEnabled    REG_DWORD    0x1
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\Parameters
    Debug    REG_DWORD    0x0
    SubServices    REG_MULTI_SZ    CPQIDE\0CPQMSCSI\0CPQMIDA\0CPQFCA\0CPQISCSI\0STORALRT\0CPQSAS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\STORALRT
    DisplayName    REG_SZ    Storage Remote Alerter
    Timeout    REG_DWORD    0x36ee80

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\STORALRT\EventDef
    EventDef000    REG_BINARY    B3043584070001000100FF0000000000000000001C004B00FFFF000001000000000000001801E2004900E500808001000100298001000200980101000000000004000100000000000000000000000000000000000000000000000000000000000000
    EventDef001    REG_BINARY    B0043584070001000100FF0000000000000000001A000300FFFFFFFF02000000000000008202010003000000808001000100FFFF01000200020301000000000004000100000000000000000000000000000000000000000000000000000000007D01
    EventDef002    REG_BINARY    C1043584070001000100FF0000000000000000001B000200FFFFFFFF0400000000000000100098000000000080804080FFFFFFFF01000200900001000000000004000100000000000000000000000000000000000000000000000000000000000F00
    EventDef003    REG_BINARY    C0043584070001000100FF0000000000000000001C004A00FFFFFFFF02000000000000001801A8019D01E500808040800100298001000200980101000000000004000100000000000000000000000000000000000000000000000000000000004D00
    EventDef004    REG_BINARY    B4043584070001000100FF00000000000000000019000100FFFFFFFF030000000000000048000000000000008080FFFFFFFFFFFF01000100440000000000000004000000000000000000000000000000000000000000000000000000000000004200
    EventDef005    REG_BINARY    B5043584070000000100FF00000000000000000019000400FFFF0000030000000000000048000000000000008080FFFFFFFFFFFF01000100440000000000000004000000000000000000000000000000000000000000000000000000000000000000
    EventDef006    REG_BINARY    B6043584070000000100FF00000000000000000019000A00FFFF0000040000000000000048000000000000008080FFFFFFFFFFFF01000100440000000000000004000000000000000000000000000000000000000000000000000000000000000000
    EventDef007    REG_BINARY    2C0435C4070001000100FF00000000000000000029000400FFFFFFFF020000000000000003003C000000000001000100FFFFFFFF010002009D003C000000000004000100000000000000000000000000000000000000000000000000000000003D00
    EventDef008    REG_BINARY    2E0435C40F0001000100FF0000000000000000002C002700FFFFFFFF0200000000000000C200840002000000010001000100FFFF01000300BE0084000200000004000100010000000000000000000000000000000000000000000000000000006800
    EventDef009    REG_BINARY    C2043584070001000100FF0000000000000000002E004700FFFFFFFF02000000000000005000E0001C0003008080408009801180010002004C0001000000000004000100000000000000000000000000000000000000000000000000000000004800
    EventDef00A    REG_BINARY    C3043584070001000100FF0000000000000000002E004900FFFFFFFF02000000000000005000E0001C0003008080408009801180010002004C0001000000000004000100000000000000000000000000000000000000000000000000000000004A00
    EventDef00B    REG_BINARY    A3043584070001000100FF00000000000000000089000300FFFFFFFF02000000000000000600220001000000010051800100FFFF01000200000001000000000001000100000000000000000000000000000000000000000000000000000000000400
    EventDef00C    REG_BINARY    AC043584070001000100FF0000000000000000007000C200FFFFFFFF00000000000000002400C3000000000020800100FFFFFFFF0100010000000000000000000200000000000000000000000000000000000000000000000000000000000000C500
    EventDef00D    REG_BINARY    4A043544000000000100FF0000000000000000001C004C00FFFF000001000000000000001801A8019D01E500808040800100298001000200980101000000000004000100000000000000000000000000000000000000000000000000000000000000
    EventDef00E    REG_BINARY    4D043584070000000100FF0000000000000000002E002800FFFF00000300000000000000500001001C0003008080010009801180010002004C0001000000000004000100000000000000000000000000000000000000000000000000000000000000
    EventDef00F    REG_BINARY    4E043544070000000100FF0000000000000000002E002800FFFFFEFF0200000000000000500001001C0003008080010009801180010002004C0001000000000004000100000000000000000000000000000000000000000000000000000000000000
    EventDef010    REG_BINARY    C4043584070001000100FF0000000000000000002E004B00FFFFFFFF02000000000000005000E0001C0003008080408009801180010002004C000100000000000400010000000000000000000000000000000000000000000000000000000000D000
    EventDef011    REG_BINARY    A8043584070001000100FF0000000000000000004F00C600FFFFFFFF020000000000000086013C000200030001000100010001000100040082013C00020003000400010001000100000000000000000000000000000000000000000000000000CA00
    EventDef012    REG_BINARY    5F043584070000000100FF0000000000000000004F003900FFFF0000020000000000000086013C000200030001000100010001000100040082013C000200030004000100010001000000000000000000000000000000000000000000000000000000
    EventDef013    REG_BINARY    60043584070000000100FF0000000000000000004F003A00FFFF0000020000000000000086013C000200030001000100010001000100040082013C000200030004000100010001000000000000000000000000000000000000000000000000000000
    EventDef014    REG_BINARY    A2043584070001000100FF00000000000000000087004900FFFFFFFF02000000000000000000010002003400010001002980158001000200000001000000000001000100000000000000000000000000000000000000000000000000000000004A00
    EventDef015    REG_BINARY    790435C4070001000100FF0000000000000000006B005700FFFFFFFF00000000000000001000B60158000000208002000100FFFF010002000000B6010000000002000200000000000000000000000000000000000000000000000000000000000700
    EventDef016    REG_BINARY    7B0435C4070001000100FF0000000000000000006C002D00FFFFFFFF0000000000000000080007002C002E00208001000100010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000000600
    EventDef017    REG_BINARY    7A0435C4070001000100FF0000000000000000006D00E900FFFFFFFF0000000000000000C5003E003500EA00208001000100010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000003B00
    EventDef018    REG_BINARY    7C0435C4070001000100FF0000000000000000006A005C00FFFFFFFF0000000000000000380002005D000000208001000100FFFF01000200000002000000000002000100000000000000000000000000000000000000000000000000000000006500
    EventDef019    REG_BINARY    7D0435C4070000000100FF0000000000000000006A000400FFFF00000300000000000000380002005D000000208001000100FFFF01000200000002000000000002000100000000000000000000000000000000000000000000000000000000000000
    EventDef01A    REG_BINARY    7E0435C4070000000100FF0000000000000000006A000600FFFF00000400000000000000380002005D000000208001000100FFFF01000200000002000000000002000100000000000000000000000000000000000000000000000000000000000000
    EventDef01B    REG_BINARY    7F0435C4070001000100FF00000000000000000069000D00FFFFFFFF0000000000000000400002000E000000208001000100FFFF01000200000002000000000002000100000000000000000000000000000000000000000000000000000000006900
    EventDef01C    REG_BINARY    80043584070001000100FF00000000000000000073004A00FFFFFFFF0000000000000000240049004B000000208001000100FFFF01000200000002000000000002000100000000000000000000000000000000000000000000000000000000004800
    EventDef01D    REG_BINARY    81043584070001000100FF00000000000000000072004900FFFFFFFF0000000000000000240003004A004D00208001000100010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000004800
    EventDef01E    REG_BINARY    82043584070001000100FF00000000000000000072004C00FFFFFFFF0000000000000000240003004A004D00208001000100010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000000000
    EventDef01F    REG_BINARY    83043584070001000100FF00000000000000000074002D00FFFFFFFF0000000000000000080005002E000600208001000100010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000000400
    EventDef020    REG_BINARY    A7043584070001000100FF0000000000000000005C007202FFFFFFFF0200000000000000AF04E2000200E3000100010001000100010004007702E2000200030004000100010001000000000000000000000000000000000000000000000000000400
    EventDef021    REG_BINARY    87043584070000000100FF0000000000000000005C000600FFFF00000300000000000000AF04E2000200E3000100010001000100010004007702E2000200030004000100010001000000000000000000000000000000000000000000000000000000
    EventDef022    REG_BINARY    88043584070000000100FF0000000000000000005C000600FFFFFEFF0200000000000000AF04E2000200E3000100010001000100010004007702E2000200030004000100010001000000000000000000000000000000000000000000000000000000
    EventDef023    REG_BINARY    890435C4070001000100FF00000000000000000079000500FFFFFFFF020000000000000081000100020005000100010001000100010004007D0001000200030004000100010001000000000000000000000000000000000000000000000000000400
    EventDef024    REG_BINARY    AF043584070001000100FF00000000000000000018001200FFFFFFFF02000000000000000800120010004800010001000100808001000100C80000000000000004000000000000000000000000000000000000000000000000000000000000004400
    EventDef025    REG_BINARY    8D043584070000000100FF00000000000000000018001100FFFFFEFF03000000000000000800120010004800010001000100808001000100C80000000000000004000000000000000000000000000000000000000000000000000000000000000000
    EventDef026    REG_BINARY    95043584070001000100FF0000000000000000007E000200FFFFFFFF0000000000000000070003000000000011800100FFFFFFFF01000100000000000000000002000000000000000000000000000000000000000000000000000000000000000500
    EventDef027    REG_BINARY    AD043584070001000100FF0000000000000000007F00D000FFFFFFFF0000000000000000440102000300D10081800100010001000100040000000200030004000200010001000100000000000000000000000000000000000000000000000000C801
    EventDef028    REG_BINARY    AE043584070001000100FF0000000000000000007F00D300FFFFFFFF0000000000000000440102000300D40081800100010001000100040000000200030004000200010001000100000000000000000000000000000000000000000000000000C901
    EventDef029    REG_BINARY    A9043584070001000100FF0000000000000000008000D200FFFFFFFF0000000000000000F00002000300D300818001000100010001000400000002000300040002000100010001000000000000000000000000000000000000000000000000007501
    EventDef02A    REG_BINARY    AA043584070000000100FF0000000000000000008000D500FFFF00000200000000000000F00002000300D300818001000100010001000400000002000300040002000100010001000000000000000000000000000000000000000000000000000000
    EventDef02B    REG_BINARY    AB043584070000000100FF0000000000000000008000DC00FFFF00000200000000000000F00002000300D300818001000100010001000400000002000300040002000100010001000000000000000000000000000000000000000000000000000000
    EventDef02C    REG_BINARY    9B043584070001000100FF00000000000000000069006600FFFFFFFF0000000000000000400002000E000000208001000100FFFF01000200000002000000000002000100000000000000000000000000000000000000000000000000000000000000
    EventDef02D    REG_BINARY    B7043584070001000100FF0000000000000000008300D900FFFFFFFF0000000000000000280101000200DA00808001000100010001000400A80101000200030004000100010001000000000000000000000000000000000000000000000000002401
    EventDef02E    REG_BINARY    B8043584070001000100FF0000000000000000008300DC00FFFFFFFF0000000000000000280101000200DD00808001000100010001000400A80101000200030004000100010001000000000000000000000000000000000000000000000000002501
    EventDef02F    REG_BINARY    B9043584070001000100FF0000000000000000008400D700FFFFFFFF0000000000000000E80001000200D80080800100010001000100040068010100020003000400010001000100000000000000000000000000000000000000000000000000E600
    EventDef030    REG_BINARY    BA043584070000000100FF0000000000000000008400DD00FFFF00000200000000000000E80001000200D800808001000100010001000400680101000200030004000100010001000000000000000000000000000000000000000000000000000000
    EventDef031    REG_BINARY    BB043584070000000100FF0000000000000000008400DF00FFFF00000200000000000000E80001000200D800808001000100010001000400680101000200030004000100010001000000000000000000000000000000000000000000000000000000
    EventDef032    REG_BINARY    BF043584070001000100FF0000000000000000006F00A400FFFFFFFF00000000000000000D01A5000000000080800100FFFFFFFF01000100000000000000000004000000000000000000000000000000000000000000000000000000000000000700
    EventDef033    REG_BINARY    A4043584070001000100FF00000000000000000037002A00FFFFFFFF00000000000000005800020019002B00208001001180010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000008100
    EventDef034    REG_BINARY    A5043584070001000100FF00000000000000000037002C00FFFFFFFF00000000000000005800020019002D00208001001180010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000008200
    EventDef035    REG_BINARY    A6043584070001000100FF00000000000000000037002E00FFFFFFFF00000000000000005800020019002F00208001001180010001000200000002000000000002000100000000000000000000000000000000000000000000000000000000008300
    EventDef036    REG_BINARY    2D0435C4070001000100FF0000000000000000002B000700FFFFFFFF02000000000000004100400005000000010001000100FFFF01000300000040000500000004000100010000000000000000000000000000000000000000000000000000000800
    EventDef037    REG_BINARY    C50435840F0001000100FF00000000000000000099001100FFFFFFFF00000000000000001B009B001E011200808051802980010001000200000004000000000004000400000000000000000000000000000000000000000000000000000000001400
    EventDef038    REG_BINARY    C60435840F0001000100FF0000000000000000009800A400FFFFFFFF000000000000000018000400A5000000808004000100FFFF01000200000004000000000004000400000000000000000000000000000000000000000000000000000000001600
    EventDef039    REG_BINARY    C70435840F0001000100FF0000000000000000009A000A00FFFFFFFF00000000000000000C008C0067010B00808051804180010001000200000004000000000004000400000000000000000000000000000000000000000000000000000000000800
    EventDef03A    REG_BINARY    C8043584070001000100FF00000000000000000018001300FFFFFFFF02000000000000004800CE000000000080802080FFFFFFFF01000100C80000000000000004000000000000000000000000000000000000000000000000000000000000001500
    EventDef03B    REG_BINARY    C9043584070001000100FF0000000000000000002E00DE00FFFFFFFF00000000000000005000E000DC0003008080408001001180010002004C0001000000000004000100000000000000000000000000000000000000000000000000000000002600

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CqMgStor\Enum
    0    REG_SZ    Root\LEGACY_CQMGSTOR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crcdisk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\crcdisk.sys
    DisplayName    REG_SZ    CRC Disk Filter Driver
    Group    REG_SZ    Pnp Filter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crcdisk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crcdisk\Enum
    0    REG_SZ    Root\LEGACY_CRCDISK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
    DependOnService    REG_MULTI_SZ    RpcSs
    Description    REG_SZ    Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Cryptographic Services
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\cryptsvc.dll
    ServiceMain    REG_SZ    CryptServiceMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Security
    Security    REG_BINARY    00000E0001

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Enum
    0    REG_SZ    Root\LEGACY_CRYPTSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac2w2k
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x20
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac2w2k\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac2w2k\Parameters\PnpInterface
    2    REG_DWORD    0x1
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac960nt
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x20
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac960nt\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac960nt\Parameters\PnpInterface
    2    REG_DWORD    0x1
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch
    Description    REG_SZ    Provides launch functionality for DCOM services.
    DisplayName    REG_SZ    DCOM Server Process Launcher
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Event Log
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k DcomLaunch
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20
    FailureActions    REG_BINARY    00000000000000000000000001000000000000000200000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\rpcss.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch\Security
    Security    REG_BINARY    01001480B4000000C00000001400000034000000020020000100000002801800FF010F00010100000000000100000000200200000200800005000000000318008D0002000101000000000001000000000000000000031800FF010F0001020000000000052000000020020000000318008F00020001020000000000052000000023020000000318009D00000001010000000000050400000023020000000318009D00000001020000000000052000000021020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch\Enum
    0    REG_SZ    Root\LEGACY_DCOMLAUNCH\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dellcerc
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x2b
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dellcerc\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dellcerc\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x10
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\Dfssvc.exe
    DisplayName    REG_SZ    Distributed File System
    Group    REG_SZ    Dfs
    DependOnService    REG_MULTI_SZ    LanmanWorkstation\0LanmanServer\0DfsDriver\0Mup\0SamSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Integrates disparate file shares into a single, logical namespace and manages these logical volumes distributed across a local or wide area network. If this service is stopped, users will be unable to access file shares. If this service is disabled, any services that explicitly depend on it will fail to start.
    DfsVersion    REG_DWORD    0x565

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs\Parameters
    CheckIfShouldRun    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs\Parameters\Replicated

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs\Enum
    0    REG_SZ    Root\LEGACY_DFS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsDriver
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\Dfs.sys
    DisplayName    REG_SZ    DfsDriver
    Group    REG_SZ    filter
    Description    REG_SZ    Integrates disparate file shares into a single, logical namespace and manages these logical volumes distributed across a local or wide area network. If this service is stopped, users will be unable to access file shares. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsDriver\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsDriver\Enum
    0    REG_SZ    Root\LEGACY_DFSDRIVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k NetworkService
    DisplayName    REG_SZ    DHCP Client
    Group    REG_SZ    TDI
    DependOnService    REG_MULTI_SZ    Tcpip\0Afd
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Configurations
    Options    REG_BINARY    32000000000000000400000000000000FFFFFF7F0000000001000000000000000400000000000000FFFFFF7F00000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Linkage

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Linkage\Disabled

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\dhcpcsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\1
    KeyType    REG_DWORD    0x7
    RegLocation    REG_MULTI_SZ    SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpSubnetMaskOpt\0SYSTEM\CurrentControlSet\Services\?\Parameters\Tcpip\DhcpSubnetMaskOpt

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15
    KeyType    REG_DWORD    0x1
    RegLocation    REG_MULTI_SZ    SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain\0SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\3
    KeyType    REG_DWORD    0x7
    RegLocation    REG_MULTI_SZ    SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDefaultGateway\0SYSTEM\CurrentControlSet\Services\?\Parameters\Tcpip\DhcpDefaultGateway

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\44
    KeyType    REG_DWORD    0x1
    RegLocation    REG_MULTI_SZ    SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_?\DhcpNameServerList\0SYSTEM\CurrentControlSet\Services\NetBT\Adapters\?\DhcpNameServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\46
    KeyType    REG_DWORD    0x4
    RegLocation    REG_SZ    SYSTEM\CurrentControlSet\Services\NetBT\Parameters\DhcpNodeType

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\47
    KeyType    REG_DWORD    0x1
    RegLocation    REG_SZ    SYSTEM\CurrentControlSet\Services\NetBT\Parameters\DhcpScopeID

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\6
    KeyType    REG_DWORD    0x1
    RegLocation    REG_MULTI_SZ    SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpNameServer\0SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\DhcpNetbiosOptions
    KeyType    REG_DWORD    0x4
    OptionId    REG_DWORD    0x1
    VendorType    REG_DWORD    0x1
    RegLocation    REG_MULTI_SZ    SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_?\DhcpNetbiosOptions

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B00000000001800FD0102000102000000000005200000002C02000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Enum
    0    REG_SZ    Root\LEGACY_DHCP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk
    DependOnGroup    REG_MULTI_SZ    SCSI miniport
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI Class
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x2
    Type    REG_DWORD    0x1
    TimeOutValue    REG_DWORD    0x3c
    DisplayName    REG_SZ    Disk Driver
    ImagePath    REG_SZ    system32\DRIVERS\disk.sys
    AutoRunAlwaysDisable    REG_MULTI_SZ    Brother RemovableDisk(U)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\Enum
    0    REG_SZ    SCSI\Disk&Ven_HP&Prod_LOGICAL_VOLUME&Rev_7.08\5&1d8810e0&0&000400
    Count    REG_DWORD    0x19
    NextInstance    REG_DWORD    0x19
    1    REG_SZ    SCSI\Disk&Ven_HP&Prod_LOGICAL_VOLUME&Rev_7.08\5&1d8810e0&0&000500
    2    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953062
    3    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953063
    4    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953064
    5    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953065
    6    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953066
    7    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953067
    8    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953068
    9    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953069
    10    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306A
    11    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306B
    12    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306C
    13    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306D
    14    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306E
    15    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306F
    16    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953070
    17    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953071
    18    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953072
    19    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953073
    20    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953074
    21    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953075
    22    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953076
    23    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\emcp&0001&0001&5_0_0_0
    24    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\emcp&0001&0001&3_0_0_0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Diskeeper
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"
    DisplayName    REG_SZ    Diskeeper
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Allows Diskeeper to run on this computer and improve file system performance.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Diskeeper\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Diskeeper\Enum
    0    REG_SZ    Root\LEGACY_DISKEEPER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin
    DependOnService    REG_MULTI_SZ    RpcSs\0PlugPlay\0DmServer
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\dmadmin.exe /com
    DisplayName    REG_SZ    Logical Disk Manager Administrative Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin\Parameters
    EnableDynamicConversionFor1394    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020078000500000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D01020001010000000000050B00000000001800FD01020001020000000000052000000023020000000018007000000001020000000000052000000027020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin\Enum
    0    REG_SZ    Root\LEGACY_DMADMIN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmboot
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Filter
    Tag    REG_DWORD    0xb
    ImagePath    REG_SZ    System32\drivers\dmboot.sys
    VolumeRecoveryNeeded    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmboot\Enum
    0    REG_SZ    Root\LEGACY_DMBOOT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmio
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Tag    REG_DWORD    0xd
    ImagePath    REG_SZ    System32\drivers\dmio.sys
    DisplayName    REG_SZ    Logical Disk Manager Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmio\Boot Info
    Boot ID    REG_SZ    35ce3042-ce12-11db-96c1-806e6f6e6963

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmio\Boot Info\Disk Group 1
    Name    REG_SZ    ukebuuasd99dg0
    ID    REG_SZ    5486f4ec-3dd4-48ed-8a28-a4531a5a7030
    DiskSetID    REG_SZ    00000000-0000-0000-0000-000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmio\Enum
    0    REG_SZ    Root\dmio\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmload
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Tag    REG_DWORD    0xc
    ImagePath    REG_SZ    System32\drivers\dmload.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmload\Enum
    0    REG_SZ    Root\LEGACY_DMLOAD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver
    DependOnService    REG_MULTI_SZ    RpcSs\0PlugPlay
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Logical Disk Manager
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\dmserver.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Enum
    0    REG_SZ    Root\LEGACY_DMSERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k NetworkService
    DisplayName    REG_SZ    DNS Client
    Group    REG_SZ    TDI
    DependOnService    REG_MULTI_SZ    Tcpip
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\dnsrslvr.dll
    DomainNameDevolutionLevel    REG_DWORD    0xffffffff

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200780005000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FD0102000102000000000005200000002C02000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Enum
    0    REG_SZ    Root\LEGACY_DNSCACHE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dpti2o
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3c
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dpti2o\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dpti2o\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DTSPipeline

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DTSPipeline\Performance
    Library    REG_SZ    C:\apps_srv\mssql\90\DTS\Binn\DTSPipelinePerf.dll
    Open    REG_SZ    PrfData_Open
    Collect    REG_SZ    PrfData_Collect
    Close    REG_SZ    PrfData_Close
    PerfIniFile    REG_SZ    perf-DTSPERF.INI
    Last Counter    REG_DWORD    0x27e0
    Last Help    REG_DWORD    0x27e1
    First Counter    REG_DWORD    0x27c8
    First Help    REG_DWORD    0x27c9
    Object List    REG_SZ    10184

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxcna

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxcna\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxcna\Parameters\Device

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxplus
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x6
    ImagePath    REG_SZ    system32\DRIVERS\elxplus.sys
    DisplayName    REG_SZ    Emulex PLUS Service
    Group    REG_SZ    System Bus Extender
    DependOnGroup    REG_MULTI_SZ    SCSI Miniport

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxplus\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxplus\Enum
    0    REG_SZ    Root\ELXPLUS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x27
    Type    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\elxstor.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor\Parameters
    BusType    REG_DWORD    0x6

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor\Parameters\Device
    DriverParameter    REG_SZ    Topology=2;EmulexOption=0;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor\Enum
    0    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&b98f5c4&0&0068
    Count    REG_DWORD    0x4
    NextInstance    REG_DWORD    0x4
    1    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&b98f5c4&0&0168
    2    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&13700ced&0&0070
    3    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&13700ced&0&0170

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EMC ControlCenter Master Agent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\ECC\exec\ECCService_MasterAgent.exe"
    DisplayName    REG_SZ    EMC ControlCenter Master Agent
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Controls the EMC ControlCenter Master Agent, which controls the installation, starting, and stopping of other agents on the host, and is required on every host running an agent.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EMC ControlCenter Master Agent\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EMC ControlCenter Master Agent\Enum
    0    REG_SZ    Root\LEGACY_EMC_CONTROLCENTER_MASTER_AGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpBase
    HostReservationId    REG_BINARY    5A9E7C0B1E000000
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x7
    ImagePath    REG_SZ    system32\DRIVERS\EmcpBase.sys
    DisplayName    REG_SZ    EMC PowerPath Base Driver
    Group    REG_SZ    System Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpBase\Parameters
    PassThruTimeout    REG_DWORD    0x1e
    emcpConfigVcmDb    REG_DWORD    0x0
    Extensions    REG_MULTI_SZ    EmcpMP\0EmcpMPC\0EmcpHR\0EmcpMPAA\0EmcpMPAP\0EmcpClass\0EmcpCg\0EmcpSapi

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpBase\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpBase\Enum
    0    REG_SZ    Root\SCSIADAPTER\0000
    Count    REG_DWORD    0x4b
    NextInstance    REG_DWORD    0x4b
    1    REG_SZ    PCI\VEN_103C&DEV_3230&SUBSYS_3234103C&REV_03\4&22febb0d&0&0060
    2    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&b98f5c4&0&0068
    3    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&b98f5c4&0&0168
    4    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&13700ced&0&0070
    5    REG_SZ    PCI\VEN_10DF&DEV_FE00&SUBSYS_FE0010DF&REV_02\4&13700ced&0&0170
    6    REG_SZ    SCSI\Disk&Ven_HP&Prod_LOGICAL_VOLUME&Rev_7.08\5&1d8810e0&0&000500
    7    REG_SZ    SCSI\Disk&Ven_HP&Prod_LOGICAL_VOLUME&Rev_7.08\5&1d8810e0&0&000400
    31    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953076
    32    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953075
    33    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953074
    34    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953073
    35    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953072
    36    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953071
    37    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953070
    38    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306F
    39    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306E
    40    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306D
    41    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306C
    42    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306B
    43    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306A
    44    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953069
    45    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953068
    46    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953067
    47    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953066
    48    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953065
    49    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953064
    50    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953063
    51    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953062
    30    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000043
    29    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\emcp&0001&0001&5_0_0_0
    28    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000042
    27    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000041
    26    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000040
    25    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003f
    24    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003e
    23    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003d
    22    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003c
    21    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003b
    20    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003a
    19    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000039
    18    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000038
    17    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000037
    16    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000036
    15    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000035
    14    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000034
    13    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000033
    12    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000032
    11    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000031
    10    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000030
    9    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00002f
    8    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000000
    53    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000000
    54    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00002f
    55    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000030
    56    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000031
    57    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000032
    58    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000033
    59    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000034
    60    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000035
    61    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000036
    62    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000037
    63    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000038
    64    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000039
    65    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003a
    66    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003b
    67    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003c
    68    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003d
    69    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003e
    70    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003f
    71    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000040
    72    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000041
    73    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000042
    52    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000043
    74    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\emcp&0001&0001&3_0_0_0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpCG
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x12
    ImagePath    REG_SZ    system32\DRIVERS\EmcpCG.sys
    DisplayName    REG_SZ    EMC Consistency Group Extension for PowerPath
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpClass
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\EmcpClass.sys
    DisplayName    REG_SZ    EMC Multi-Path Class Device with Third Party Array Support

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpClass\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpClass\Enum
    Count    REG_DWORD    0x2c
    NextInstance    REG_DWORD    0x2c
    11    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003e
    10    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003d
    9    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003c
    8    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003b
    7    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003a
    6    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000039
    5    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000038
    4    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000037
    3    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000036
    2    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000035
    1    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000034
    0    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000033
    12    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000043
    13    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000042
    14    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000041
    15    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000040
    16    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003f
    17    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000000
    18    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00002f
    19    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000030
    20    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000031
    21    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000032
    22    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000000
    23    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00002f
    24    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000030
    25    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000031
    26    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000032
    27    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000033
    28    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000034
    29    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000035
    30    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000036
    31    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000037
    32    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000038
    33    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000039
    34    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003a
    35    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003b
    36    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003c
    37    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003d
    38    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003e
    39    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003f
    40    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000040
    41    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000041
    42    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000042
    43    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000043

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpHR
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x13
    ImagePath    REG_SZ    system32\DRIVERS\EmcpHR.sys
    DisplayName    REG_SZ    EMC High Road Extension for PowerPath
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpMP
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0xf
    ImagePath    REG_SZ    system32\DRIVERS\EmcpMP.sys
    DisplayName    REG_SZ    EMC PowerPath MultiPath Extension for Symmetrix
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpMPAA
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x14
    ImagePath    REG_SZ    system32\DRIVERS\EmcpMPAA.sys
    DisplayName    REG_SZ    EMC PowerPath Multipath Extension for Active-Active arrays
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpMPAP
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x15
    ImagePath    REG_SZ    system32\DRIVERS\EmcpMPAP.sys
    DisplayName    REG_SZ    EMC PowerPath Multipath Extension for Active-Passive arrays
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpMPC
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x10
    ImagePath    REG_SZ    system32\DRIVERS\EmcpMPC.sys
    DisplayName    REG_SZ    EMC PowerPath MultiPath Extension for CLARiiON
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcPowSrv
    License    REG_MULTI_SZ    B9PF-UB4L-VF4T-Q4VX-MZ92-QFYY
    (Default)    REG_SZ    
    DisplayName    REG_SZ    EMC PowerPath Service 4.5.0
    ObjectName    REG_SZ    LocalSystem
    Flash    REG_DWORD    0x1
    Type    REG_DWORD    0x10
    Update    REG_DWORD    0x64
    Beep    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\EMC\PowerCommon\EmcPowSrv.exe
    Pop    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    AdminPath    REG_SZ    C:\apps_srv\EMC\PowerPath\EmcPowerPathW2K3_32bit.msc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcPowSrv\Security
    (Default)    REG_SZ    
    Security    REG_BINARY    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcPowSrv\Enum
    0    REG_SZ    Root\LEGACY_EMCPOWSRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EmcpSAPI
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x11
    ImagePath    REG_SZ    system32\DRIVERS\EmcpSAPI.sys
    DisplayName    REG_SZ    EMC Symmetrix API Extension for PowerPath
    Group    REG_SZ    System Bus Extender
    DependOnService    REG_MULTI_SZ    EmcpBase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Emulex HBA Management
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\Program Files\Emulex\Util\Common\RMServer.exe
    DisplayName    REG_SZ    Emulex HBA Management
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides remote and local HBA management.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Emulex HBA Management\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Emulex HBA Management\Enum
    0    REG_SZ    Root\LEGACY_EMULEX_HBA_MANAGEMENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Emulex SvcMgr
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe
    DisplayName    REG_SZ    Emulex SvcMgr
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Manages HBA management services during hot-swaps and driver updates.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Emulex SvcMgr\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Emulex SvcMgr\Enum
    0    REG_SZ    Root\LEGACY_EMULEX_SVCMGR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\enterceptAgent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe"
    DisplayName    REG_SZ    McAfee Host Intrusion Prevention Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Host-based intrusion prevention component that blocks exploits and hacks in real-time, including malicious buffer overflow code execution and privilege escalations. If this service is disabled or stopped, the system is no longer protected against intrusions.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\enterceptAgent\Parameters
    INSTALLPATH    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\enterceptAgent\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\enterceptAgent\Enum
    0    REG_SZ    Root\LEGACY_ENTERCEPTAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
    DependOnService    REG_MULTI_SZ    RpcSs
    Description    REG_SZ    Collects, stores, and reports unexpected application crashes to Microsoft. If this service is stopped, then Error Reporting will occur only for kernel faults and some types of user mode faults.  If this service is disabled, any services that explicitly depend on it will not start.
    DisplayName    REG_SZ    Error Reporting Service
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k WinErr
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20
    FailureActions    REG_DWORD    0x3a
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\ersvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc\Security
    Security    REG_BINARY    0100148078000000840000001400000044000000020030000200000002801400FF010F000101000000000001000000000240140070000C00010100000000000100000000020034000200000000001800FF010F000102000000000005200000002002000000001400FF010F00010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc\Enum
    0    REG_SZ    Root\LEGACY_ERSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESMAgent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\Symantec\ESM\bin\w3s-ix86\esmagent.exe
    DisplayName    REG_SZ    Enterprise Security Agent
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESMAgent\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESMAgent\Enum
    0    REG_SZ    Root\LEGACY_ESMAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
    Description    REG_SZ    Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.
    DisplayName    REG_SZ    Event Log
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Event log
    ImagePath    REG_SZ    C:\WINNT\system32\services.exe
    ObjectName    REG_SZ    LocalSystem
    PlugPlayServiceType    REG_DWORD    0x3
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20
    ComputerName    REG_SZ    UKEBUUASD99

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application
    DisplayNameFile    REG_SZ    C:\WINNT\system32\els.dll
    DisplayNameID    REG_DWORD    0x100
    File    REG_SZ    C:\WINNT\system32\config\AppEvent.Evt
    MaxSize    REG_DWORD    0x6400000
    PrimaryModule    REG_SZ    Application
    Retention    REG_DWORD    0x0
    AutoBackupLogFiles    REG_DWORD    0x0
    Sources    REG_MULTI_SZ    WSH\0WMIAdapter\0WmdmPmSN\0WinMgmt\0Winlogon\0Windows Product Activation\0Windows 3.1 Migration\0weblogin\0WebClient\0wbatsh\0Wbat\0W3SVC-WP\0W3Ctrs\0vxvmasrs.exe\0VxSvc_vxvm\0VxSvc_VxPolicyManager\0VxSvc_vssprov\0VxSvc_vmstat\0VxSvc_vdsprov\0VxSvc_system\0VxSvc_sysprov\0VxSvc_pnp\0VxSvc_mount\0VxSvc_iscsi\0VxSvc_ftdisk\0VxSvc_fsys\0VxSvc_fastfileresync\0VxSvc_dummy\0VxSvc_disk\0vxsvc_alert\0vxsvc\0VxPBX Service\0vxffr\0VxDgDi\0VSS\0VsJITDebugger\0vmperf\0Visual Studio 2005 Remote Debugger\0Visual Studio - VsTemplate\0VERITAS VSS Provider\0VERITAS VDS Provider\0Veritas Scheduler Service\0Veritas Enterprise Administrator Service\0VBRuntime\0Userinit\0Userenv\0UploadM\0tsync\0TrustMonitor\0TransferManager\0Tlntsvr\0SysmonLog\0SSH Tectia Server\0SSH SFTP Server\0SQLWriter\0SQLWEP\0SQLVDI\0SQLSERVERAGENT\0SQLNCLI\0SQLISService\0SQLISPackage\0SQLDumper\0SQLCTR\0SQLBrowser\0SpoolerCtrs\0Software Restriction Policies\0Software Installation\0soesfx\0SOEInventory\0soeinv\0SOEAdminService\0SOE Wrap Send Service\0sninst\0SndServ\0Service1\0Send Service\0seinst\0SecurityManager\0SclgNtfy\0SceSrv\0SceCli\0sbgina\0safrslv\0SAFrdms\0RPC\0RouteEngine\0RendezvousManager\0Remote Storage\0Remote Assistance\0ProxyServer\0postinv\0PluginHostWinService\0PKZIP\0PerfProc\0PerfOS\0PerfNet\0Perfmon\0Perflib\0PerfDisk\0Perfctrs\0PatrolAgent\0PassportManager\0OmniKernel\0Offline Files\0ObjectManager\0Oakley\0ntbackup\0NetWorker\0Network Optional Components\0MSSQLServerADHelper\0MSSQLSERVER/MSDE\0MSSQLSERVER\0MSSOAP\0MsiInstaller\0msftesqlWatson\0msftesql\0MSDTC Client\0MSDTC\0MSDMine\0mnmsrvc\0Microsoft Visual Studio\0Microsoft Document Explorer\0Microsoft (R) Visual C# 2005 Compiler\0Microsoft (R) Visual Basic Compiler\0McLogEvent\0MailService\0LocationManager\0LoadPerf\0LiveUpdate\0LicenseService\0ipsecevents\0IntellectUpload\0IntellectPickList\0IntellectMailService\0IntellectFlowMPSSvc\0Intellectflow-MailerDaemon Service\0IndexManager\0IISInfoCtrs\0IISADMIN\0HostMIBAgent\0HelpSvc\0Guardium_STAP\0Group Manager\0GetPkg\0Folder Redirection\0FireTDI\0FirePM\0File Deployment\0EvntAgnt\0EventSystem\0EventCreate\0ESR3DiscoveryEngine\0ESR3 Queue Inspector\0ESENT\0Enterprise Security Reporter 3\0enterceptAgent\0Emulex SvcMgr\0Emulex HBA Management\0EmcpSvcErr\0EmcPowerPathService\0EMC ControlCenter Master Agent\0DSReplicationProvider\0DrWatson\0DiskQuota\0Diskeeper\0devenv\0dbmon\0DataTransformationServices90\0DatabaseMail\0crypt32\0cpqvcagent\0ConnectDirect4200\0COM+\0COM\0Ci\0Chkdsk\0CertEnterprisePolicy\0bsys3020\0bsys3010\0BSYS2025\0bsgrp32\0BGS_SDService\0Autosys Remote Agent (S01)\0AutoEnrollment\0Autochk\0ASP.NET 2.0.50727.0\0ASP.NET 1.1.4322.0\0Application Management\0Application Hang\0Application Error\0apphelp\0Active Server Pages\0.NET Runtime Optimization Service\0.NET Runtime 2.0 Error Reporting\0.NET Runtime\0Application
    CustomSD    REG_SZ    O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x2;;;S-1-5-21-1504218004-891719847-2931530920-1021)
    RestrictGuestAccess    REG_DWORD    0x1
    (Default)    REG_SZ    mnmsrvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\system32\mscoree.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime Optimization Service
    EventMessageFile    REG_SZ    C:\WINNT\system32\mscoree.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Active Server Pages
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iisres.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\apphelp
    EventMessageFile    REG_SZ    C:\WINNT\System32\apphelp.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application
    CategoryCount    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\eventlog.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Error
    EventMessageFile    REG_SZ    C:\WINNT\System32\faultrep.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang
    EventMessageFile    REG_SZ    C:\WINNT\System32\faultrep.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Management
    EventMessageFile    REG_SZ    C:\WINNT\System32\appmgmts.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ASP.NET 1.1.4322.0
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll
    CategoryCount    REG_DWORD    0x2
    CategoryMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ASP.NET 2.0.50727.0
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
    CategoryCount    REG_DWORD    0x5
    CategoryMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Autochk
    EventMessageFile    REG_SZ    C:\WINNT\System32\winlogon.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\AutoEnrollment
    EventMessageFile    REG_SZ    C:\WINNT\System32\pautoenr.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Autosys Remote Agent (S01)
    EventMessageFile    REG_SZ    C:\apps_srv\autosys.S01\Autosys\bin\autosysd.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\BGS_SDService
    EventMessageFile    REG_SZ    x
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\bsgrp32
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\BSYS2025
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\bsys3010
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\bsys3020
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\CertEnterprisePolicy
    EventMessageFile    REG_SZ    C:\WINNT\System32\certpdef.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Chkdsk
    EventMessageFile    REG_SZ    C:\WINNT\System32\ulib.dll;C:\WINNT\System32\w03a2409.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Ci
    EventMessageFile    REG_SZ    C:\WINNT\System32\query.dll
    CategoryMessageFile    REG_SZ    C:\WINNT\System32\query.dll
    TypesSupported    REG_DWORD    0x7
    CategoryCount    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\COM
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\xpsp2res.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\COM+
    EventMessageFile    REG_SZ    C:\WINNT\system32\comres.dll;C:\WINNT\system32\ws03res.dll;C:\WINNT\system32\W03A2409.dll
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\comres.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\system32\comres.dll
    TypeSupported    REG_DWORD    0x7
    CategoryCount    REG_DWORD    0x75

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ConnectDirect4200
    EventMessageFile    REG_SZ    CDELMSG.DLL
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\cpqvcagent
    CategoryCount    REG_DWORD    0x3
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\hp\hpsmh\data\cgi-bin\vcagent\smMsgTblEvents6.1.0.841.dll
    EventMessageFile    REG_SZ    C:\hp\hpsmh\data\cgi-bin\vcagent\smMsgTblEvents6.1.0.841.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\crypt32
    EventMessageFile    REG_SZ    C:\WINNT\System32\crypt32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DatabaseMail
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DataTransformationServices90
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\dbmon
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\devenv
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\devenv.exe
    TypesSupported    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Diskeeper
    EventMessageFile    REG_SZ    C:\Program Files\Diskeeper Corporation\Diskeeper\DkMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DiskQuota
    EventMessageFile    REG_SZ    %SystemRoot%\System32\dskquota.dll
    TypesSupported    REG_SZ    0x00000007

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DrWatson
    EventMessageFile    REG_SZ    C:\WINNT\System32\drwtsn32.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DSReplicationProvider
    EventMessageFile    REG_SZ    C:\WINNT\system32\replprov.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\EMC ControlCenter Master Agent
    EventMessageFile    REG_SZ    C:\apps_srv\ECC\exec\ECCService_MasterAgent.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\EmcPowerPathService
    EventMessageFile    REG_SZ    C:\apps_srv\EMC\PowerCommon\EmcpSvcErr.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\EmcpSvcErr
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\apps_srv\EMC\PowerCommon\EmcpSvcErr.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Emulex HBA Management
    EventMessageFile    REG_SZ    C:\Program Files\Emulex\Util\Common\ElxHBASvcMsg.dll
    Types Supported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Emulex SvcMgr
    EventMessageFile    REG_SZ    C:\Program Files\Emulex\Util\Common\ElxHBASvcMsg.dll
    Types Supported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\enterceptAgent
    (Default)    REG_SZ    
    EventMessageFile    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Enterprise Security Reporter 3
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT
    EventMessageFile    REG_SZ    C:\WINNT\system32\ESENT.dll
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\ESENT.dll
    CategoryCount    REG_DWORD    0x10
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESR3 Queue Inspector
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESR3DiscoveryEngine
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\EventCreate
    EventMessageFile    REG_SZ    C:\WINNT\System32\EventCreate.exe
    TypesSupported    REG_DWORD    0x7
    CustomSource    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\EventSystem
    CategoryCount    REG_DWORD    0x6
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\comres.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\comres.dll;C:\WINNT\system32\ws03res.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\EvntAgnt
    EventMessageFile    REG_SZ    C:\WINNT\System32\evntagnt.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\File Deployment
    EventMessageFile    REG_SZ    C:\WINNT\System32\fdeploy.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\FirePM
    EventMessageFile    REG_SZ    C:\WINNT\system32\Drivers\FirePM.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\FireTDI
    EventMessageFile    REG_SZ    C:\WINNT\system32\Drivers\FireTDI.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Folder Redirection
    EventMessageFile    REG_SZ    C:\WINNT\System32\fdeploy.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\GetPkg
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Group Manager
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Guardium_STAP
    EventMessageFile    REG_SZ    C:\Program Files\guardium\guardium_stap\guardium_stap\guardium_stapr.exe
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\Program Files\guardium\guardium_stap\guardium_stap\guardium_stapr.exe
    CategoryCount    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\HelpSvc
    EventMessageFile    REG_SZ    C:\WINNT\PCHealth\HelpCtr\Binaries\HCAppRes.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\HostMIBAgent
    EventMessageFile    REG_SZ    C:\WINNT\System32\hostmib.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IISADMIN
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\svcext.dll
    TypesSupported    REG_DWORD    0xf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IISInfoCtrs
    EventMessageFile    REG_SZ    C:\WINNT\system32\infoctrs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IndexManager
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Intellectflow-MailerDaemon Service
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IntellectFlowMPSSvc
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IntellectMailService
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IntellectPickList
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IntellectUpload
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ipsecevents
    EventMessageFile    REG_SZ    C:\WINNT\System32\w03a2409.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\LicenseService
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    %SystemRoot%\System32\llsrpc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\LiveUpdate
    EventMessageFile    REG_SZ    C:\Program Files\Symantec\LiveUpdate\ResLuComServer_3_2.DLL
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\LoadPerf
    EventMessageFile    REG_SZ    C:\WINNT\System32\loadperf.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\LocationManager
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MailService
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\McLogEvent
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\naievent.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft (R) Visual Basic Compiler
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft (R) Visual C# 2005 Compiler
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Document Explorer
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Visual Studio
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\mnmsrvc
    EventMessageFile    REG_SZ    %SystemRoot%\System32\nmevtmsg.dll
    TypeSupported    REG_BINARY    07000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSDMine
    EventMessageFile    REG_SZ    C:\PROGRA~1\COMMON~1\SYSTEM\OLEDB~1\MSDMINE.DLL
    TypesSupported    REG_BINARY    0012B858
    CategoryCount    REG_DWORD    0x2
    CategoryMessageFile    REG_SZ    C:\PROGRA~1\COMMON~1\SYSTEM\OLEDB~1\MSDMINE.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSDTC
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\COMRES.DLL
    EventMessageFile    REG_SZ    C:\WINNT\system32\COMRES.DLL;C:\WINNT\system32\xpsp2res.dll;C:\WINNT\system32\ws03res.dll
    TypesSupported    REG_DWORD    0x7
    CategoryCount    REG_DWORD    0xf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSDTC Client
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\COMRES.DLL
    EventMessageFile    REG_SZ    C:\WINNT\system32\COMRES.DLL;C:\WINNT\system32\xpsp2res.dll;C:\WINNT\system32\ws03res.dll
    TypesSupported    REG_DWORD    0x7
    CategoryCount    REG_DWORD    0xf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\msftesql
    EventMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\msfte.dll
    CategoryMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\msfte.dll
    CategoryCount    REG_DWORD    0x4
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\msftesqlWatson
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft SQL Server\90\Shared\dw15.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MsiInstaller
    EventMessageFile    REG_SZ    C:\WINNT\system32\msi.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSOAP
    TypesSupported    REG_DWORD    0x1
    CategoryCount    REG_DWORD    0x4
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\MSSoap\Binaries\MSSOAP30.dll
    CategoryMessageFile    REG_SZ    C:\Program Files\Common Files\MSSoap\Binaries\MSSOAP30.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSQLSERVER
    CategoryCount    REG_DWORD    0x8
    CategoryMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\Resources\1033\sqlevn70.rll
    EventMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\Resources\1033\sqlevn70.rll
    TypesSupported    REG_DWORD    0xff

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSQLSERVER/MSDE
    EventMessageFile    REG_SZ    C:\WINNT\AppPatch\acres.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSQLServerADHelper
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft SQL Server\90\Shared\Resources\1033\sqladevn90.rll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Network Optional Components
    EventMessageFile    REG_SZ    C:\WINNT\System32\Setup\netoc.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NetWorker
    EventMessageFile    REG_SZ    C:\apps_srv\Legato\nsr\bin\liblocal.dll
    CategoryMessageFile    REG_SZ    C:\apps_srv\Legato\nsr\bin\liblocal.dll
    CategoryCount    REG_DWORD    0x23
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ntbackup
    EventMessageFile    REG_SZ    C:\WINNT\System32\ntbackup.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Oakley
    EventMessageFile    REG_SZ    %SystemRoot%\System32\oakley.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ObjectManager
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Offline Files
    EventMessageFile    REG_SZ    C:\WINNT\System32\cscui.dll
    TypesSupported    REG_SZ    0x00000007

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\OmniKernel
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PassportManager
    EventMessageFile    REG_SZ    C:\WINNT\system32\msppmalr.dll
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\msppmalr.dll
    TypesSupported    REG_DWORD    0x7
    CategoryCount    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PatrolAgent
    EventMessageFile    REG_SZ    c:\apps_srv\BMC Software\Patrol3\bin\PatrolAgent.exe
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Perfctrs
    EventMessageFile    REG_SZ    C:\WINNT\System32\perfctrs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PerfDisk
    EventMessageFile    REG_SZ    C:\WINNT\System32\perfdisk.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Perflib
    EventMessageFile    REG_SZ    C:\WINNT\System32\prflbmsg.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Perfmon
    EventMessageFile    REG_SZ    C:\WINNT\System32\perfmon.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PerfNet
    EventMessageFile    REG_SZ    C:\WINNT\System32\perfnet.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PerfOS
    EventMessageFile    REG_SZ    C:\WINNT\System32\perfOS.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PerfProc
    EventMessageFile    REG_SZ    C:\WINNT\System32\perfproc.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PKZIP
    EventMessageFile    REG_SZ    C:\PROGRA~1\PKWARE\PKZIPC\pkzipc.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\PluginHostWinService
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\postinv
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ProxyServer
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Remote Assistance
    EventMessageFile    REG_SZ    C:\WINNT\system32\racpldlg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Remote Storage
    CategoryCount    REG_DWORD    0xb
    CategoryMessageFile    REG_SZ    C:\WINNT\System32\RsCommon.Dll
    EventMessageFile    REG_SZ    C:\WINNT\System32\RsCommon.Dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\RendezvousManager
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\RouteEngine
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\RPC
    EventMessageFile    REG_SZ    C:\WINNT\System32\w03a2409.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SAFrdms
    EventMessageFile    REG_SZ    C:\WINNT\system32\safrdm.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\safrslv
    EventMessageFile    REG_SZ    C:\WINNT\system32\safrslv.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\sbgina
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SceCli
    EventMessageFile    REG_SZ    C:\WINNT\System32\scecli.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SceSrv
    EventMessageFile    REG_SZ    C:\WINNT\System32\scesrv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SclgNtfy
    EventMessageFile    REG_SZ    C:\WINNT\System32\sclgntfy.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityManager
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\seinst
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Send Service
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Service1
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SndServ
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\sninst
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SOE Wrap Send Service
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SOEAdminService
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\soeinv
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SOEInventory
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\soesfx
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Installation
    EventMessageFile    REG_SZ    C:\WINNT\System32\appmgr.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Restriction Policies
    EventMessageFile    REG_SZ    C:\WINNT\System32\ntdll.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SpoolerCtrs
    EventMessageFile    REG_SZ    C:\WINNT\System32\winspool.drv
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLBrowser
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft SQL Server\90\Shared\Resources\1033\sbevent.rll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLCTR
    EventMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\Resources\1033\sqlevn70.rll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLDumper
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLISPackage
    EventMessageFile    REG_SZ    C:\apps_srv\mssql\90\DTS\Binn\Resources\1033\dtsmsg.rll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLISService
    CategoryCount    REG_DWORD    0x2
    CategoryMessageFile    REG_SZ    C:\apps_srv\mssql\90\DTS\Binn\Resources\1033\dtsmsg.rll
    EventMessageFile    REG_SZ    C:\apps_srv\mssql\90\DTS\Binn\Resources\1033\dtsmsg.rll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLNCLI
    EventMessageFile    REG_SZ    C:\WINNT\system32\sqlncli.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLSERVERAGENT
    CategoryCount    REG_DWORD    0x8
    CategoryMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\SQLAGENTLOG90.DLL
    TypesSupported    REG_DWORD    0xff
    EventMessageFile    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\SQLAGENTLOG90.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLVDI
    (Default)    REG_SZ    Microsoft SQL Server Virtual Device Interface
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft SQL Server\80\COM\sqlvdi.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLWEP
    (Default)    REG_SZ    Microsoft SQL Server WMI Event Provider
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft SQL Server\90\COM\sqlwep.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLWriter
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft SQL Server\90\Shared\Resources\1033\sqlwriter.rll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SSH SFTP Server
    EventMessageFile    REG_SZ    C:\apps_srv\SSH Communications Security\SSH Secure Shell Server\ssh2master.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SSH Tectia Server
    EventMessageFile    REG_SZ    C:\apps_srv\SSH Communications Security\SSH Secure Shell Server\ssh2master.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SysmonLog
    EventMessageFile    REG_SZ    C:\WINNT\System32\smlogsvc.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Tlntsvr
    EventMessageFile    REG_SZ    C:\WINNT\system32\tlntsvr.exe
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\TransferManager
    EventMessageFile    REG_SZ    D:\eistream\Server\BIN\SRVMSG.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\TrustMonitor
    EventMessageFile    REG_SZ    C:\WINNT\system32\wbem\adstatus\trustmon.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\tsync
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\UploadM
    EventMessageFile    REG_SZ    C:\WINNT\PCHealth\UploadLB\Binaries\UploadM.exe
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Userenv
    EventMessageFile    REG_SZ    C:\WINNT\System32\userenv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Userinit
    EventMessageFile    REG_SZ    C:\WINNT\System32\userinit.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VBRuntime
    EventMessageFile    REG_SZ    C:\WINNT\system32\msvbvm60.dll
    TypesSupported    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Veritas Enterprise Administrator Service
    (Default)    REG_SZ    
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\VRTSobc\pal33\bin\msgCatalog.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Veritas Scheduler Service
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\VxServiceMsgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VERITAS VDS Provider
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\ENU\vxvds_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VERITAS VSS Provider
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vxvm_msgs.dll;C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vxvssprov_msgs.dll;
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Visual Studio - VsTemplate
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\msenv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Visual Studio 2005 Remote Debugger
    EventMessageFile    REG_SZ    C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmperf
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vxstat_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VsJITDebugger
    EventMessageFile    REG_SZ    C:\WINNT\system32\vsjitdebugger.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSS
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\System32\VSSVC.EXE;C:\WINNT\System32\ws03res.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxDgDi
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\ENU\LateStartMsgs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\vxffr
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\Enu\vxffrmsgs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxPBX Service
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\Program Files\Common Files\VERITAS\VRTSicsco\vxACE_3.dll;C:\Program Files\Veritas\VxPBX\\resources\VxPBXEN.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\vxsvc
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\vxapi.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\vxsvc_alert
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\alert_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_disk
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\disk_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_dummy
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\smpl_msg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_fastfileresync
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\Enu\ffr_msgs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_fsys
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\fsys_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_ftdisk
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\ftdisk_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_iscsi
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\iscsi_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_mount
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\mount_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_pnp
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\pnp_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_sysprov
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\sysprov_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_system
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\VRTSobc\pal33\bin\msgCatalog.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_vdsprov
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vdsprov_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_vmstat
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vxstat_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_vssprov
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vssprov_msgs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_VxPolicyManager
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\ENU\vxpolman_msgs.dll
    (Default)    REG_SZ    
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VxSvc_vxvm
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\enu\vxvm_msgs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\vxvmasrs.exe
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\ENU\asrmessages.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\W3Ctrs
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iisres.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\W3SVC-WP
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iisres.dll;C:\WINNT\system32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wbat
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\wbatsh
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WebClient
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\weblogin
    EventMessageFile    REG_SZ    soemsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows 3.1 Migration
    EventMessageFile    REG_SZ    C:\WINNT\System32\advapi32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Product Activation
    EventMessageFile    REG_SZ    C:\WINNT\System32\dpcdll.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon
    EventMessageFile    REG_SZ    C:\WINNT\System32\winlogon.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WinMgmt
    EventMessageFile    REG_SZ    C:\WINNT\system32\WBEM\WinMgmtR.dll;C:\WINNT\system32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WmdmPmSN
    EventMessageFile    REG_SZ    C:\WINNT\system32\mspmsnsv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WMIAdapter
    EventMessageFile    REG_SZ    C:\WINNT\system32\WBEM\WMIApRes.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WSH
    EventMessageFile    REG_SZ    C:\WINNT\System32\wshext.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\IFlow MPSSvc
    Sources    REG_MULTI_SZ    IFlow MPSSvc
    MaxSize    REG_DWORD    0x80000
    Retention    REG_DWORD    0x93a80
    AutoBackupLogFiles    REG_DWORD    0x0
    File    REG_SZ    C:\WINNT\System32\config\IFlow MP.evt
    CustomSD    REG_SZ    O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x1;;;S-1-5-21-1504218004-891719847-2931530920-1021)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\IFlow MPSSvc\IFlow MPSSvc
    EventMessageFile    REG_SZ    C:\WINNT\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security
    DisplayNameFile    REG_SZ    C:\WINNT\System32\els.dll
    DisplayNameID    REG_DWORD    0x101
    File    REG_SZ    C:\WINNT\System32\config\SecEvent.Evt
    MaxSize    REG_DWORD    0x6400000
    PrimaryModule    REG_SZ    Security
    Retention    REG_DWORD    0x0
    WarningLevel    REG_DWORD    0x0
    AutoBackupLogFiles    REG_DWORD    0x0
    Sources    REG_MULTI_SZ    Spooler\0Security Account Manager\0SC Manager\0NetDDE Object\0LSA\0IIS-METABASE\0DS\0Security
    CustomSD    REG_SZ    O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x2;;;S-1-5-21-1504218004-891719847-2931530920-1021)
    RestrictGuestAccess    REG_DWORD    0x1
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\DS
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\DS\ObjectNames
    Directory Service Object    REG_DWORD    0x1e00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\IIS-METABASE
    EventSourceFlags    REG_DWORD    0x1
    EventMessageFile    REG_SZ    %SystemRoot%\system32\inetsrv\iisres.dll;%SystemRoot%\system32\ws03res.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\LSA
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\LSA\ObjectNames
    PolicyObject    REG_DWORD    0x1600
    SecretObject    REG_DWORD    0x1610
    TrustedDomainObject    REG_DWORD    0x1620
    UserAccountObject    REG_DWORD    0x1630

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\NetDDE Object
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\NetDDE Object\ObjectNames
    DDE Share    REG_DWORD    0x1d00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\SC Manager
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\SC Manager\ObjectNames
    SC_MANAGER Object    REG_DWORD    0x1c00
    SERVICE Object    REG_DWORD    0x1c10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security
    CategoryCount    REG_DWORD    0x9
    CategoryMessageFile    REG_SZ    C:\WINNT\System32\MsAuditE.dll
    GuidMessageFile    REG_SZ    C:\WINNT\System32\NtMarta.dll
    EventMessageFile    REG_SZ    C:\WINNT\System32\MsAuditE.dll;C:\WINNT\System32\ws03res.dll;C:\WINNT\System32\xpsp2res.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll
    TypesSupported    REG_DWORD    0x1c

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security\ObjectNames
    Channel    REG_DWORD    0x1400
    Desktop    REG_DWORD    0x1a10
    Device    REG_DWORD    0x1100
    Directory    REG_DWORD    0x1110
    Event    REG_DWORD    0x1120
    EventPair    REG_DWORD    0x1130
    File    REG_DWORD    0x1140
    IoCompletion    REG_DWORD    0x1300
    Job    REG_DWORD    0x1410
    Key    REG_DWORD    0x1150
    MailSlot    REG_DWORD    0x1140
    Mutant    REG_DWORD    0x1160
    NamedPipe    REG_DWORD    0x1140
    Port    REG_DWORD    0x1170
    Process    REG_DWORD    0x1180
    Profile    REG_DWORD    0x1190
    Section    REG_DWORD    0x11a0
    Semaphore    REG_DWORD    0x11b0
    SymbolicLink    REG_DWORD    0x11c0
    Thread    REG_DWORD    0x11d0
    Timer    REG_DWORD    0x11e0
    Token    REG_DWORD    0x11f0
    Type    REG_DWORD    0x1200
    WaitablePort    REG_DWORD    0x1170
    WindowStation    REG_DWORD    0x1a00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security Account Manager
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security Account Manager\ObjectNames
    SAM_ALIAS    REG_DWORD    0x1530
    SAM_DOMAIN    REG_DWORD    0x1510
    SAM_GROUP    REG_DWORD    0x1520
    SAM_SERVER    REG_DWORD    0x1500
    SAM_USER    REG_DWORD    0x1540

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Spooler
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\MsObjs.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Spooler\ObjectNames
    Document    REG_DWORD    0x1b20
    Printer    REG_DWORD    0x1b10
    Server    REG_DWORD    0x1b00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System
    DisplayNameFile    REG_SZ    C:\WINNT\system32\els.dll
    DisplayNameID    REG_DWORD    0x102
    File    REG_SZ    C:\WINNT\system32\config\SysEvent.Evt
    MaxSize    REG_DWORD    0x6400000
    PrimaryModule    REG_SZ    System
    Retention    REG_DWORD    0x0
    AutoBackupLogFiles    REG_DWORD    0x0
    Sources    REG_MULTI_SZ    WZCSVC\0Workstation\0WMIxWDM\0WLBS\0WinHttpAutoProxySvc\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows File Protection\0Win32k\0Wdf01007\0Wdf01005\0Wdf01000\0Wd\0WAM\0W3SVC\0W32Time\0vxio\0vxcache\0vxboot\0Volume Shadow Copy Service Task\0VolSnap\0Virtual Disk Service\0viaide\0VgaSave\0vga\0VDS Basic Provider 1.1\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermServJet\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip6\0Tcpip\0System Error\0sym_u3\0sym_hi\0symmpi\0symc8xx\0symc810\0storport\0Storage Agents\0StillImage\0Srv\0SNMPTRAP\0SNMP\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service Control Manager\0Server Agents\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0Removable Storage Service\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql2300\0ql2200\0ql2100\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0Processor\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0PCSOEVNC\0pcmcia\0pciide\0pci\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC Agents\0nfrd960\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0mfehidk\0LsaSrv\0lp6nds35\0LmHosts\0LDMS\0LDM\0l2nd\0Kerberos\0KDC\0kbdhid\0kbdclass\0isapnp\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0ipsraidn\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelide\0IISWMI\0IISMAP\0IISLOG\0IISCTLS\0IIS Config\0iirsp\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpt3xx\0hpqilo2\0hpn\0HpCISSs2\0hpcisss\0HP Wbem Dump\0HP Test\0HP Tape\0HP System Management Homepage\0HP System\0HP Smart Array\0HP Sensor\0HP SCSI\0HP SATA\0HP SAS\0HP Processor\0HP Memory\0HP Fibre Channel\0HP Ethernet\0HP Disk Threshold\0HP CPU Threshold\0ftdisk\0fs_rec\0Foundation Agents\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0Emcreports\0EmcpBase\0elxstor\0elxplus\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Server\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0dellcerc\0DCOM\0dac960nt\0dac2w2k\0cryptsvc\0CPQTeamMP\0CPQTeam\0cpqfcalm\0cpqcissm\0cpqarry2\0cpqarray\0cmdide\0Clussvc\0Cissesrv\0changer\0CertObj\0cdrom\0Cdm\0cdfs\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0b06bdrv\0Atmarpc\0ati2mtag\0atdisk\0atapi\0AsyncMac\0Application Popup\0ami0nt\0amdide\0aliide\0Alerter\0aic78xx\0aic78u2\0afcnt\0AeLookupSvc\0adpu320\0adpu160m\0acpiec\0acpi\0abiosdsk\0System
    CustomSD    REG_SZ    O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-21-1504218004-891719847-2931530920-1021)
    RestrictGuestAccess    REG_DWORD    0x1
    EventMessageFile    REG_SZ    %systemroot%\system32\stisvc.exe
    TypesSupported    REG_BINARY    07000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\abiosdsk
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\acpi
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\acpi.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\acpiec
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\acpiec.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\adpu160m
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\adpu320
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc
    EventMessageFile    REG_SZ    C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\afcnt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\aic78u2
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\aic78xx
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Alerter
    EventMessageFile    REG_SZ    C:\WINNT\System32\netmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\aliide
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\AliIde.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\amdide
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\amdide.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ami0nt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Application Popup
    EventMessageFile    REG_SZ    C:\WINNT\System32\ntdll.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\AsyncMac
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\atapi
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\atdisk
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ati2mtag
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\ati2erec.dll;C:\WINNT\System32\drivers\ati2mtag.sys
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\WINNT\System32\drivers\ati2erec.dll
    CategoryCount    REG_DWORD    0x3f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Atmarpc
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\b06bdrv
    eventmessagefile    REG_SZ    C:\WINNT\System32\iologmsg.dll;C:\WINNT\System32\drivers\bxvbdx.sys
    typessupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\beep
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\BITS
    TypesSupported    REG_DWORD    0x7
    CategoryCount    REG_DWORD    0x1
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\xpob2res.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\xpob2res.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Browser
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cbidf2k
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cd20xrnt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cdfs
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Cdm
    (Default)    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cdrom
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\CertObj
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\certobj.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\changer
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Cissesrv
    EventMessageFile    REG_SZ    C:\Program Files\HP\Cissesrv\cissesrv.exe
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\Program Files\HP\Cissesrv\cissesrv.exe
    CategoryCount    REG_DWORD    0x3

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Clussvc
    EventMessageFile    REG_SZ    ;C:\WINNT\system32\ws03res.dll;C:\WINNT\system32\w03a2409.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cmdide
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\CmdIde.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cpqarray
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cpqarry2
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cpqcissm
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cpqfcalm
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\CPQTeam
    EventMessageFile    REG_SZ    C:\WINNT\System32\drivers\cpqteam.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\CPQTeamMP
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\Drivers\CPQTeam.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cryptsvc
    EventMessageFile    REG_SZ    C:\WINNT\System32\cryptsvc.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\dac2w2k
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\dac960nt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\DCOM
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\xpsp2res.dll;C:\WINNT\System32\ws03res.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\dellcerc
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\DfsDriver
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\DfsSvc
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll;C:\WINNT\System32\w03a2409.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Dhcp
    EventMessageFile    REG_SZ    C:\WINNT\System32\dhcpcsvc.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\disk
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Distributed Link Tracking Client
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Distributed Link Tracking Server
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\dmboot
    EventMessageFile    REG_SZ    C:\WINNT\System32\Drivers\dmboot.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\dmio
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\dmio.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Dnsapi
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Dnscache
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\dpti2o
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\efs
    EventMessageFile    REG_SZ    C:\WINNT\System32\lsasrv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\elxplus
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\elxplus.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\elxstor
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\elxstor.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\EmcpBase
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\EmcpBase.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Emcreports
    EventMessageFile    REG_SZ    C:\WINNT\System32\EventCreate.exe
    TypesSupported    REG_DWORD    0x7
    CustomSource    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\eventlog
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\fastfat
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\fdc
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\fdc.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Fips
    EventMessageFile    REG_SZ    C:\WINNT\System32\Drivers\fips.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\flpydisk
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\flpydisk.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Foundation Agents
    CategoryCount    REG_DWORD    0x10
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\cpqhsmsg.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\cpqhsmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\fs_rec
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ftdisk
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\FtDisk.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP CPU Threshold
    CategoryCount    REG_DWORD    0x6a
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Disk Threshold
    CategoryCount    REG_DWORD    0x6a
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Ethernet
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Fibre Channel
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Memory
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Processor
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP SAS
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP SATA
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP SCSI
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Sensor
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Smart Array
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP System
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP System Management Homepage
    CategoryCount    REG_DWORD    0x1
    CategoryMessageFile    REG_SZ    C:\hp\hpsmh\bin\smhevent.6.1.0.102.dll
    EventMessageFile    REG_SZ    C:\hp\hpsmh\bin\smhevent.6.1.0.102.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Tape
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Test
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HP Wbem Dump
    CategoryCount    REG_DWORD    0x2e
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\hpcisss
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\HpCISSs2
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\hpn
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\hpqilo2
    EventMessageFile    REG_SZ    C:\WINNT\System32\Drivers\hpqilo2.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\hpt3xx
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Http
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\i2omgmt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\i2omp
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\i8042prt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\i8042prt.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IGMPv2
    EventMessageFile    REG_SZ    C:\WINNT\System32\igmpv2.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\iirsp
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IIS Config
    CategoryCount    REG_DWORD    0x15
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iiscfg.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iiscfg.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iiscfg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IISCTLS
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iisrstas.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IISLOG
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iscomlog.dll
    TypesSupported    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IISMAP
    EventMessageFile    REG_SZ    C:\WINNT\system32\iismap.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IISWMI
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iiswmi.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\intelide
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\IntelIde.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPBOOTP
    EventMessageFile    REG_SZ    C:\WINNT\System32\ipbootp.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMGM
    EventMessageFile    REG_SZ    C:\WINNT\System32\rtm.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPNATHLP
    EventMessageFile    REG_SZ    C:\WINNT\System32\ipnathlp.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRIP2
    EventMessageFile    REG_SZ    C:\WINNT\System32\iprip2.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRouterManager
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPSec
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ipsraidn
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPXCP
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPXRIP
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPXRouterManager
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPXSAP
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\isapnp
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\isapnp.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdclass
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\kbdclass.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdhid
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\kbdhid.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\KDC
    EventMessageFile    REG_SZ    C:\WINNT\System32\kdcsvc.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Kerberos
    EventMessageFile    REG_SZ    C:\WINNT\System32\kerberos.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\l2nd
    eventmessagefile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\drivers\bxnd52x.sys
    typessupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\LDM
    EventMessageFile    REG_SZ    C:\WINNT\System32\dmadmin.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\LDMS
    EventMessageFile    REG_SZ    C:\WINNT\System32\dmserver.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\LmHosts
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\lp6nds35
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\System32\lsasrv.dll
    CategoryMessageFile    REG_SZ    C:\WINNT\System32\lsasrv.dll
    CategoryCount    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\mfehidk
    EventMessageFile    REG_SZ    C:\WINNT\system32\drivers\mfehidk.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Modem
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\Modem.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\mouclass
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\mouclass.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\mouhid
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\mouhid.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\mraid35x
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\MRxDAV
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\MrxSmb
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\iologmsg.dll
    TypesSupported    REG_DWORD    0x7
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\msadlib
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\msfs
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Mup
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ndis
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\NdisWan
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\NetBIOS
    EventMessageFile    REG_SZ    C:\WINNT\System32\iologmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\NetBT
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\NetDDE
    EventMessageFile    REG_SZ    C:\WINNT\System32\netdde.exe
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Netlogon
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    EventMessageFile    REG_SZ    C:\WINNT\System32\netmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\nfrd960
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\NIC Agents
    CategoryCount    REG_DWORD    0x10
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\cpqnimsg.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\cpqnimsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Nla
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\npfs
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ntfs
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\NtServicePack
    EventMessageFile    REG_SZ    C:\WINNT\System32\spmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\null
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPF
    EventMessageFile    REG_SZ    C:\WINNT\System32\ospf.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\OSPFMib
    EventMessageFile    REG_SZ    C:\WINNT\System32\ospfmib.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\parport
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\ParPort.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\partmgr
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\pci
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\Pci.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\pciide
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\PciIde.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\pcmcia
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\Pcmcia.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\PCSOEVNC
    EventMessageFile    REG_SZ    C:\WINNT\system32\soemsg.dll
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\soemsg.dll
    CategoryCount    REG_DWORD    0x6

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\perc2
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\PlugPlayManager
    EventMessageFile    REG_SZ    C:\WINNT\System32\umpnpmgr.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\PolicyAgent
    EventMessageFile    REG_SZ    C:\WINNT\System32\polagent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\PptpMiniport
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Print
    EventMessageFile    REG_SZ    C:\WINNT\System32\LocalSpl.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Processor
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\processr.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql1080
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql10wnt
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql12160
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql1240
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql1280
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql2100
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql2200
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ql2300
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\RasAuto
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\RasMan
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Rdbss
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\redbook
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\redbook.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\RemoteAccess
    EventMessageFile    REG_SZ    C:\WINNT\System32\mprmsg.dll;C:\WINNT\System32\ws03res.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\iassvcs.dll
    TypesSupported    REG_DWORD    0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Removable Storage Service
    EventMessageFile    REG_SZ    C:\WINNT\System32\ntmsevt
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM
    EventMessageFile    REG_SZ    C:\WINNT\System32\samsrv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Save Dump
    EventMessageFile    REG_SZ    C:\WINNT\System32\SaveDump.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\SCardSvr
    EventMessageFile    REG_SZ    C:\WINNT\System32\SCardSvr.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel
    EventMessageFile    REG_SZ    C:\WINNT\system32\lsasrv.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Schedule
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\scsiport
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\serial
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\serial.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Server
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Server Agents
    CategoryCount    REG_DWORD    0x10
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\cpqsvmsg.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\cpqsvmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll;C:\WINNT\System32\w03a2409.dll
    ParameterMessageFile    REG_SZ    C:\WINNT\System32\kernel32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Setup
    EventMessageFile    REG_SZ    C:\WINNT\System32\syssetup.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\sfloppy
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\SideBySide
    EventMessageFile    REG_SZ    C:\WINNT\System32\sxs.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Simbad
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\sndblst
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMP
    EventMessageFile    REG_SZ    C:\WINNT\System32\snmp.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP
    EventMessageFile    REG_SZ    C:\WINNT\System32\snmptrap.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Srv
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage
    EventMessageFile    REG_SZ    C:\WINNT\System32\wiaservc.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Storage Agents
    CategoryCount    REG_DWORD    0x10
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\cpqstmsg.dll
    EventMessageFile    REG_SZ    C:\WINNT\system32\cpqstmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\storport
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\symc810
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\symc8xx
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\symmpi
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\sym_hi
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\sym_u3
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System
    CategoryCount    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\eventlog.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System Error
    EventMessageFile    REG_SZ    C:\WINNT\System32\faultrep.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Tcpip
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll;C:\WINNT\System32\w03a3409.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Tcpip6
    EventMessageFile    REG_SZ    C:\WINNT\System32\netevent.dll;C:\WINNT\System32\ws03res.dll;C:\WINNT\System32\w03a3409.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    %SystemRoot%\System32\tcpmon.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\tdi
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermDD
    EventMessageFile    REG_SZ    C:\WINNT\System32\ntdll.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServDevices
    EventMessageFile    REG_SZ    C:\WINNT\System32\wlnotify.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService
    EventMessageFile    REG_SZ    C:\WINNT\System32\termsrv.dll;C:\WINNT\System32\ntdll.dll;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServJet
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\System32\tssdjet.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermServSessDir
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_SZ    C:\WINNT\System32\tssdis.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\toside
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\TosIde.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\udfs
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\ultra
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\UPS
    EventMessageFile    REG_SZ    C:\WINNT\System32\netmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\USER32
    EventMessageFile    REG_SZ    C:\WINNT\System32\user32.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\VDS Basic Provider 1.1
    EventMessageFile    REG_SZ    C:\WINNT\System32\vdsbas.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\vga
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\drivers\vgapnp.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\VgaSave
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\vga.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\viaide
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\ViaIde.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Virtual Disk Service
    EventMessageFile    REG_SZ    C:\WINNT\System32\vds.exe
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\VolSnap
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\VolSnap.sys;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Volume Shadow Copy Service Task
    EventMessageFile    REG_SZ    C:\WINNT\Cluster\VSSTask.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\vxboot
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\ENU\vxbootlg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\vxcache
    EventMessageFile    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\Enu\vxcachemsg.dll
    TypeSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\vxio
    EventMessageFile    REG_SZ    C:\WINNT\system32\iologmsg.dll;C:\Program Files\Veritas\Veritas Volume Manager 5.1\ENU\vxiolog.dll;C:\WINNT\system32\Drivers\vxio.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time
    EventMessageFile    REG_SZ    C:\WINNT\system32\ws03res.dll;C:\WINNT\system32\w32time.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\W3SVC
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\iisres.dll;C:\WINNT\system32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WAM
    EventMessageFile    REG_SZ    C:\WINNT\system32\inetsrv\wam.dll
    TypesSupported    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Wd
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll;C:\WINNT\System32\Drivers\wd.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Wdf01000
    EventMessageFile    REG_SZ    C:\WINNT\System32\Drivers\wdf01000.sys
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Wdf01005
    EventMessageFile    REG_SZ    C:\WINNT\System32\spmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Wdf01007
    EventMessageFile    REG_SZ    C:\WINNT\System32\spmsgXP_2k3.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Win32k
    EventMessageFile    REG_SZ    C:\WINNT\System32\win32k.sys;C:\WINNT\System32\ws03res.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows File Protection
    EventMessageFile    REG_SZ    C:\WINNT\System32\sfc_os.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Script Host
    EventMessageFile    REG_SZ    C:\WINNT\System32\wshext.dll
    TypesSupported    REG_DWORD    0x18

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Update Agent
    EventMessageFile    REG_SZ    C:\WINNT\system32\wuaucpl.cpl
    TypesSupported    REG_DWORD    0x7
    CategoryMessageFile    REG_SZ    C:\WINNT\system32\wuaucpl.cpl
    CategoryCount    REG_DWORD    0x9

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WindowsMedia
    EventMessageFile    REG_SZ    C:\WINNT\System32\spmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WinHttpAutoProxySvc
    EventMessageFile    REG_SZ    winhttp.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WLBS
    EventMessageFile    REG_SZ    C:\WINNT\System32\drivers\wlbs.sys;C:\WINNT\System32\netevent.dll;C:\WINNT\System32\netcfgx.dll;C:\WINNT\System32\wbem\nlbmprov.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WMIxWDM
    EventMessageFile    REG_SZ    C:\WINNT\System32\IoLogMsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Workstation
    EventMessageFile    REG_SZ    C:\WINNT\System32\netmsg.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WZCSVC
    EventMessageFile    REG_SZ    C:\WINNT\System32\wzcsvc.dll
    TypesSupported    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    COM+ Event System
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\es.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem\Security
    Security    REG_BINARY    010014807C00000088000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002004C0003000000000014009D01020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem\Enum
    0    REG_SZ    Root\LEGACY_EVENTSYSTEM\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fastfat
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Boot file system
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fastfat\Enum
    0    REG_SZ    Root\LEGACY_FASTFAT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fdc
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x0
    Type    REG_DWORD    0x1
    SetupDone    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fdc\Enum
    Count    REG_DWORD    0x0
    NextInstance    REG_DWORD    0x0
    INITSTARTFAILED    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fips
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fips\Enum
    0    REG_SZ    Root\LEGACY_FIPS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\firehk.sys
    DisplayName    REG_SZ    McAfee NDIS Intermediate Filter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk\Parameters\Adapters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk\Parameters\Adapters\NdisWanBh
    UpperBindings    REG_SZ    \Device\{BA085EC1-D8EF-4895-8E03-BD0CA02AA1A7}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk\Parameters\Adapters\NdisWanIp
    UpperBindings    REG_SZ    \Device\{ADA8BAF3-D3C1-4CAC-B6CF-DBF8B852D692}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk\Parameters\Adapters\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    UpperBindings    REG_SZ    \Device\{6C70D61A-9D4F-4BFD-8866-F9BB78F7EBDF}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirehkMP
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\firehk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirehkMP\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirehkMP\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirehkMP\Enum
    0    REG_SZ    Root\MFE_FIREHKMP\0000
    Count    REG_DWORD    0x3
    NextInstance    REG_DWORD    0x3
    1    REG_SZ    Root\MFE_FIREHKMP\0001
    2    REG_SZ    Root\MFE_FIREHKMP\0002

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\firelm01
    ImagePath    REG_SZ    \??\C:\WINNT\system32\drivers\firelm01.sys
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\firelm01\Enum
    0    REG_SZ    Root\LEGACY_FIRELM01\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirePM
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\Drivers\FirePM.sys
    DisplayName    REG_SZ    McAfee HIP Component FirePM
    Group    REG_SZ    Base
    Description    REG_SZ    Host-based intrusion prevention component that blocks exploits and hacks in real-time, including malicious buffer overflow code execution and privilege escalations. If this service is disabled or stopped, the system is no longer protected against intrusions.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirePM\Parameters
    SystemImage    REG_SZ    C:\WINNT\system32\ntoskrnl.exe
    NumberOfRules    REG_DWORD    0x1b
    FirewallBootQuarantine    REG_DWORD    0x0
    Rule0    REG_BINARY    390044003300310036004300320031002D0037003700460035002D0034006100630061002D0038003400310037002D00440042004200300036003000420042003500380039003100000001010002000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004D006300410066006500650020004100670065006E007400200043006F006D006D0075006E00690063006100740069006F006E000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000100000000000001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule1    REG_BINARY    350036003200610064003200320036002D0031006500650037002D0034003300370037002D0062006200320036002D0036006300650062006500660066006100630033006100300000000101000206000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100A046000000000000000003000000000000000000000000004D006300410066006500650020002D00200041006C006C006F0077002000650050004F0020006200790020004E0061006D006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D00630041006600650065005C0043006F006D006D006F006E0020004600720061006D00650077006F0072006B005C004600720061006D00650077006F0072006B0053006500720076006900630065002E006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000010000000000000100000000000000000000000100000068D4ED000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule2    REG_BINARY    320030006300300061003400380032002D0034006100620032002D0034003800320032002D0061003000630030002D00350039006200300034003400610037006600660030006200000001010002060000000000000000000400000000000000A9B6CFB5000000000000000000000000000000000000000000000000000000000000000000000000000000000100A046000000000000000003000000000000000000000000004D006300410066006500650020002D00200041006C006C006F0077002000650050004F0020006200790020004100640064007200650073007300000000000000000000000000000000000000000000000000000000000000000000000000000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D00630041006600650065005C0043006F006D006D006F006E0020004600720061006D00650077006F0072006B005C004600720061006D00650077006F0072006B0053006500720076006900630065002E0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000000001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule3    REG_BINARY    630036003200320037003800390036002D0032006500380039002D0034006600390063002D0062003000350037002D00390030006600340034006500610035006600390037003800000001010002110004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001004300000000000000000000000000010044000000000000004D006300410066006500650020002D00200041006C006C006F007700200042006F006F00740070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000000001000000000000000000040000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule4    REG_BINARY    310039003600340032006100320033002D0036006300310031002D0034006300390037002D0038003000300036002D00620031003300390064003200640062006500660031003700000001010002110004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001003500000000000000000003000000000000000000000000004D006300410066006500650020002D00200041006C006C006F007700200044004E00530020005200650073006F006C007500740069006F006E000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000000001000000000000000000040000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule5    REG_BINARY    380063006200390032003400660036002D0066003300660036002D0034006600380034002D0038003400320030002D003600390033006400620062003500340061003600630065000000010100010600040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000100A1460000000000004D006300410066006500650020002D00200041006C006C006F00770020004100670065006E0074002000570061006B0065007500700000000000000000000000000000000000000000000000000000000000000000000000000000000000000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D00630041006600650065005C0043006F006D006D006F006E0020004600720061006D00650077006F0072006B005C004600720061006D00650077006F0072006B0053006500720076006900630065002E0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000000001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule6    REG_BINARY    310064003600310035006400330065002D0065006400300033002D0034006200330064002D0039003200370039002D0038003200370035003900370030003100620066003000370000000100000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000650050006F006C0069006300790020004F007200630068006500730074007200610074006F00720020004100670065006E0074000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000E4F700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule7    REG_BINARY    390064003700300033003400350038002D0035003300320064002D0034006300320061002D0061003600300065002D006200610034006400300065006200370037003400300038000000010100000004040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000030000000000000000000000000041006C006C006F00770020004600720061006D00650077006F0072006B002000530065007200760069006300650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004600520041004D00450057004F0052004B0053004500520056004900430045002E004500580045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule8    REG_BINARY    640066006500620062003200650032002D0032003300370035002D0034003500630034002D0062003700360034002D003400650030006200300062003700350066006300640064000000010100000004040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000030000000000000000000000000041006C006C006F007700200052006F0067007500650020004D0061006300680069006E006500200044006500740065006300740069006F006E00000000000000000000000000000000000000000000000000000000000000000000000000000052005300530045004E0053004F0052002E00450058004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule9    REG_BINARY    360035003100300032006400320030002D0064006600340031002D0034003000330038002D0062003900360034002D0035006300340036006100310061006500610037006500320000000101000206000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000100000002000004FFFF000000004D006300410066006500650020004100670065006E0074002000550070006400610074006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004D0063005300630072006900700074005F0049006E005500730065002E00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000000001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule10    REG_BINARY    330037006500300033006400300062002D0033003500360033002D0034006600360061002D0061003700370064002D0033003200350063006400360064003500390039006500620000000100000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000650050006F006C0069006300790020004F007200630068006500730074007200610074006F0072002000530065007200760065007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000E5F700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule11    REG_BINARY    640030003100330034003300640065002D0032003300300031002D0034006200640035002D0062006500350066002D006600310064003700650036006300390037003400640065000000010100020600040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000020010041604000000000000030000000000000000000000000041006C006C006F0077002000650050006F006C0069006300790020004F007200630068006500730074007200610074006F00720020005300650072007600650072000000000000000000000000000000000000000000000000000000000000004100500041004300480045002E0045005800450000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule12    REG_BINARY    360034006600350066006200310037002D0064003900610037002D0034006500340063002D0061006500320034002D003200360031003600370064006200350030006400380065000000010100020600040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000040010041604911F61220000030000000000000000000000000041006C006C006F0077002000650050006F006C0069006300790020004F007200630068006500730074007200610074006F007200200053006500720076006500720000000000000000000000000000000000000000000000000000000000000054004F004D0043004100540035002E004500580045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule13    REG_BINARY    320036003000620061006400330036002D0033006500390062002D0034003000320062002D0039006300330031002D003500300035003400660030003700340037003600620031000000010100010600040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000100FB2000000000000041006C006C006F0077002000650050006F006C0069006300790020004F007200630068006500730074007200610074006F007200200053006500720076006500720000000000000000000000000000000000000000000000000000000000000054004F004D0043004100540035002E004500580045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule14    REG_BINARY    660064003100660062006100620033002D0030003000390037002D0034003600650038002D0038006500320039002D003100300066003500390063006300640066003400380030000000010100010600040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000020000000200100416040000000041006C006C006F0077002000650050006F006C0069006300790020004F007200630068006500730074007200610074006F0072002000530065007200760065007200000000000000000000000000000000000000000000000000000000000000530051004C00530045005200560052002E00450058004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule15    REG_BINARY    300036006500370066003300650039002D0032006400660038002D0034003200300033002D0061003100640034002D0064003000390032003600360066003000390030003600620000000101000206000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100FB200000000000000000030000000000000000000000000041006C006C006F0077002000650050006F006C0069006300790020004F007200630068006500730074007200610074006F007200200043006F006E0073006F006C0065000000000000000000000000000000000000000000000000000000000049004500580050004C004F00520045002E00450058004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule16    REG_BINARY    610031006200330030006200650065002D0066006400390034002D0034003700330035002D0062003300310031002D006400350036003800640063003500390034003600350063000000010100020600040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000030010041604500000000000030000000000000000000000000041006C006C006F0077002000650050006F006C0069006300790020004F007200630068006500730074007200610074006F00720020005300650072007600650072000000000000000000000000000000000000000000000000000000000000004500560045004E0054005000410052005300450052002E00450058004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule17    REG_BINARY    620037003200620064006400630065002D0061003300380038002D0034003300330030002D0039003700330064002D0039006500660063006200390034006500300036003200320000000100000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000560050004E00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000E6F700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule18    REG_BINARY    350064006500310035003400380065002D0066003500350066002D0034006300360039002D0039006500640032002D006200360036006600390030003300660034003900620063000000010100003200040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000030000000000000000000000000041006C006C006F0077002000490050007300650063002000450053005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule19    REG_BINARY    660032006400610032006500350061002D0061006300630032002D0034003300330064002D0062003200380038002D003100320036003000330033003100620063006100640035000000010100011100040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000100F40100000000000041006C006C006F007700200049004B004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule20    REG_BINARY    340036006600320038003400630038002D0037003500390066002D0034006100620038002D0062003900340036002D003100330063003600390065003600610061003700650061000000010100002F00040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000030000000000000000000000000041006C006C006F0077002000470052004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000010001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule21    REG_BINARY    320036003300650065003300610033002D0036003700330032002D0034003000310061002D0038003700370032002D0037003400660035006500360034006400640032003100660000000101000211000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100F4010000000000000000030000000000000000000000000041006C006C006F007700200049004B00450020004F007500740062006F0075006E006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000100000000000001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule22    REG_BINARY    610066003800350033003300320030002D0036003600610033002D0034006300320039002D0062003900380034002D00650038006600310037003400390035003800620062006600000001010001060004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000004FFFF000000000000000000000100500000000000000041006C006C006F00770020004100670065006E0074002D0074006F002D00530065007200760065007200200043006F006D006D0075006E00690063006100740069006F006E0000000000000000000000000000000000000000000000000000004100500041004300480045002E0045005800450000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule23    REG_BINARY    660034003400320032003900380031002D0061003900640032002D0034003900640032002D0062006200620064002D0038006300610030006600330033003400330065006300310000000101000206000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100612200000000000000000100000002000004FFFF0000000041006C006C006F007700200075007000640061007400650073002000660072006F006D0020004D0079004100760065007200740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004D0053004800540041002E00450058004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000001000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule24    REG_BINARY    630033006500330038006600380030002D0065003800340064002D0034006100310030002D0062006400330031002D003300320065003000630031006200380038003700330030000000010100021100040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010043000000000000000000000000000100440000000000000041006C006C006F007700200062006F006F00740070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000010001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule25    REG_BINARY    610065006300650032003200360066002D0031006200300037002D0034006300350062002D0038006600370066002D003600380064003400310066006500610032003800370036000000010100021100040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010035000000000000000000030000000000000000000000000041006C006C006F007700200044004E005300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000010001000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Rule26    REG_BINARY    660031003300660033003600630061002D0037003600350032002D0034006400650037002D0039003900390036002D0039003100350036003500640066003700360066006200390000000101000206000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100500000000000000000000100000002000004FFFF000000004D00630041006600650065002000560061006C00690064006100740069006F006E002000540072007500730074002000500072006F00740065006300740069006F006E00200053006500720076006900630065000000000000000000000000006D006600650076007400700073002E006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000007F01000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    RulesHashSum    REG_BINARY    D203D1D16753F8F1811893E58033C2BA

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirePM\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirePM\Enum
    0    REG_SZ    Root\LEGACY_FIREPM\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FireTDI
    (Default)    REG_SZ    
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    \??\C:\WINNT\system32\Drivers\FireTDI.sys
    DisplayName    REG_SZ    McAfee HIP Component FireTDI
    Group    REG_SZ    PNP_TDI
    DependOnService    REG_MULTI_SZ    TCPIP
    Description    REG_SZ    Host-based intrusion prevention component that blocks exploits and hacks in real-time, including malicious buffer overflow code execution and privilege escalations. If this service is disabled or stopped, the system is no longer protected against intrusions.
    Tag    REG_DWORD    0x7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FireTDI\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FireTDI\Enum
    0    REG_SZ    Root\LEGACY_FIRETDI\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Flpydisk
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Primary disk
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x2
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Flpydisk\Enum
    Count    REG_DWORD    0x0
    NextInstance    REG_DWORD    0x0
    INITSTARTFAILED    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x4
    ImagePath    REG_SZ    system32\DRIVERS\fltMgr.sys
    DisplayName    REG_SZ    FltMgr
    Group    REG_SZ    FSFilter Infrastructure
    Description    REG_SZ    File System Filter Manager Driver
    AttachWhenLoaded    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr\Enum
    0    REG_SZ    Root\LEGACY_FLTMGR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fs_Rec
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Boot file system
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x8

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fs_Rec\Enum
    0    REG_SZ    Root\LEGACY_FS_REC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ftdisk
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x9
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Volume Manager Driver
    ImagePath    REG_SZ    system32\DRIVERS\ftdisk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ftdisk\Enum
    0    REG_SZ    Root\ftdisk\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Gpc
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x6
    ImagePath    REG_SZ    system32\DRIVERS\msgpc.sys
    DisplayName    REG_SZ    Generic Packet Classifier
    Group    REG_SZ    PNP_TDI
    Description    REG_SZ    Generic Packet Classifier

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Gpc\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Gpc\Parameters\Winsock
    HelperDllName    REG_SZ    C:\WINNT\System32\wshqos.dll
    MaxSockAddrLength    REG_DWORD    0x10
    MinSockAddrLength    REG_DWORD    0x10
    Mapping    REG_BINARY    0A00000003000000020000000100000006000000020000000100000000000000020000000000000006000000000000000000000006000000000000000100000006000000020000000200000011000000020000000200000000000000020000000000000011000000000000000000000011000000000000000200000011000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Gpc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Gpc\Enum
    0    REG_SZ    Root\LEGACY_GPC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GUARDIUM_STAP
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\guardium\guardium_stap\guardium_stap\guardium_stapr.exe"
    DisplayName    REG_SZ    GUARDIUM_STAP
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Tap DataBase activity and sends it to the Guard machine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GUARDIUM_STAP\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GUARDIUM_STAP\Enum
    0    REG_SZ    Root\LEGACY_GUARDIUM_STAP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Help and Support
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    FailureActions    REG_BINARY    8051010000000000000000000300000038C14804010000006400000001000000640000000000000064000000
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc\Parameters
    ServiceDll    REG_SZ    C:\WINNT\PCHealth\HelpCtr\Binaries\pchsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc\Security
    Security    REG_BINARY    0100148078000000840000001400000044000000020030000200000002801400FF010F000101000000000001000000000240140070000C00010100000000000100000000020034000200000000001800FF010F000102000000000005200000002002000000001400FF010F00010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc\Enum
    0    REG_SZ    Root\LEGACY_HELPSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ
    DependOnService    REG_MULTI_SZ    RpcSs
    Description    REG_SZ    Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    HID Input Service
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\hidserv.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ\Enum
    0    REG_SZ    Root\LEGACY_HIDSERV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidusb
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    DisplayName    REG_SZ    Microsoft HID Class Driver
    ImagePath    REG_SZ    system32\DRIVERS\hidusb.sys
    Group    REG_SZ    extended base
    Tag    REG_DWORD    0x5

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidusb\Enum
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    0    REG_SZ    USB\Vid_03f0&Pid_1027&MI_00\7&3b124f76&0&0000
    1    REG_SZ    USB\Vid_03f0&Pid_1027&MI_01\7&3b124f76&0&0001

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPK
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\HIPK.sys
    DisplayName    REG_SZ    McAfee Inc. HIPK
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPK\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPK\Enum
    0    REG_SZ    Root\LEGACY_HIPK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPPSK
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\HIPPSK.sys
    DisplayName    REG_SZ    McAfee Inc. HIPPSK
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPPSK\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPPSK\Enum
    0    REG_SZ    Root\LEGACY_HIPPSK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPQK
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\HIPQK.sys
    DisplayName    REG_SZ    McAfee Inc. HIPQK
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPQK\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPQK\Enum
    0    REG_SZ    Root\LEGACY_HIPQK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hips
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    "C:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\HIPSvc.exe"
    DisplayName    REG_SZ    McAfee HIPSCore Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides McAfee system monitoring and protection of your computer system.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hips\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hips\Enum
    0    REG_SZ    Root\LEGACY_HIPS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpcisss
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3e
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpcisss\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpcisss\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpCISSs2
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    Group    REG_SZ    SCSI miniport
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\HpCISSs2.sys
    tag    REG_DWORD    0x103

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpCISSs2\Parameters
    BusType    REG_DWORD    0x8

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpCISSs2\Parameters\Device
    DriverParameter    REG_SZ    CSMI=None;
    OSVersion    REG_SZ    5.2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpCISSs2\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpCISSs2\Enum
    0    REG_SZ    PCI\VEN_103C&DEV_3230&SUBSYS_3234103C&REV_03\4&22febb0d&0&0060
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpn
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpn\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpn\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpqilo2
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\hpqilo2.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpqilo2\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpqilo2\Enum
    0    REG_SZ    PCI\VEN_103C&DEV_3302&SUBSYS_3305103C&REV_00\4&21887ae&0&2648
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpt3xx
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3b
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpt3xx\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpt3xx\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPWMISTOR
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\Program Files\HPWBEM\Storage\Service\HPWMISTOR.exe
    DisplayName    REG_SZ    HP WMI Storage Providers
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    HP WMI Storage Providers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPWMISTOR\CPQMSCSI
    Timeout    REG_DWORD    0x1d4c0
    DisplayName    REG_SZ    SCSI Information

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPWMISTOR\CPQSAS
    Timeout    REG_DWORD    0x1d4c0
    DisplayName    REG_SZ    SAS Information

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPWMISTOR\Parameters
    Debug    REG_DWORD    0x0
    SubServices    REG_MULTI_SZ    CPQMSCSI\0CPQSAS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPWMISTOR\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPWMISTOR\Enum
    0    REG_SZ    Root\LEGACY_HPWMISTOR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP
    DisplayName    REG_SZ    HTTP
    Description    REG_SZ    This service implements the hypertext transfer protocol (HTTP). If this service is disabled, any services that explicitly depend on it will fail to start.
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    System32\Drivers\HTTP.sys
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
    DisableServerHeader    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\UrlAclInfo

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\Synchronize

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D01020001010000000000050B00000000001800FD0102000102000000000005200000002302000000001400140000000101000000000005040000000000140014000000010100000000000506000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Enum
    0    REG_SZ    Root\LEGACY_HTTP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPFilter
    DependOnService    REG_MULTI_SZ    HTTP\0IISADMIN
    Description    REG_SZ    This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service,  using the Secure Socket Layer (SSL).  If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    HTTP SSL
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\lsass.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i2omgmt
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI Class
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x2d
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i2omp
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x2d
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i2omp\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i2omp\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    Group    REG_SZ    Keyboard Port
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    i8042 Keyboard and PS/2 Mouse Port Driver
    ImagePath    REG_SZ    system32\DRIVERS\i8042prt.sys
    Tag    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
    PollingIterations    REG_DWORD    0x2ee0
    PollingIterationsMaximum    REG_DWORD    0x2ee0
    ResendIterations    REG_DWORD    0x3
    LayerDriver JPN    REG_SZ    kbd101.dll
    LayerDriver KOR    REG_SZ    kbd101a.dll
    KeyboardFailedReset    REG_DWORD    0x0
    Headless    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Enum
    0    REG_SZ    ACPI\PNP0303\4&142b453b&0
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    ACPI\PNP0F13\4&142b453b&0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBMTivoliCommonAgent0
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\tivoli\ep\runtime\agent\nonstop.exe" @"C:\Program Files\tivoli\ep\runtime\agent\config\nonstop.properties"
    DisplayName    REG_SZ    Tivoli Common Agent - 'C:\Program Files\tivoli\ep\runtime\agent'
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides shared services for Tivoli products

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBMTivoliCommonAgent0\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBMTivoliCommonAgent0\Enum
    0    REG_SZ    Root\LEGACY_IBMTIVOLICOMMONAGENT0\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IDriverT
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
    DisplayName    REG_SZ    InstallDriver Table Manager
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides support for the Running Object Table for InstallShield Drivers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IDriverT\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IDriverT\Enum
    0    REG_SZ    Root\LEGACY_IDRIVERT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iirsp
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x2d
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iirsp\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iirsp\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\inetsrv\inetinfo.exe
    DisplayName    REG_SZ    IIS Admin Service
    DependOnService    REG_MULTI_SZ    RPCSS\0SamSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables this server to administer Web and FTP services. If this service is stopped, the server will be unable to run Web, FTP, NNTP, or SMTP sites or configure IIS. If this service is disabled, any services that explicitly depend on it will fail to start.
    InetinfoW3CoreLaunchEventName    REG_SZ    Global\W3SVCStartW3WP-965fbe33-9d21-4b92-a845-48fe1415cae0
    FailureCommand    REG_SZ    "C:\WINNT\system32\iisreset.exe" /start /fail=%1%
    FailureActions    REG_BINARY    8051010001000000010000000300000053006500030000000100000003000000010000000300000001000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN\Enum
    0    REG_SZ    Root\LEGACY_IISADMIN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\imapi
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x4
    ImagePath    REG_SZ    system32\DRIVERS\imapi.sys
    DisplayName    REG_SZ    CD-Burning Filter Driver
    Group    REG_SZ    Pnp Filter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\imapi\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\imapi\Enum
    Count    REG_DWORD    0x0
    NextInstance    REG_DWORD    0x0
    INITSTARTFAILED    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ImapiService
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\imapi.exe
    ObjectName    REG_SZ    LocalSystem
    DisplayName    REG_SZ    IMAPI CD-Burning COM Service
    Description    REG_SZ    Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IndexManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\indexmgr.exe
    DisplayName    REG_SZ    WMS Index Manager
    ObjectName    REG_SZ    eur\ldngtssvcorb01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IndexManager\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IndexManager\Enum
    0    REG_SZ    Root\LEGACY_INDEXMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\inetaccs
    (Default)    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\inetaccs\Parameters
    (Default)    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
    ListenBackLog    REG_DWORD    0x19
    DispatchEntries    REG_MULTI_SZ    \0?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Performance
    Library    REG_SZ    infoctrs.dll
    Open    REG_SZ    OpenINFOPerformanceData
    Close    REG_SZ    CloseINFOPerformanceData
    Collect    REG_SZ    CollectINFOPerformanceData
    PerfIniFile    REG_SZ    infoctrs.ini
    Last Counter    REG_DWORD    0x9a6
    Last Help    REG_DWORD    0x9a7
    First Counter    REG_DWORD    0x966
    First Help    REG_DWORD    0x967
    Object List    REG_SZ    2406
    Library Validation Code    REG_BINARY    002F061834A5C8010020000000000000
    2003    REG_NONE    76837BC18D0FCB01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inport

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inport\Parameters
    HzMode    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntelIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectFlowMPSSvc
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "D:\IntellectFlow\IntellectMPSServer\IntellectFlowMPS.exe"
    DependOnService    REG_MULTI_SZ    MSSQLSERVER
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Swift/RCX Message File Processing Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectFlowMPSSvc\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectFlowMPSSvc\Enum
    0    REG_SZ    Root\LEGACY_INTELLECTFLOWMPSSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectMailService
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "D:\IntellectFlow\IntellectMailService\IntellectMailService.exe"
    ObjectName    REG_SZ    LocalSystem
    DisplayName    REG_SZ    IntellectMailService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectMailService\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectMailService\Enum
    0    REG_SZ    Root\LEGACY_INTELLECTMAILSERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectPickList
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "D:\IntellectFlow\IntellectPicklist\IntellectPickListSrv.exe"
    DisplayName    REG_SZ    IntellectPickList
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectPickList\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectPickList\Enum
    0    REG_SZ    Root\LEGACY_INTELLECTPICKLIST\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectUpload
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "D:\IntellectFlow\IntellectUpload\IntellectUpload.exe"
    DisplayName    REG_SZ    IntellectUpload
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectUpload\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntellectUpload\Enum
    0    REG_SZ    Root\LEGACY_INTELLECTUPLOAD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ip6Fw
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\Ip6Fw.sys
    DisplayName    REG_SZ    IPv6 Windows Firewall Driver
    Description    REG_SZ    Provides intrusion prevention service for a home or small office network.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ip6Fw\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpFilterDriver
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\ipfltdrv.sys
    DisplayName    REG_SZ    IP Traffic Filter Driver
    DependOnService    REG_MULTI_SZ    Tcpip
    Description    REG_SZ    IP Traffic Filter Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpFilterDriver\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpInIp
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\ipinip.sys
    DisplayName    REG_SZ    IP in IP Tunnel Driver
    DependOnService    REG_MULTI_SZ    Tcpip
    Description    REG_SZ    IP in IP Tunnel Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpInIp\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpNat
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\ipnat.sys
    DisplayName    REG_SZ    IP Network Address Translator
    DependOnService    REG_MULTI_SZ    Tcpip
    Description    REG_SZ    IP Network Address Translator

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpNat\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpNat\Enum
    0    REG_SZ    Root\LEGACY_IPNAT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x4
    ImagePath    REG_SZ    system32\DRIVERS\ipsec.sys
    DisplayName    REG_SZ    IPSEC driver
    Group    REG_SZ    PNP_TDI
    Description    REG_SZ    IPSEC driver
    NoDefaultExempt    REG_DWORD    0x3
    BootExemptList    REG_BINARY    01000000100000001101000044000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\Performance
    Open    REG_SZ    OpenIPSecPerformanceData
    Close    REG_SZ    CloseIPSecPerformanceData
    Collect    REG_SZ    CollectIPSecPerformanceData
    Library    REG_SZ    C:\WINNT\System32\winipsec.dll
    PerfIniFile    REG_SZ    ipsecprf.ini
    Last Counter    REG_DWORD    0x792
    Last Help    REG_DWORD    0x793
    First Counter    REG_DWORD    0x738
    First Help    REG_DWORD    0x739
    WbemAdapFileSignature    REG_BINARY    1E3CEABF63C7D5559FAF4AEF9266D221
    WbemAdapFileTime    REG_BINARY    00B628BB5862C701
    WbemAdapFileSize    REG_DWORD    0x9000
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\Enum
    0    REG_SZ    Root\LEGACY_IPSEC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ipsraidn
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x35
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ipsraidn\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ipsraidn\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ISAPISearch

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ISAPISearch\Linkage
    Bind    REG_SZ    \Dummy
    Export    REG_SZ    \Dummy
    Route    REG_SZ    \Dummy

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ISAPISearch\Performance
    Close    REG_SZ    DoneCIISAPIPerformanceData
    Collect    REG_SZ    CollectCIISAPIPerformanceData
    Open    REG_SZ    InitializeCIISAPIPerformanceData
    Library    REG_SZ    C:\WINNT\System32\query.dll
    PerfIniFile    REG_SZ    perfwci.ini
    WbemAdapFileSignature    REG_BINARY    589936DA5DB61D530F04311BC323DB44
    WbemAdapFileTime    REG_BINARY    D4DC89B95862C701
    WbemAdapFileSize    REG_DWORD    0x15dc00
    WbemAdapStatus    REG_DWORD    0x0
    Last Counter    REG_DWORD    0x250a
    Last Help    REG_DWORD    0x250b
    First Counter    REG_DWORD    0x24f6
    First Help    REG_DWORD    0x24f7
    Object List    REG_SZ    9462

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\isapnp
    ErrorControl    REG_DWORD    0x3
    Group    REG_SZ    Boot Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x3
    Type    REG_DWORD    0x1
    HasBootConfig    REG_DWORD    0x0
    DisplayName    REG_SZ    PnP ISA/EISA Bus Driver
    ImagePath    REG_SZ    system32\DRIVERS\isapnp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\isapnp\Parameters
    ADP1502    REG_DWORD    0x1
    ADP1505    REG_DWORD    0x1
    ADP1510    REG_DWORD    0x1
    ADP1512    REG_DWORD    0x1
    ADP1515    REG_DWORD    0x1
    ADP1520    REG_DWORD    0x1
    ADP1522    REG_DWORD    0x1
    ADP3015    REG_DWORD    0x1
    ADP3215    REG_DWORD    0x1
    ADP6360    REG_DWORD    0x1
    ADP6370    REG_DWORD    0x1
    USR0014    REG_DWORD    0x1
    USR1001    REG_DWORD    0x1
    USR1002    REG_DWORD    0x1
    USR1003    REG_DWORD    0x1
    USR1004    REG_DWORD    0x1
    USR6001    REG_DWORD    0x1
    USR6002    REG_DWORD    0x1
    USR6003    REG_DWORD    0x1
    USR6004    REG_DWORD    0x1
    USR6005    REG_DWORD    0x1
    USR6006    REG_DWORD    0x1
    USR6007    REG_DWORD    0x1
    USR6008    REG_DWORD    0x1
    USR6009    REG_DWORD    0x1
    USR600A    REG_DWORD    0x1
    USR600B    REG_DWORD    0x1
    USR600C    REG_DWORD    0x1
    USR600D    REG_DWORD    0x1
    USR600E    REG_DWORD    0x1
    USR600F    REG_DWORD    0x1
    USR6010    REG_DWORD    0x1
    USR6011    REG_DWORD    0x1
    USR6012    REG_DWORD    0x1
    USR6101    REG_DWORD    0x1
    USR6020    REG_DWORD    0x1
    USR0041    REG_DWORD    0x1
    USR002C    REG_DWORD    0x1
    AZT4029    REG_DWORD    0x1
    AZT4023    REG_DWORD    0x1
    USR0040    REG_DWORD    0x1
    HAY8601    REG_DWORD    0x1
    EQX2400    REG_DWORD    0x2
    EQX0900    REG_DWORD    0x2
    EQX1B00    REG_DWORD    0x2
    EQX1700    REG_DWORD    0x2
    EQX0700    REG_DWORD    0x2
    EQX0F00    REG_DWORD    0x2
    EQX0800    REG_DWORD    0x2
    EQX1000    REG_DWORD    0x2
    EQX3F00    REG_DWORD    0x2
    EQX1200    REG_DWORD    0x2
    IBM0001    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\isapnp\Enum
    0    REG_SZ    PCI\VEN_10DE&DEV_0051&SUBSYS_00000000&REV_B1\3&20fea912&0&08
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IsmServ
    DependOnService    REG_MULTI_SZ    SamSS
    Description    REG_SZ    Enables messages to be exchanged between computers running Windows Server sites. If this service is stopped, messages will not be exchanged, nor will site routing information be calculated for other services.  If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Intersite Messaging
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\ismserv.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JBOSS_3.2.4_bmc_service
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\BMCSOF~1\common\jboss\3.2.4\bin\wrapper.exe -s C:\apps_srv\BMCSOF~1\common\jboss\3.2.4\conf\bmc.conf
    DisplayName    REG_SZ    BMC JBOSS 3.2.4 Cfg bmc Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    JBOSS 3.2.4 Service for BMC tools Configuration(bmc)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JBOSS_3.2.4_bmc_service\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JBOSS_3.2.4_bmc_service\Enum
    0    REG_SZ    Root\LEGACY_JBOSS_3.2.4_BMC_SERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kbdclass
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Keyboard Class
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Keyboard Class Driver
    ImagePath    REG_SZ    system32\DRIVERS\kbdclass.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kbdclass\Parameters
    ConnectMultiplePorts    REG_DWORD    0x0
    KeyboardDataQueueSize    REG_DWORD    0x64
    KeyboardDeviceBaseName    REG_SZ    KeyboardClass
    MaximumPortsServiced    REG_DWORD    0x3
    SendOutputToAllPorts    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kbdclass\Enum
    0    REG_SZ    Root\RDP_KBD\0000
    Count    REG_DWORD    0x3
    NextInstance    REG_DWORD    0x3
    1    REG_SZ    ACPI\PNP0303\4&142b453b&0
    2    REG_SZ    HID\Vid_03f0&Pid_1027&MI_00\8&2270823c&0&0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    Group    REG_SZ    Keyboard Port
    ErrorControl    REG_DWORD    0x0
    DisplayName    REG_SZ    Keyboard HID Driver
    ImagePath    REG_SZ    system32\DRIVERS\kbdhid.sys
    Tag    REG_DWORD    0x5

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters
    WorkNicely    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Enum
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1
    INITSTARTFAILED    REG_DWORD    0x1
    0    REG_SZ    HID\Vid_03f0&Pid_1027&MI_00\8&2270823c&0&0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kdc
    DependOnService    REG_MULTI_SZ    RpcSs\0Afd
    Description    REG_SZ    On domain controllers this service enables users to log on to the network using the Kerberos authentication protocol. If this service is stopped on a domain controller, users will be unable to log on to the network. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Kerberos Key Distribution Center
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    MS_WindowsRemoteValidation
    ImagePath    REG_SZ    C:\WINNT\System32\lsass.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kdc\Security
    Security    REG_BINARY    010014809C000000A80000001400000034000000020020000100000002801800FF010F00010100000000000100000000200200000200680004000000000318008D0002000101000000000001000000000000000000031800FF010F0001020000000000052000000020020000000318008F00020001020000000000052000000023020000000318009D00000001010000000000050400000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KSecDD
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Base
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KSecDD\Enum
    0    REG_SZ    Root\LEGACY_KSECDD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\l2nd
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0xa
    ImagePath    REG_SZ    system32\DRIVERS\bxnd52x.sys
    DisplayName    REG_SZ    HP NC370 Multifunction Gigabit Server Adapter
    Group    REG_SZ    ndis

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\l2nd\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\l2nd\Enum
    0    REG_SZ    B06BDRV\L2ND&PCI_164A14E4&SUBSYS_1709103C&REV_02\5&b64f98d&0&20054101
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    B06BDRV\L2ND&PCI_164A14E4&SUBSYS_1709103C&REV_02\5&2945e16&0&20054102

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Server
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\AutotunedParameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity
    SrvsvcConfigInfo    REG_BINARY    010004808C00000098000000000000001400000002007800050000000000180017000F00010200000000000520000000200200000000180017000F00010200000000000520000000250200000000140017000F00010100000000000512000000000018000300000001020000000000052000000023020000000014000100000001010000000000050B000000010100000000000512000000010100000000000512000000
    SrvsvcTransportEnum    REG_BINARY    010004808C00000098000000000000001400000002007800050000000000180017000F00010200000000000520000000200200000000180017000F00010200000000000520000000250200000000140017000F00010100000000000512000000000018000300000001020000000000052000000023020000000014000100000001010000000000050B000000010100000000000512000000010100000000000512000000
    SrvsvcConnection    REG_BINARY    010004807C00000088000000000000001400000002006800040000000000180001000F00010200000000000520000000200200000000180001000F0001020000000000052000000025020000000018000100000001020000000000052000000026020000000018000100000001020000000000052000000023020000010100000000000512000000010100000000000512000000
    SrvsvcServerDiskEnum    REG_BINARY    010004804C00000058000000000000001400000002003800020000000000180001000F00010200000000000520000000200200000000180001000F0001020000000000052000000025020000010100000000000512000000010100000000000512000000
    SrvsvcFile    REG_BINARY    010004806400000070000000000000001400000002005000030000000000180011000F00010200000000000520000000200200000000180011000F00010200000000000520000000250200000000180011000F0001020000000000052000000023020000010100000000000512000000010100000000000512000000
    SrvsvcSessionInfo    REG_BINARY    010004807800000084000000000000001400000002006400040000000000180013000F00010200000000000520000000200200000000180013000F00010200000000000520000000250200000000180013000F0001020000000000052000000023020000000014000100000001010000000000050B000000010100000000000512000000010100000000000512000000
    SrvsvcShareFileInfo    REG_BINARY    010004807800000084000000000000001400000002006400040000000000180013000F00010200000000000520000000200200000000180013000F00010200000000000520000000250200000000180013000F0001020000000000052000000023020000000014000100000001010000000000050B000000010100000000000512000000010100000000000512000000
    SrvsvcSharePrintInfo    REG_BINARY    01000480900000009C000000000000001400000002007C00050000000000180013000F00010200000000000520000000200200000000180013000F00010200000000000520000000250200000000180013000F00010200000000000520000000260200000000180013000F0001020000000000052000000023020000000014000100000001010000000000050B000000010100000000000512000000010100000000000512000000
    SrvsvcShareAdminInfo    REG_BINARY    010004807800000084000000000000001400000002006400040000000000180013000F0001020000000000052000000020020000000018000200000001020000000000052000000025020000000018000200000001020000000000052000000023020000000014000100000001010000000000050B000000010100000000000512000000010100000000000512000000
    SrvsvcShareConnect    REG_BINARY    010004808C00000098000000000000001400000002007800050000000000180003000F00010200000000000520000000200200000000180003000F00010200000000000520000000250200000000180003000F000102000000000005200000002702000000001400010000000101000000000001000000000000140001000000010100000000000507000000010100000000000512000000010100000000000512000000
    SrvsvcShareAdminConnect    REG_BINARY    010004806400000070000000000000001400000002005000030000000000180003000F00010200000000000520000000200200000000180003000F00010200000000000520000000250200000000180003000F0001020000000000052000000027020000010100000000000512000000010100000000000512000000
    SrvsvcStatisticsInfo    REG_BINARY    01000480600000006C000000000000001400000002004C00030000000000180001000F00010200000000000520000000200200000000180001000F00010200000000000520000000250200000000140001000000010100000000000200000000010100000000000512000000010100000000000512000000
    AnonymousDescriptorsUpgraded    REG_DWORD    0x1
    PreviousAnonymousRestriction    REG_DWORD    0x1
    SessionSecurityDescriptorRegenerated    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Linkage
    Bind    REG_MULTI_SZ    \Device\NetbiosSmb\0\Device\NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}
    Route    REG_MULTI_SZ    "NetbiosSmb"\0"NetBT" "CPQTeam" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NetBT" "Tcpip" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NetBT" "Tcpip" "NdisWanIp"
    Export    REG_MULTI_SZ    \Device\LanmanServer_NetbiosSmb\0\Device\LanmanServer_NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\LanmanServer_NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\LanmanServer_NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\LanmanServer_NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
    autodisconnect    REG_DWORD    0xf
    enableforcedlogoff    REG_DWORD    0x1
    enablesecuritysignature    REG_DWORD    0x1
    requiresecuritysignature    REG_DWORD    0x0
    restrictnullsessaccess    REG_DWORD    0x1
    NullSessionPipes    REG_MULTI_SZ    COMNAP\0COMNODE\0SQL\QUERY\0SPOOLSS\0NETLOGON\0LSARPC\0SAMR\0BROWSER\0SysExec
    NullSessionShares    REG_MULTI_SZ    COMCFG\0DFS$
    ServiceDll    REG_SZ    C:\WINNT\System32\srvsvc.dll
    Lmannounce    REG_DWORD    0x0
    Size    REG_DWORD    0x3
    AdjustedNullSessionPipes    REG_DWORD    0x1
    CachedOpenLimit    REG_DWORD    0x0
    SizReqBuf    REG_DWORD    0x14596
    srvcomment    REG_SZ    Orbiflow SSA UAT Application Server
    IrpStackSize    REG_DWORD    0x10
    Guid    REG_BINARY    668CA874100FFD4FAD181FC50F537653

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares
    OrbiflowImage    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\OrbiflowImage\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    OrbiUnzip    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\OrbiUnzip\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    OrbiflowApps    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\OrbiflowApps\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    OrbiflowData    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\OrbiflowData\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    dbagroup_D    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\data\data_srv\dbagroup\0Permissions=0\0Remark=\0Type=0
    dbagroup_e    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=E:\data\data_srv\dbagroup\0Permissions=0\0Remark=\0Type=0
    IWLETTERS    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\IntellectUpload\Imagesource\uploadsource\IWLETTERS\0Permissions=0\0Remark=\0Type=0
    CAM    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CAM\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    DRC    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\DRC\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CDI    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CDI\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    KEN    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\KEN\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    TZN    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\TZN\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    ZAM    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\ZAM\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA_EFT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\EFT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA_REPAIR_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\REPAIR\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA_MT    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\MT 210\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA_MTMS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\MTMS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    RSA_SWIFT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\RSA\SWIFT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CAM_CamFTNewFlexC_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CAM\CamFTNewFlexC\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CAM_Cam_FT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CAM\Cam_FT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CAM_CAM_MT_910_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CAM\CAM_MT_910\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CAM_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CAM\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    DRC_DRC_FT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\DRC\DRC_FT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    DRC_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\DRC\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB_GAB_FT_MT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\GAB_FT_MT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB_GbFlexcFcyFtInward_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\GbFlexcFcyFtInward\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB_GAB_MT_910_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\GAB_MT_910\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB_GAB_FFT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\GAB_FFT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    GAB_GABON_FLEXC_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\GAB\GABON_FLEXC\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CDI_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CDI\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CDI_MT202_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CDI\MT202\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CDI_MT200_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CDI\MT200\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CDI_MT103_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CDI\MT103\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    CDI_MT100_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\CDI\MT100\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    KEN_KEN_FT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\KEN\KEN_FT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    KEN_KEN_GEN_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\KEN\KEN_GEN\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    KEN_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\KEN\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_RCX_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\RCX\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_AutoRej999_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\AutoRej999\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_AutoRej_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\AutoRej\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MTHold_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MTHold\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MTFreeFT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MTFreeFT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MTFree_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MTFree\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MT910_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MT910\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MT202_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MT202\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MT100_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MT100\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MT101_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MT101\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    NGR_MT103_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\NGR\MT103\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_MT103_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_MT103\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_ALL_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_ALL\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_MT999_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_MT999\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_MT910_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_MT910\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_MT900_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_MT900\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_MT196_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_MT196\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    SEN_SEN_MT199_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\SEN\SEN_MT199\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    TZN_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\TZN\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    TZN_TZN_FT_32B_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\TZN\TZN_FT_32B\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    TZN_TZN_FT_GP2_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\TZN\TZN_FT_GP2\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    TZN_TZN_FT_FX1_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\TZN\TZN_FT_FX1\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    TZN_TZN_FT_FT1_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\TZN\TZN_FT_FT1\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_FT910_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_FT910\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_FT900_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_FT900\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_Rcx_70T_00R_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_Rcx_70T_00R\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_Rcx_101_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_Rcx_101\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_Ugn_MT70T_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\Ugn_MT70T\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UgnInTrf_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UgnInTrf\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_FT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_FT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_MT202_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\MT202\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_FT950_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_FT950\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_FT940_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_FT940\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    UGD_UGN_FT300_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\UGD\UGN_FT300\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    ZAM_RCS_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\ZAM\RCS\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    ZAM_ZAM_FT_SpoolFile    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\MsgProcPaths\ZAM\ZAM_FT\SpoolFile\0Permissions=0\0Remark=Shared by remote command.\0Type=0
    error_folder    REG_MULTI_SZ    CSCFlags=0\0MaxUses=4294967295\0Path=D:\IntellectFlow\IntellectUpload\Imagesource\UploadErrorPath\0Permissions=0\0Remark=\0Type=0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares\Security
    OrbiflowImage    REG_BINARY    0100048028030000380300000000000014000000020014031600000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC4E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC5E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC6E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC8E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC9E8020000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E658040000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E558040000002400BF011300010500000000000515000000093A2A2432621F2A828BA62813C2010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6280496010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6285C00010000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E25E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E35E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E45E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E55E060000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B20F9000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B8AA3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B89A3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B6ACD010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B67CD010000002400BF011300010500000000000515000000F89FB474625CBC06235F636B464A060000002400BF011300010500000000000515000000F89FB474625CBC06235F636BF28D090000001800FF011F000102000000000005200000002002000001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    OrbiUnzip    REG_BINARY    010004807003000080030000000000001400000002005C031800000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC4E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC5E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC6E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC8E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC9E8020000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E658040000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E558040000002400BF011300010500000000000515000000093A2A2432621F2A828BA62813C2010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6280496010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6285C00010000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E25E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E35E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E45E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E55E060000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B20F9000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B8AA3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B89A3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B6ACD010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B67CD010000002400BF011300010500000000000515000000F89FB474625CBC06235F636B464A060000002400BF011300010500000000000515000000F89FB474625CBC06235F636BF28D090000001800FF011F000102000000000005200000002002000000002400BF011300010500000000000515000000093A2A2432621F2A828BA6288342120000002400BF011300010500000000000515000000093A2A2432621F2A828BA6288142120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    OrbiflowApps    REG_BINARY    0100048028030000380300000000000014000000020014031600000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC4E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC5E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC6E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC8E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC9E8020000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E658040000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E558040000002400BF011300010500000000000515000000093A2A2432621F2A828BA62813C2010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6280496010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6285C00010000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E25E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E35E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E45E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E55E060000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B20F9000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B8AA3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B89A3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B6ACD010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B67CD010000002400BF011300010500000000000515000000F89FB474625CBC06235F636B464A060000002400BF011300010500000000000515000000F89FB474625CBC06235F636BF28D090000001800FF011F000102000000000005200000002002000001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    OrbiflowData    REG_BINARY    0100048028030000380300000000000014000000020014031600000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC4E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC5E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC6E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC8E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC9E8020000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E658040000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E558040000002400BF011300010500000000000515000000093A2A2432621F2A828BA62813C2010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6280496010000002400BF011300010500000000000515000000093A2A2432621F2A828BA6285C00010000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E25E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E35E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E45E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E55E060000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B20F9000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B8AA3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B89A3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B6ACD010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B67CD010000002400BF011300010500000000000515000000F89FB474625CBC06235F636B464A060000002400BF011300010500000000000515000000F89FB474625CBC06235F636BF28D090000001800FF011F000102000000000005200000002002000001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    dbagroup_D    REG_BINARY    0100048054000000640000000000000014000000020040000200000000042400FF011F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000041400A900120001010000000000010000000001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    dbagroup_e    REG_BINARY    0100048054000000640000000000000014000000020040000200000000042400FF011F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000041400A900120001010000000000010000000001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    IWLETTERS    REG_BINARY    0100048028030000380300000000000014000000020014031600000000002400BF011300010500000000000515000000F89FB474625CBC06235F636B464A060000001800FF011F000102000000000005200000002002000000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B6ACD010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B67CD010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B8AA3010000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B89A3010000002400BF011300010500000000000515000000093A2A2432621F2A828BA62813C2010000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E658040000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E558040000002400BF011300010500000000000515000000093A2A2432621F2A828BA6280496010000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E45E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E25E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E55E060000002400BF011300010500000000000515000000093A2A2432621F2A828BA628E35E060000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC6E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC4E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC8E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC5E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2BC9E8020000002400BF0113000105000000000005150000005729024C507B9E5F07E53B2B20F9000000002400BF011300010500000000000515000000093A2A2432621F2A828BA6285C00010000002400BF011300010500000000000515000000F89FB474625CBC06235F636BF28D090001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CAM    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C845120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628DA45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    DRC    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CDI    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CB45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    KEN    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CC45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    TZN    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D045120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    ZAM    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D245120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA_EFT_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA_REPAIR_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA_MT    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA_MTMS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    RSA_SWIFT_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CF45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CAM_CamFTNewFlexC_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C845120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628DA45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CAM_Cam_FT_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C845120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628DA45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CAM_CAM_MT_910_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C845120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628DA45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CAM_RCS_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C845120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628DA45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    DRC_DRC_FT_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    DRC_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628C945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB_RCS_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB_GAB_FT_MT_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB_GbFlexcFcyFtInward_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB_GAB_MT_910_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB_GAB_FFT_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    GAB_GABON_FLEXC_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CA45120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D945120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CDI_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CB45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CDI_MT202_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CB45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CDI_MT200_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CB45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CDI_MT103_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CB45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    CDI_MT100_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CB45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    KEN_KEN_FT_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CC45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    KEN_KEN_GEN_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CC45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    KEN_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CC45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_RCX_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_AutoRej999_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_AutoRej_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MTHold_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MTFreeFT_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MTFree_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MT910_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MT202_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MT100_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MT101_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    NGR_MT103_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CD45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_MT103_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_ALL_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_MT999_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_MT910_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_MT900_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_MT196_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    SEN_SEN_MT199_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628CE45120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    TZN_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D045120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    TZN_TZN_FT_32B_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D045120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    TZN_TZN_FT_GP2_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D045120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    TZN_TZN_FT_FX1_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D045120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    TZN_TZN_FT_FT1_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D045120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_FT910_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_FT900_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_RCS_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_Rcx_70T_00R_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_Rcx_101_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_Ugn_MT70T_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UgnInTrf_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_FT_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_MT202_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_FT950_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_FT940_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    UGD_UGN_FT300_SpoolFile    REG_BINARY    0100048064000000740000000000000014000000020050000200000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D145120000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D745120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    ZAM_RCS_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D245120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    ZAM_ZAM_FT_SpoolFile    REG_BINARY    010004804000000050000000000000001400000002002C000100000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628D245120001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000
    error_folder    REG_BINARY    0100048058000000680000000000000014000000020044000200000000001800FF011F000102000000000005200000002002000000002400BF011300010500000000000515000000093A2A2432621F2A828BA628FF01130001020000000000052000000020020000010500000000000515000000093A2A2432621F2A828BA62801020000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Enum
    0    REG_SZ    Root\LEGACY_LANMANSERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Workstation
    Group    REG_SZ    NetworkProvider
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Linkage
    Bind    REG_MULTI_SZ    \Device\NetbiosSmb\0\Device\NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}
    Route    REG_MULTI_SZ    "NetbiosSmb"\0"NetBT" "CPQTeam" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NetBT" "Tcpip" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NetBT" "Tcpip" "NdisWanIp"
    Export    REG_MULTI_SZ    \Device\LanmanWorkstation_NetbiosSmb\0\Device\LanmanWorkstation_NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\LanmanWorkstation_NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\LanmanWorkstation_NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\LanmanWorkstation_NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\NetworkProvider
    Name    REG_SZ    Microsoft Windows Network
    ProviderPath    REG_SZ    C:\WINNT\System32\ntlanman.dll
    DeviceName    REG_SZ    \Device\LanmanRedirector

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
    enableplaintextpassword    REG_DWORD    0x0
    enablesecuritysignature    REG_DWORD    0x1
    requiresecuritysignature    REG_DWORD    0x0
    ServiceDll    REG_SZ    C:\WINNT\System32\wkssvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Enum
    0    REG_SZ    Root\LEGACY_LANMANWORKSTATION\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lcfd
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe"
    DisplayName    REG_SZ    Tivoli Endpoint
    ObjectName    REG_SZ    LocalSystem
    run_dir    REG_SZ    C:\apps_srv\Tivoli\lcf\dat\1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lcfd\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lcfd\Enum
    0    REG_SZ    Root\LEGACY_LCFD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ldap
    ldapclientintegrity    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseInfo
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseInfo\FilePrint
    Mode    REG_DWORD    0x0
    ConcurrentLimit    REG_DWORD    0x0
    FlipAllow    REG_DWORD    0x0
    FamilyDisplayName    REG_SZ    Windows Server
    DisplayName    REG_SZ    Windows Server

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\llssrv.exe
    DisplayName    REG_SZ    License Logging
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Monitors and records client access licensing for portions of the operating system (such as IIS, Terminal Server and File/Print) as well as products that aren't a part of the OS, like SQL and Exchange Server. If this service is stopped, licensing will be enforced, but will not be monitored.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint\IIS
    (Default)    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint\KSecDD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint\MSAfpSrv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint\SMBServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint\TCP/IP Print Server

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\FilePrint\TermService
    (Default)    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\Parameters
    UseEnterprise    REG_DWORD    0x0
    ReplicationType    REG_DWORD    0x0
    ReplicationTime    REG_DWORD    0x15180
    EnterpriseServer    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LicenseService\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LiveUpdate
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
    DisplayName    REG_SZ    LiveUpdate
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    LiveUpdate Core Engine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LiveUpdate\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LiveUpdate\Enum
    0    REG_SZ    Root\LEGACY_LIVEUPDATE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k LocalService
    DisplayName    REG_SZ    TCP/IP NetBIOS Helper
    Group    REG_SZ    TDI
    DependOnService    REG_MULTI_SZ    NetBT\0Afd
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and log on to the network. If this service is stopped, these functions might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\lmhsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts\Enum
    0    REG_SZ    Root\LEGACY_LMHOSTS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LocationManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\locmgr.exe
    DisplayName    REG_SZ    WMS Location Manager
    ObjectName    REG_SZ    eur\ldngtssvcorb01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LocationManager\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LocationManager\Enum
    0    REG_SZ    Root\LEGACY_LOCATIONMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lp6nds35
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x27
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lp6nds35\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lp6nds35\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lpctrc
    (Default)    REG_SZ    
    Type    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    ImagePath    REG_SZ    system32\drivers\lpctrc.sys
    DisplayName    REG_SZ    lpctrc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lpctrc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lpctrc\Enum
    0    REG_SZ    Root\LEGACY_LPCTRC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MailService
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "D:\IntellectFlow\MailerDaemon\MailerDaemon Service.exe"
    ObjectName    REG_SZ    eur\ldngtssvcorb01
    DisplayName    REG_SZ    MailService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MailService\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MailService\Enum
    0    REG_SZ    Root\LEGACY_MAILSERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeEngineService
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe"
    DisplayName    REG_SZ    McAfee Engine Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    McAfee Engine Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeEngineService\Security
    Security    REG_BINARY    010014808400000090000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020054000300000000001400FF010F0001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D00020001010000000000050B000000484D3300A84D3300704E3300010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeEngineService\Enum
    0    REG_SZ    Root\LEGACY_MCAFEEENGINESERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeFramework
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart
    DisplayName    REG_SZ    McAfee Framework Service
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Shared component framework for McAfee products

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeFramework\Security
    Security    REG_BINARY    010014808400000090000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020054000300000000001400FF010F0001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D00020001010000000000050B000000500072006F00670072006100010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeFramework\Enum
    0    REG_SZ    Root\LEGACY_MCAFEEFRAMEWORK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McShield
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe"
    DisplayName    REG_SZ    McAfee McShield
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides McAfee On-Access scanning protection of your computer system.
    DependOnService    REG_MULTI_SZ    mfevtp

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McTaskManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe"
    DisplayName    REG_SZ    McAfee Task Manager
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Allows scheduling of McAfee scanning and updating activities.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McTaskManager\Security
    Security    REG_BINARY    010014808400000090000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020054000300000000001400FF010F0001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D00020001010000000000050B000000500072006F00670072006100010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McTaskManager\Enum
    0    REG_SZ    Root\LEGACY_MCTASKMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Messenger
    DependOnService    REG_MULTI_SZ    LanmanWorkstation\0NetBIOS\0PlugPlay\0RpcSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\msgsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfeapfk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\mfeapfk.sys
    DisplayName    REG_SZ    McAfee Inc. mfeapfk
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfeapfk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfeapfk\Enum
    0    REG_SZ    Root\LEGACY_MFEAPFK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfeavfk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\mfeavfk.sys
    DisplayName    REG_SZ    McAfee Inc. mfeavfk
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfeavfk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfeavfk\Enum
    0    REG_SZ    Root\LEGACY_MFEAVFK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfebopk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\mfebopk.sys
    DisplayName    REG_SZ    McAfee Inc. mfebopk
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfebopk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfebopk\Enum
    0    REG_SZ    Root\LEGACY_MFEBOPK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfehidk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\mfehidk.sys
    DisplayName    REG_SZ    McAfee Inc. mfehidk
    Group    REG_SZ    FSFilter
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    LoadArg    REG_SZ    00000000
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfehidk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfehidk\Enum
    0    REG_SZ    Root\LEGACY_MFEHIDK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mferkdet
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\mferkdet.sys
    DisplayName    REG_SZ    McAfee Inc. mferkdet
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe
    VTPOptions.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_DWORD    0x2
    VTPOptions    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mferkdet\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mferkdet\Enum
    0    REG_SZ    Root\LEGACY_MFERKDET\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mferkdk
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    \??\c:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys
    DisplayName    REG_SZ    VSCore mferkdk

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mferkdk\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mferkdk\Enum
    0    REG_SZ    Root\LEGACY_MFERKDK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1
    INITSTARTFAILED    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfetdik
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\mfetdik.sys
    DisplayName    REG_SZ    McAfee Inc. mfetdik
    Group    REG_SZ    PNP_TDI
    Tag    REG_DWORD    0x7
    DependOnService    REG_MULTI_SZ    Tcpip
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    LoadArg    REG_SZ    00000000
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfetdik\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfetdik\Enum
    0    REG_SZ    Root\LEGACY_MFETDIK\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfevtp
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\mfevtps.exe
    DisplayName    REG_SZ    McAfee Validation Trust Protection Service
    ObjectName    REG_SZ    LocalSystem
    DependOnService    REG_MULTI_SZ    mfehidk
    Description    REG_SZ    Provides validation trust protection services
    LockDownEnabled    REG_DWORD    0x1
    InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe
    InstallReference.C__Program_Files_McAfee_VirusScan_Enterprise_mfehidin.exe    REG_SZ    C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfevtp\Security
    Security    REG_BINARY    010014808400000090000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020054000300000000001400FF010F00010100000000000512000000000018009D00060001020000000000052000000020020000000014009D00020001010000000000050B000000704B3300D04B3300984C3300010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfevtp\Enum
    0    REG_SZ    Root\LEGACY_MFEVTP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmdd
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Video Save
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmdd\Device0
    InstalledDisplayDrivers    REG_MULTI_SZ    mnmdd
    Device Description    REG_SZ    NetMeeting driver
    VgaCompatible    REG_DWORD    0x0
    MirrorDriver    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmdd\Video
    VideoID    REG_SZ    {8B6D7859-A639-4A15-8790-7161976D057A}
    Service    REG_SZ    mnmdd

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmdd\Enum
    0    REG_SZ    Root\LEGACY_MNMDD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Type    REG_DWORD    0x110
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\mnmsrvc.exe
    DisplayName    REG_SZ    NetMeeting Remote Desktop Sharing
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmsrvc\Security
    Security    REG_BINARY    0100148078000000840000001400000044000000020030000200000002801400FF010F000101000000000001000000000240140070000C00010100000000000100000000020034000200000000001800FF010F000102000000000005200000002002000000001400FF010F00010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Modem
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Extended base
    Start    REG_DWORD    0x3
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Modem\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mouclass
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Pointer Class
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Mouse Class Driver
    ImagePath    REG_SZ    system32\DRIVERS\mouclass.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mouclass\Parameters
    ConnectMultiplePorts    REG_DWORD    0x0
    MaximumPortsServiced    REG_DWORD    0x3
    MouseDataQueueSize    REG_DWORD    0x64
    PointerDeviceBaseName    REG_SZ    PointerClass

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mouclass\Enum
    0    REG_SZ    Root\RDP_MOU\0000
    Count    REG_DWORD    0x3
    NextInstance    REG_DWORD    0x3
    1    REG_SZ    ACPI\PNP0F13\4&142b453b&0
    2    REG_SZ    HID\Vid_03f0&Pid_1027&MI_01\8&aacf5f7&0&0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Group    REG_SZ    Pointer Port
    ErrorControl    REG_DWORD    0x0
    DisplayName    REG_SZ    Mouse HID Driver
    ImagePath    REG_SZ    system32\DRIVERS\mouhid.sys
    Tag    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid\Parameters
    UseOnlyMice    REG_DWORD    0x0
    TreatAbsoluteAsRelative    REG_DWORD    0x0
    TreatAbsolutePointerAsAbsolute    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid\Enum
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1
    0    REG_SZ    HID\Vid_03f0&Pid_1027&MI_01\8&aacf5f7&0&0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MountMgr
    DisplayName    REG_SZ    Mount Point Manager
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x8
    Type    REG_DWORD    0x1
    NoAutoMount    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MountMgr\Enum
    0    REG_SZ    Root\LEGACY_MOUNTMGR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mraid35x
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x2b
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mraid35x\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mraid35x\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxDAV
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\mrxdav.sys
    DisplayName    REG_SZ    WebDav Client Redirector
    Description    REG_SZ    WebDav Client Redirector

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxDAV\EncryptedDirectories
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxDAV\Parameters
    FileInformationCacheLifeTimeInSec    REG_DWORD    0x3c
    FileNotFoundCacheLifeTimeInSec    REG_DWORD    0x3c
    NameCacheMaxEntries    REG_DWORD    0x12c
    DAVDebugFlag    REG_DWORD    0x0
    UMRxDebugFlag    REG_DWORD    0x0
    CreateRequestTimeoutInSec    REG_DWORD    0x258
    CreateVNetRootRequestTimeoutInSec    REG_DWORD    0x3c
    QueryDirectoryRequestTimeoutInSec    REG_DWORD    0x258
    CloseRequestTimeoutInSec    REG_DWORD    0x258
    CreateSrvCallRequestTimeoutInSec    REG_DWORD    0x3c
    FinalizeSrvCallRequestTimeoutInSec    REG_DWORD    0x258
    FinalizeFobxRequestTimeoutInSec    REG_DWORD    0x258
    FinalizeVNetRootRequestTimeoutInSec    REG_DWORD    0x258
    ReNameRequestTimeoutInSec    REG_DWORD    0x258
    SetFileInfoRequestTimeoutInSec    REG_DWORD    0x258
    QueryFileInfoRequestTimeoutInSec    REG_DWORD    0x258
    QueryVolumeInfoRequestTimeoutInSec    REG_DWORD    0x258
    LockRefreshRequestTimeoutInSec    REG_DWORD    0x258

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxDAV\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxSmb
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x5
    ImagePath    REG_SZ    system32\DRIVERS\mrxsmb.sys
    DisplayName    REG_SZ    MRXSMB
    Group    REG_SZ    Network
    Description    REG_SZ    MRXSMB
    LastLoadStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxSmb\Parameters
    CscEnabled    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxSmb\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxSmb\Enum
    0    REG_SZ    Root\LEGACY_MRXSMB\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\msdtc.exe
    DisplayName    REG_SZ    Distributed Transaction Coordinator
    Group    REG_SZ    MS Transactions
    DependOnService    REG_MULTI_SZ    RPCSS\0SamSS
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. 
    FailureActions    REG_BINARY    1E0000000000000000000000040000005C00730001000000E803000001000000F82A0000010000000852000000000000E8030000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC\Performance
    Library    REG_SZ    msdtcuiu.DLL
    Open    REG_SZ    DtcPerfOpen
    Collect    REG_SZ    DtcPerfCollect
    Close    REG_SZ    DtcPerfClose
    PerfIniFile    REG_SZ    msdtcprf.ini
    Last Counter    REG_DWORD    0x85e
    Last Help    REG_DWORD    0x85f
    First Counter    REG_DWORD    0x844
    First Help    REG_DWORD    0x845
    Object List    REG_SZ    2116
    WbemAdapFileSignature    REG_BINARY    3F143F8022753F843081D7CA220B7F2D
    WbemAdapFileTime    REG_BINARY    18DC94721F62C701
    WbemAdapFileSize    REG_DWORD    0x28e00
    WbemAdapStatus    REG_DWORD    0x0
    1008    REG_NONE    7D05ED657629CA01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC\Security
    Security    REG_BINARY    01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0007000000000014001D00020001010000000000010000000000001800FD01020001020000000000052000000023020000000014008D01020001010000000000050B00000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000000014009D010200010100000000000200000000000014009D000200010100000000000514000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC\Enum
    0    REG_SZ    Root\LEGACY_MSDTC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsDtsServer
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\mssql\90\DTS\Binn\MsDtsSrvr.exe
    DisplayName    REG_SZ    SQL Server Integration Services
    ObjectName    REG_SZ    eur\ldnwassvcsysadm01
    Description    REG_SZ    Provides management support for SSIS package storage and execution.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsDtsServer\Linkage
    Export    REG_MULTI_SZ    MsDtsServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsDtsServer\Performance
    Counter Names    REG_MULTI_SZ    Package Instances
    Counter Types    REG_MULTI_SZ    65792
    Library    REG_SZ    netfxperf.dll
    Open    REG_SZ    OpenPerformanceData
    Collect    REG_SZ    CollectPerformanceData
    Close    REG_SZ    ClosePerformanceData
    PerfIniFile    REG_SZ    perf-DTSSVCPERF.INI
    Last Counter    REG_DWORD    0x27c6
    Last Help    REG_DWORD    0x27c7
    First Counter    REG_DWORD    0x27c4
    First Help    REG_DWORD    0x27c5
    Object List    REG_SZ    10180

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsDtsServer\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsDtsServer\Enum
    0    REG_SZ    Root\LEGACY_MSDTSSERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Msfs
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    File system
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Msfs\Enum
    0    REG_SZ    Root\LEGACY_MSFS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesql
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\msftesql.exe -s:MSSQL.1 -f:MSSQLSERVER
    DisplayName    REG_SZ    SQL Server FullText Search (MSSQLSERVER)
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    eur\ldnwassvcsysadm01
    Description    REG_SZ    Quickly creates full-text indexes on content and properties of structured and semi-structured data to allow fast linguistic searches on this data.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesql\Performance
    Open    REG_SZ    PerfmonOpen
    Close    REG_SZ    PerfmonClose
    Collect    REG_SZ    PerfmonCollect
    Library    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\msfte.dll
    PerfIniFile    REG_SZ    iftcntrs.ini
    Last Counter    REG_DWORD    0xfd4
    Last Help    REG_DWORD    0xfd5
    First Counter    REG_DWORD    0xf1e
    First Help    REG_DWORD    0xf1f
    Object List    REG_SZ    3870 3984

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesql\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesql\Enum
    0    REG_SZ    Root\LEGACY_MSFTESQL\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesqlFD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesqlFD\Performance
    Open    REG_SZ    PerfmonFDOpen
    Close    REG_SZ    PerfmonFDClose
    Collect    REG_SZ    PerfmonFDCollect
    Library    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\msfte.dll
    PerfIniFile    REG_SZ    ifdcntrs.ini
    Last Counter    REG_DWORD    0xf1c
    Last Help    REG_DWORD    0xf1d
    First Counter    REG_DWORD    0xf04
    First Help    REG_DWORD    0xf05
    Object List    REG_SZ    3844

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesqlIDX

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesqlIDX\Performance
    Open    REG_SZ    PerfmonIDXOpen
    Close    REG_SZ    PerfmonIDXClose
    Collect    REG_SZ    PerfmonIDXCollect
    Library    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\msfte.dll
    PerfIniFile    REG_SZ    iindctrs.ini
    Last Counter    REG_DWORD    0x1054
    Last Help    REG_DWORD    0x1055
    First Counter    REG_DWORD    0xfd6
    First Help    REG_DWORD    0xfd7
    Object List    REG_SZ    4054

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer
    Description    REG_SZ    Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start.
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\msiexec.exe /V
    DisplayName    REG_SZ    Windows Installer
    DependOnService    REG_MULTI_SZ    RpcSs
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer\Enum
    0    REG_SZ    Root\LEGACY_MSISERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssmbios
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\mssmbios.sys
    DisplayName    REG_SZ    Microsoft System Management BIOS Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssmbios\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssmbios\Data
    AcpiData    REG_BINARY    525344544C00000001AB48502020202050726F4C69616E7402000000D20400002E16000080E0D47F40E1D47FC0E1D47F00E2D47F40E2D47F40E4D47F00E6D47F00EAD47F80EBD47FC0EBD47F4641435074000000016C485020202020413037202020202002000000D20400002E16000000E1D47F00EFD47F010009002E0A00000100000000090000000000000409000000000000000000000809000076060000000000000402000404000000FFFFFFFF0000000000007D7E7F030000A5010000445344546D4A000001E5485020202020445344540000000001000000494E544C28020320535043525000000001C8485020202020535043525242535501000000D20400002E16000000000000000000000000000000000000010400000000030001030000FFFFFFFF0000000000000000000000004850455438000000018E48502020202050726F4C69616E7402000000D20400002E16000001822210002000000000D0FE000000000000080053504D4940000000056248502020202050726F4C69616E7401000000D20400002E16000001010002000000000000000001100001A20C0000000000000000000045525354D0010000013F48502020202050726F4C69616E7401000000D20400002E1600000C000000000000000D000000000300000008000124800E00000000000000000000000000FF00000000000000010300000008000124800E00000000000100000000000000FF00000000000000020300000008000124800E00000000000200000000000000FF00000000000000030300000008000124800E0000000000FF00000000000000FF00000000000000040200000040000228800E00000000000000000000000000FFFF000000000000050300000008000125800E00000000000100000000000000FF0000000000000005030000010800012E0A0000000000001000000000000000FF00000000000000060100000008000125800E00000000000100000000000000FF00000000000000070000000008000126800E00000000000000000000000000FF00000000000000080000000040000430800E00000000000000000000000000FFFFFFFFFFFFFFFF090200000040000430800E00000000000000000000000000FFFFFFFFFFFFFFFF0A0000000008000127800E00000000000000000000000000FF000000000000000B0300000008000124800E00000000000B00000000000000FF0000000000000041504943C6000000013748502020202050726F4C69616E740200000000000000000000000000E0FE0100000000080000010000000008020201000000000804040100000000080606010000000008010101000000000803030100000000080505010000000008070701000000010C080000008FD900000000010C09000000FDD918000000010C0A000000FED91F000000010C0B000000FFD926000000020A0000020000000500020A0009090000000F00030800001C00000003080000230000000406FF00000153524154A0010000016E414D4420202046414D5F465F313002000000414D44200100000001000000000000000000000000100000010000000000000000000000001000010100000000000000000000000128000000000000000000000000000000000A000000000001000000010000000000000000000000012800000000000000001000000000000000F07F0000000001000000010000000000000000000000012800000000000000000000010000000000008001000000010000000100000000000000000000000010010201000000000000000000000000100103010000000000000000000000012801000000000000000080020000000000000002000000010000000100000000000000000000000010020401000000000000000000000000100205010000000000000000000000012802000000000000000080040000000000000002000000010000000100000000000000000000000010030601000000000000000000000000100307010000000000000000000000012803000000000000000080060000000000000002000000010000000100000000000000000000004646464676010000011448502020202050726F4C69616E7401000000D20400002E16000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004245525430000000014248502020202050726F4C69616E7401000000D20400002E160000400000000070D57F000000004845535470010000013748502020202050726F4C69616E7401000000D20400002E16000004000000000000000000000101000000010000000000000000000000FFFFFFFFFFFFFFFF05000000000000000000020000040000FEFFFFFFFFFFFFFF0104000002040000000000000100020004040000FEFFFFFFFFFFFFFF0504000006040000000000000200020008040000FFFFFFFFFFFFFFFF090400000A04000000000000030002000C040000FFFFFFFFFFFFFFFF0D0400000E040000000000000400020010040000FFFFFFFFFFFFFFFF110400001204000000000000060006000000020001000000010000000000000000000000165800000000100011F01700C1110000A000000000000000070007000000020001000000010000000000000000000000165800000000100011F01700C1110000A0000000080008000000020001000000010000000000000000000000165800000000100011F01700C1110000A00000000000100011F01700A0000000
    RegistersData    REG_BINARY    0000000000000000010000004175746863414D44656E7469000000000000000000000000000000000000000001000000130F04000008020701200000FFFB8B170000000000000000000000000000000001000000800000C0000800000000000000000000000000000000000000000000000000000000000001000000410001C0140A00000100000000000000000000000000000000000000000000000000000001000000420001C0140214080A1208310000000000000000000000000000000000000000000000000000000000000080180000804175746863414D44656E7469000000000000000000000000000000000000000001000080130F0400550900001F000000FFFBD3EB0000000000000000000000000000000000000000020000804475616C2D436F726520414D44204F700000000000000000000000000000000000000000030000807465726F6E28746D292050726F636573000000000000000000000000000000000000000004000080736F722038323230000000000000000000000000000000000000000000000000000000000500008008FF08FF20FF20FF4001024040010240000000000000000000000000000000000000000006000080000000000042004240810004000000000000000000000000000000000000000000000000070000800000000000000000000000003F000000000000000000000000000000000000000000000008000080283000000000000001000000000000000000000000000000000000000000000000000000090000800000000000000000000000000000000000000000000000000000000000000000000000000A0000800100000040000000000000000000000000000000000000000000000000000000000000000B0000800000000000000000000000000000000000000000000000000000000000000000000000000C0000800000000000000000000000000000000000000000000000000000000000000000000000000D0000800000000000000000000000000000000000000000000000000000000000000000000000000E0000800000000000000000000000000000000000000000000000000000000000000000000000000F0000800000000000000000000000000000000000000000000000000000000000000000000000001000008000000000000000000000000000000000000000000000000000000000000000000000000011000080000000000000000000000000000000000000000000000000000000000000000000000000120000800000000000000000000000000000000000000000000000000000000000000000000000001300008000000000000000000000000000000000000000000000000000000000000000000000000014000080000000000000000000000000000000000000000000000000000000000000000000000000150000800000000000000000000000000000000000000000000000000000000000000000000000001600008000000000000000000000000000000000000000000000000000000000000000000000000017000080000000000000000000000000000000000000000000000000000000000000000000000000180000800000000000000000000000000000000000000000000000000000000000000000
    BiosData    REG_BINARY    0A0000007E004D0048007A0000000400000004000000FC0A00002C00000043006F006D0070006F006E0065006E007400200049006E0066006F0072006D006100740069006F006E0000000300000010000000000000000000000000000000010000002600000043006F006E00660069006700750072006100740069006F006E002000440061007400610000000900000010000000FFFFFFFFFFFFFFFF0000000000000000160000004900640065006E00740069006600690065007200000001000000440000007800380036002000460061006D0069006C00790020003100350020004D006F00640065006C0020003600350020005300740065007000700069006E00670020003300000028000000500072006F0063006500730073006F0072004E0061006D00650053007400720069006E006700000001000000520000004400750061006C002D0043006F0072006500200041004D00440020004F0070007400650072006F006E00280074006D0029002000500072006F0063006500730073006F00720020003800320032003000000022000000560065006E0064006F0072004900640065006E007400690066006900650072000000010000001A000000410075007400680065006E0074006900630041004D0044000000
    SMBiosData    REG_BINARY    000204246D10000000180000010200F0033F80DAC97D000000000307FFFFFFFF4850004130370031322F31342F323030390000011B0001040500010000000000000000000000000000000006020320202020202020202020202020202020003431383633332D4232312020202020200050726F4C69616E740048500050726F4C69616E7420444C3538352047322020200020202020202020202020202020000003110003011700020302020202000000004850002020202020202020202020202020202000202020202020202020202020202020202020202020202020202020202020202000000428000401038402130F0400FFFB8B17008E0000AC0DF00A410410072007FFFF000000020202040050726F63203100414D4400000428010401038402130F0400FFFB8B17008E0000AC0DF00A440411072107FFFF000000020202040050726F63203200414D4400000428020401038402130F0400FFFB8B17008E0000AC0DF00A440412072207FFFF000000020202040050726F63203300414D4400000428030401038402130F0400FFFB8B17008E0000AC0DF00A440413072307FFFF000000020202040050726F63203400414D4400000713100701800180008000080008000005040450726F636573736F72203120496E7465726E616C204C3120436163686500000713110701800180008000080008000005040450726F636573736F72203220496E7465726E616C204C3120436163686500000713120701800180008000080008000005040450726F636573736F72203320496E7465726E616C204C3120436163686500000713130701800180008000080008000005040450726F636573736F72203420496E7465726E616C204C3120436163686500000713200701810220802080080008000005050850726F636573736F72203120496E7465726E616C204C3220436163686500000713210701810220802080080008000005050850726F636573736F72203220496E7465726E616C204C3220436163686500000713220701810220802080080008000005050850726F636573736F72203320496E7465726E616C204C3220436163686500000713230701810220802080080008000005050850726F636573736F72203420496E7465726E616C204C322043616368650000DA13340700000000000000000000000000000020202020202020202020202020202020202020202020202020202020200000DA13320700000000000000000000000000000020202020202020202020202020202020202020202020202020202020200000DA13330700000000000000000000000000000020202020202020202020202020202020202020202020202020202020200000DA133407000000000000000000000000000000202020202020202020202020202020202020202020202020202020202000000809010801120212104A35380055534220506F7274203100000809020801120212104A35380055534220506F7274203200000809030801120212104A35380055534220506F7274203300000809040801120212104A35380055534220506F7274203400000809050801120212104A35380055534220506F727420350000090D0109011206030401000400504349202020536C6F7420310000090D0209011206030402000400504349202020536C6F7420320000090D030901A50A0301030004005043492D4520536C6F7420330000090D040901A50A0301040004005043492D4520536C6F7420340000090D050901A50B0301050004005043492D4520536C6F7420350000090D060901A50A0301060004005043492D4520536C6F7420360000090D070901A50B0401070004005043492D4520536C6F7420370000090D080901A50B0401080004005043492D4520536C6F7420380000090D090901A50A0401090004005043492D4520536C6F74203900000B05000B0150726F647563742049443A203431383633332D4232312020202020200000100F001003030500000010FEFF20000000111700110010FEFF480040000008090101001380009B0244494D4D2031410000111701110010FEFF480040000008090101001380009B0244494D4D2032410000111702110010FEFF480040000008090201001380009B0244494D4D2033420000111703110010FEFF480040000008090201001380009B0244494D4D2034420000111704110010FEFF48004000000009030100138000000044494D4D2035430000111705110010FEFF48004000000009030100138000000044494D4D2036430000111706110010FEFF48004000000009040100138000000044494D4D2037440000111707110010FEFF48004000000009040100138000000044494D4D2038440000111708110010FEFF480040000008090501001380009B0244494D4D2039450000111709110010FEFF480040000008090501001380009B0244494D4D20313045000011170A110010FEFF480040000008090601001380009B0244494D4D20313146000011170B110010FEFF480040000008090601001380009B0244494D4D20313246000011170C110010FEFF48004000000009070100138000000044494D4D20313347000011170D110010FEFF48004000000009070100138000000044494D4D20313447000011170E110010FEFF48004000000009080100138000000044494D4D20313548000011170F110010FEFF48004000000009080100138000000044494D4D203136480000111710110010FEFF480040000008090901001380009B0244494D4D203137490000111711110010FEFF480040000008090901001380009B0244494D4D203138490000111712110010FEFF480040000008090A01001380009B0244494D4D2031394A0000111713110010FEFF480040000008090A01001380009B0244494D4D2032304A0000111714110010FEFF480040000000090B0100138000000044494D4D2032314B0000111715110010FEFF480040000000090B0100138000000044494D4D2032324B0000111716110010FEFF480040000000090C0100138000000044494D4D2032334C0000111717110010FEFF480040000000090C0100138000000044494D4D2032344C0000111718110010FEFF480040000008090D01001380009B0244494D4D2032354D0000111719110010FEFF480040000008090D01001380009B0244494D4D2032364D000011171A110010FEFF480040000008090E01001380009B0244494D4D2032374E000011171B110010FEFF480040000008090E01001380009B0244494D4D2032384E000011171C110010FEFF480040000000090F0100138000000044494D4D2032394F000011171D110010FEFF480040000000090F0100138000000044494D4D2033304F000011171E110010FEFF48004000000009100100138000000044494D4D20333150000011171F110010FEFF48004000000009100100138000000044494D4D203332500000130F001300000000FFFF9F000010040000130F01130000A000FFFF1F010010040000130F021300002001FFFF9F010010040000130F03130000A001FFFF1F0200100400001413001400000000FFFF9F000011001301010100001413011400000000FFFF9F000111001302020100001413021400000000FFFF9F000211001301010100001413031400000000FFFF9F00031100130202010000141304140000000000000000041100130101010000141305140000000000000000051100130202010000141306140000000000000000061100130101010000141307140000000000000000071100130202010000141308140000A000FFFF1F01081101130101010000141309140000A000FFFF1F0109110113020201000014130A140000A000FFFF1F010A110113010101000014130B140000A000FFFF1F010B110113020201000014130C1400000000000000000C110113010101000014130D1400000000000000000D110113020201000014130E1400000000000000000E110113010101000014130F1400000000000000000F11011302020100001413101400002001FFFF9F011011021301010100001413111400002001FFFF9F011111021302020100001413121400002001FFFF9F011211021301010100001413131400002001FFFF9F01131102130202010000141314140000000000000000141102130101010000141315140000000000000000151102130202010000141316140000000000000000161102130101010000141317140000000000000000171102130202010000141318140000A001FFFF1F02181103130101010000141319140000A001FFFF1F0219110313020201000014131A140000A001FFFF1F021A110313010101000014131B140000A001FFFF1F021B110313020201000014131C1400000000000000001C110313010101000014131D1400000000000000001D110313020201000014131E1400000000000000001E110313010101000014131F1400000000000000001F1103130202010000200B002000000000000000000026120026012020FFA30C00000000000000000000C10700C101010230362F32372F323030380030392F31332F323030360000C20500C2010000C30500C3012430453131303736370000C40500C4000000C50A00C500040001FF010000C50A01C501040200FF020000C50A02C502040400FF030000C50A03C503040600FF040000C60B00C6170000013C00010000C77000C79F000001082017126210000020000001072026030010000086000001082001054110000085000001082001054010000096000001082005112010000095000001082004112210000062000000062027011404000068000000062020090A0400006D000000062020091B0400000000CD1600CD0101464154780000E0FF0000000000000E000000CA0800CA0011FF010000CA0801CA0111FF020000CA0802CA0211FF030000CA0803CA0311FF040000CA0804CA0411FF050000CA0805CA0511FF060000CA0806CA0611FF070000CA0807CA0711FF080000CA0808CA0811FF090000CA0809CA0911FF0A0000CA080ACA0A11FF0B0000CA080BCA0B11FF0C0000CA080CCA0C11FF0D0000CA080DCA0D11FF0E0000CA080ECA0E11FF0F0000CA080FCA0F11FF100000CA0810CA1011FF110000CA0811CA1111FF120000CA0812CA1211FF130000CA0813CA1311FF140000CA0814CA1411FF150000CA0815CA1511FF160000CA0816CA1611FF170000CA0817CA1711FF180000CA0818CA1811FF190000CA0819CA1911FF1A0000CA081ACA1A11FF1B0000CA081BCA1B11FF1C0000CA081CCA1C11FF1D0000CA081DCA1D11FF1E0000CA081ECA1E11FF1F0000CA081FCA1F11FF200000D11400D10841001E0B7C9E5A1041001E0B7C9E5C0000D41800D424435255003CFDFF0000000000400000000000000000D70600D700050000DB0800DB850000000000DC2D00DC080000C500000100C501000201C500000301C501000402C500000502C501000603C500000703C501000000DA5501DC0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA7D01DC000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DD1400DD0841001E0B7C9E5B1041001E0B7C9E5D00007F04007F0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssmbios\Enum
    0    REG_SZ    Root\SYSTEM\0002
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQL Monitor Service
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\Program Files\guardium\guardium_stap\guardium_stap\pcssvc.exe /service
    DisplayName    REG_SZ    MSSQL Monitor Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Service for monitoring Microsoft SQL Server instances activity

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQL Monitor Service\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQL Monitor Service\Enum
    0    REG_SZ    Root\LEGACY_MSSQL_MONITOR_SERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVER
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
    DisplayName    REG_SZ    SQL Server (MSSQLSERVER)
    ObjectName    REG_SZ    eur\ldnwassvcsysadm01
    Description    REG_SZ    Provides storage, processing and controlled access of data and rapid transaction processing.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVER\Linkage
    Export    REG_MULTI_SZ    MSSQLSERVER

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVER\Performance
    Library    REG_SZ    sqlctr90.dll
    Open    REG_SZ    OpenSQLPerformanceData1
    Collect    REG_SZ    CollectSQLPerformanceData1
    Close    REG_SZ    CloseSQLPerformanceData1
    PerfIniFile    REG_SZ    perf-MSSQLSERVERsqlctr.ini
    Last Counter    REG_DWORD    0x27c2
    Last Help    REG_DWORD    0x27c3
    First Counter    REG_DWORD    0x254e
    First Help    REG_DWORD    0x254f
    Library Validation Code    REG_BINARY    00DE3F58844EC9016001010000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVER\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVER\Enum
    0    REG_SZ    Root\LEGACY_MSSQLSERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLServerADHelper
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe"
    DisplayName    REG_SZ    SQL Server Active Directory Helper
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Enables integration with Active Directories.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLServerADHelper\Security
    Security    REG_BINARY    01001480000100000C010000140000003000000002001C000100000002801400FF010F000101000000000001000000000200D0000800000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD0300000004240011000200010500000000000515000000948BA859A7902635A89CBBAEFA03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msvsmon80
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    "C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80
    DisplayName    REG_SZ    Visual Studio 2005 Remote Debugger
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Allows members of the Administrators group to remotely debug server applications using Visual Studio 2005. Use the Visual Studio 2005 Remote Debugging Configuration Wizard to enable this service.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msvsmon80\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup
    DisplayName    REG_SZ    Mup
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Network
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x2
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup\Enum
    0    REG_SZ    Root\LEGACY_MUP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS
    DisplayName    REG_SZ    NDIS System Driver
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    NDIS Wrapper
    Start    REG_DWORD    0x0
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\MediaTypes

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Parameters
    ProcessorAffinityMask    REG_DWORD    0xffffffff

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Enum
    0    REG_SZ    Root\LEGACY_NDIS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisTapi
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\ndistapi.sys
    DisplayName    REG_SZ    Remote Access NDIS TAPI Driver
    Description    REG_SZ    Remote Access NDIS TAPI Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisTapi\Parameters
    AsyncEventQueueSize    REG_DWORD    0x300

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisTapi\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisTapi\Enum
    0    REG_SZ    Root\LEGACY_NDISTAPI\0000
    Count    REG_DWORD    0x5
    NextInstance    REG_DWORD    0x5
    1    REG_SZ    Root\MS_NDISWANBH\0000
    2    REG_SZ    Root\MS_NDISWANIP\0000
    3    REG_SZ    Root\MS_PPPOEMINIPORT\0000
    4    REG_SZ    Root\MS_PPTPMINIPORT\0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisuio
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0xc
    ImagePath    REG_SZ    system32\DRIVERS\ndisuio.sys
    DisplayName    REG_SZ    NDIS Usermode I/O Protocol
    Group    REG_SZ    NDIS
    Description    REG_SZ    NDIS Usermode I/O Protocol

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisuio\Linkage
    Bind    REG_MULTI_SZ    \Device\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    Route    REG_MULTI_SZ    "{1C720EB3-65F4-44B5-A616-874B801E4A74}"
    Export    REG_MULTI_SZ    \Device\Ndisuio_{1C720EB3-65F4-44B5-A616-874B801E4A74}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisuio\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisuio\Enum
    0    REG_SZ    Root\LEGACY_NDISUIO\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\ndiswan.sys
    DisplayName    REG_SZ    Remote Access NDIS WAN Driver
    Description    REG_SZ    Remote Access NDIS WAN Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Linkage
    Bind    REG_MULTI_SZ    \Device\{6D4ECC0A-B409-4D92-B625-FDF8284DB63F}\0\Device\{B695A06A-7062-4BF7-A4F8-77A53C795A1A}\0\Device\{87EDC7AF-1667-4062-8768-BC56D8D3CC80}\0\Device\{00AFB265-41C0-4268-BF92-2FA7B159C198}\0\Device\{FBAFB8AD-B15D-49DD-AE3A-F5CA3F09D0D7}
    Route    REG_MULTI_SZ    "{6D4ECC0A-B409-4D92-B625-FDF8284DB63F}"\0"{B695A06A-7062-4BF7-A4F8-77A53C795A1A}"\0"{87EDC7AF-1667-4062-8768-BC56D8D3CC80}"\0"{00AFB265-41C0-4268-BF92-2FA7B159C198}"\0"{FBAFB8AD-B15D-49DD-AE3A-F5CA3F09D0D7}"
    Export    REG_MULTI_SZ    \Device\NdisWan_{6D4ECC0A-B409-4D92-B625-FDF8284DB63F}\0\Device\NdisWan_{B695A06A-7062-4BF7-A4F8-77A53C795A1A}\0\Device\NdisWan_{87EDC7AF-1667-4062-8768-BC56D8D3CC80}\0\Device\NdisWan_{00AFB265-41C0-4268-BF92-2FA7B159C198}\0\Device\NdisWan_{FBAFB8AD-B15D-49DD-AE3A-F5CA3F09D0D7}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Enum
    0    REG_SZ    Root\MS_NDISWANBH\0000
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    Root\MS_NDISWANIP\0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDProxy
    DisplayName    REG_MULTI_SZ    NDIS Proxy
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    PNP_TDI
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDProxy\Enum
    0    REG_SZ    Root\LEGACY_NDPROXY\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\netbios.sys
    DisplayName    REG_SZ    NetBIOS Interface
    Group    REG_SZ    NetBIOSGroup
    Description    REG_SZ    NetBIOS Interface

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage
    LanaMap    REG_BINARY    0104010500020003
    Bind    REG_MULTI_SZ    \Device\NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}
    Route    REG_MULTI_SZ    "NetBT" "CPQTeam" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NetBT" "Tcpip" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NetBT" "Tcpip" "NdisWanIp"
    Export    REG_MULTI_SZ    \Device\NetBIOS_NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBIOS_NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBIOS_NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\NetBIOS_NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Parameters
    MaxLana    REG_DWORD    0x5

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Parameters\Winsock
    HelperDllName    REG_SZ    C:\WINNT\System32\wshnetbs.dll
    MaxSockAddrLength    REG_DWORD    0x14
    MinSockAddrLength    REG_DWORD    0x14
    Mapping    REG_BINARY    0200000003000000110000000500000000000000110000000200000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Enum
    0    REG_SZ    Root\LEGACY_NETBIOS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x5
    ImagePath    REG_SZ    system32\DRIVERS\netbt.sys
    DisplayName    REG_SZ    NetBios over Tcpip
    Group    REG_SZ    PNP_TDI
    DependOnService    REG_MULTI_SZ    Tcpip
    Description    REG_SZ    NetBios over Tcpip

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Linkage
    OtherDependencies    REG_MULTI_SZ    Tcpip
    Bind    REG_MULTI_SZ    \Device\CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}
    Route    REG_MULTI_SZ    "CPQTeam" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"Tcpip" "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"Tcpip" "NdisWanIp"
    Export    REG_MULTI_SZ    \Device\NetBT_CPQTeam_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NetBT_Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\NetBT_Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
    NbProvider    REG_SZ    _tcp
    NameServerPort    REG_DWORD    0x89
    CacheTimeout    REG_DWORD    0x927c0
    BcastNameQueryCount    REG_DWORD    0x3
    BcastQueryTimeout    REG_DWORD    0x2ee
    NameSrvQueryCount    REG_DWORD    0x3
    NameSrvQueryTimeout    REG_DWORD    0x5dc
    Size/Small/Medium/Large    REG_DWORD    0x1
    SessionKeepAlive    REG_DWORD    0x36ee80
    TransportBindName    REG_SZ    \Device\
    EnableLMHOSTS    REG_DWORD    0x0
    EnableDNS    REG_DWORD    0x1
    ScopeID    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}
    NameServerList    REG_MULTI_SZ    169.186.150.37\0169.186.203.37
    NetbiosOptions    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{DF7DB703-FE56-4F72-89FB-371431019CD1}
    NetbiosOptions    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{EE812484-03FC-4739-9BC2-B9D094470C3D}
    NameServerList    REG_MULTI_SZ    169.186.150.37\0169.186.203.37
    NetbiosOptions    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Security
    Security    REG_BINARY    01001480E8000000F4000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200B80008000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001800FF010F000102000000000005200000002502000000001400FD01020001010000000000051200000000001400400000000101000000000005130000000000140040000000010100000000000514000000000018009D0102000102000000000005200000002C020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Enum
    0    REG_SZ    Root\LEGACY_NETBT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDE
    DependOnService    REG_MULTI_SZ    NetDDEDSDM
    Description    REG_SZ    Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Network DDE
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    NetDDEGroup
    ImagePath    REG_SZ    C:\WINNT\system32\netdde.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDE\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDEdsdm
    Description    REG_SZ    Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. 
    DisplayName    REG_SZ    Network DDE DSDM
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\netdde.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDEdsdm\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\lsass.exe
    DisplayName    REG_SZ    Net Logon
    Group    REG_SZ    MS_WindowsRemoteValidation
    DependOnService    REG_MULTI_SZ    LanmanWorkstation
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this service is stopped, the computer may not authenticate users and services and the domain controller cannot register DNS records. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
    DisablePasswordChange    REG_DWORD    0x0
    maximumpasswordage    REG_DWORD    0x1e
    requiresignorseal    REG_DWORD    0x1
    requirestrongkey    REG_DWORD    0x0
    sealsecurechannel    REG_DWORD    0x1
    signsecurechannel    REG_DWORD    0x1
    Update    REG_SZ    no
    DynamicSiteName    REG_SZ    LON

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Private
    SocketAddressList    REG_BINARY    010000000C0000001000000002000000A9B6CB310000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Enum
    0    REG_SZ    Root\LEGACY_NETLOGON\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
    DependOnService    REG_MULTI_SZ    RpcSs
    Description    REG_SZ    Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. If this service is disabled, you will not be able to view local area network and remote connections and any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Network Connections
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\netman.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman\Enum
    0    REG_SZ    Root\LEGACY_NETMAN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nfrd960
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x35
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nfrd960\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nfrd960\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Network Location Awareness (NLA)
    DependOnService    REG_MULTI_SZ    Tcpip\0Afd
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Collects and stores network configuration and location information, and notifies applications when this information changes.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla\Security
    Security    REG_BINARY    010014807C00000088000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002004C0003000000000014009D01020001010000000000050B00000000001800FD0102000102000000000005200000002302000000001800FF010F0001020000000000052000000020020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla\Enum
    0    REG_SZ    Root\LEGACY_NLA\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\NMnt.sys
    DisplayName    REG_SZ    Network Monitor Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm\Linkage
    Bind    REG_MULTI_SZ    \Device\{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NdisWanBh
    Route    REG_MULTI_SZ    "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NdisWanBh"
    Export    REG_MULTI_SZ    \Device\NM_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NM_NdisWanBh

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm\Parameters
    (Default)    REG_SZ    
    MaxRequests    REG_DWORD    0x0
    MaxLinks    REG_DWORD    0x0
    MaxConnections    REG_DWORD    0x0
    MaxAddressFiles    REG_DWORD    0x0
    MaxAddresses    REG_DWORD    0x0
    MinimumT1Timeout    REG_DWORD    0x3d0900
    DefaultT1Timeout    REG_DWORD    0x5b8d80
    DefaultT2Timeout    REG_DWORD    0x16e360
    DefaultTiTimeout    REG_DWORD    0x11e1a300
    LlcRetries    REG_DWORD    0x8
    LlcMaxWindowSize    REG_DWORD    0xa
    MaximumIncomingFrames    REG_DWORD    0x4
    NameQueryRetries    REG_DWORD    0x3
    NameQueryTimeout    REG_DWORD    0x4c4b40
    AddNameQueryRetries    REG_DWORD    0x3
    AddNameQueryTimeout    REG_DWORD    0x4c4b40
    GeneralRetries    REG_DWORD    0x3
    GeneralTimeout    REG_DWORD    0x4c4b40
    WanNameQueryRetries    REG_DWORD    0x5
    UseDixOverEthernet    REG_DWORD    0x0
    QueryWithoutSourceRouting    REG_DWORD    0x0
    AllRoutesNameRecognized    REG_DWORD    0x0
    ComputerName    REG_SZ    UKEBUUASD99
    UserName    REG_SZ    SYSTEM
    EnableStationQueries    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm\Enum
    0    REG_SZ    Root\LEGACY_NM\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Npfs
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    File system
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Npfs\Aliases
    lsass    REG_MULTI_SZ    protected_storage\0netlogon\0lsarpc\0samr
    ntsvcs    REG_MULTI_SZ    eventlog\0svcctl

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Npfs\Enum
    0    REG_SZ    Root\LEGACY_NPFS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nptrc
    (Default)    REG_SZ    
    Type    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\nptrc.sys
    DisplayName    REG_SZ    nptrc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nptrc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nptrc\Enum
    0    REG_SZ    Root\LEGACY_NPTRC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsrexecd
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\apps_srv\Legato\nsr\bin\nsrexecd.exe
    DisplayName    REG_SZ    NetWorker Remote Exec Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Listens for, authenticates, and processes remote execution requests from the NetWorker Backup and Recover Server. It must be running for proper NetWorker client, storage node, or server operation.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsrexecd\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsrexecd\Enum
    0    REG_SZ    Root\LEGACY_NSREXECD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsrpm
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\apps_srv\Legato\nsr\bin\nsrpm.exe
    DisplayName    REG_SZ    NetWorker Power Monitor
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Works with the energy-saving features of Windows to keep NetWorker components running properly during power-saving modes. It may be disabled if not needed.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsrpm\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsrpm\Enum
    0    REG_SZ    Root\LEGACY_NSRPM\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs
    DependOnService    REG_MULTI_SZ    EventLog\0RpcSs\0EventSystem
    Description    REG_SZ    Allows files to be automatically copied and maintained simultaneously on multiple servers. If this service is stopped, file replication will not occur and servers will not synchronize. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    File Replication
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\system32\ntfrs.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
    Working Directory    REG_SZ    C:\WINNT\ntfrs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\SysVol

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ntfs
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    File system
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ntfs\Enum
    0    REG_SZ    Root\LEGACY_NTFS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\lsass.exe
    DisplayName    REG_SZ    NT LM Security Support Provider
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides security to remote procedure call (RPC) programs that use transports other than named pipes.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp\Enum
    0    REG_SZ    Root\LEGACY_NTLMSSP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Removable Storage
    DependOnService    REG_MULTI_SZ    RpcSs
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Manages and catalogs removable media and operates automated removable media devices. If this service is stopped, programs that are dependent on Removable Storage, such as Backup and Remote Storage, will operate more slowly. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc\Config

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc\Config\Standalone

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\ntmssvc.dll
    ShutdownTimeout    REG_DWORD    0x7530

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc\Enum
    0    REG_SZ    Root\LEGACY_NTMSSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtTdiDr
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x8
    ImagePath    REG_SZ    system32\drivers\lhmon.sys
    DisplayName    REG_SZ    NtTdiDr
    Group    REG_SZ    PNP_TDI
    DependOnService    REG_MULTI_SZ    tcpip

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Null
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Base
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Null\Enum
    0    REG_SZ    Root\LEGACY_NULL\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ObjectManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\object.exe
    DisplayName    REG_SZ    WMS Object Manager
    ObjectName    REG_SZ    eur\ldngtssvcorb01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ObjectManager\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ObjectManager\Enum
    0    REG_SZ    Root\LEGACY_OBJECTMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OmniKernel
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\Bin\omnikrnl.exe
    DisplayName    REG_SZ    WMS OmniKernel
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OmniKernel\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OmniKernel\Enum
    0    REG_SZ    Root\LEGACY_OMNIKERNEL\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Oracle Monitor Service
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\Program Files\guardium\guardium_stap\guardium_stap\orclsvc.exe /service
    DisplayName    REG_SZ    Oracle Monitor Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Service for monitoring Oracle instances activity

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Oracle Monitor Service\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Oracle Monitor Service\Enum
    0    REG_SZ    Root\LEGACY_ORACLE_MONITOR_SERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\orcltrc
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\orcltrc.sys
    DisplayName    REG_SZ    Oracle process monitor driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\orcltrc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\orcltrc\Enum
    0    REG_SZ    Root\LEGACY_ORCLTRC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ose
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    DisplayName    REG_SZ    Office Source Engine
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ose\Security
    Security    REG_BINARY    01001480E4000000F0000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200B40008000000000018009D01000001020000000000052000000022020000000014009D01000001010000000000010000000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ose\Enum
    0    REG_SZ    Root\LEGACY_OSE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Parport
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Parallel arbitrator
    Start    REG_DWORD    0x3
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PartMgr
    DisplayName    REG_SZ    Partition Manager
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x5
    Type    REG_DWORD    0x1
    EnableCounterForIoctl    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PartMgr\Enum
    0    REG_SZ    Root\LEGACY_PARTMGR\0000
    Count    REG_DWORD    0x46
    NextInstance    REG_DWORD    0x46
    1    REG_SZ    SCSI\Disk&Ven_HP&Prod_LOGICAL_VOLUME&Rev_7.08\5&1d8810e0&0&000400
    2    REG_SZ    SCSI\Disk&Ven_HP&Prod_LOGICAL_VOLUME&Rev_7.08\5&1d8810e0&0&000500
    26    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953076
    27    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953075
    28    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953074
    29    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953073
    30    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953072
    31    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953071
    32    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953070
    33    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306F
    34    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306E
    35    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306D
    36    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306C
    37    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306B
    38    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&000029010095306A
    39    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953069
    40    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953068
    41    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953067
    42    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953066
    43    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953065
    44    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953064
    45    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953063
    46    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\Mp&0001&0002&0000290100953062
    25    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000043
    21    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\emcp&0001&0001&5_0_0_0
    22    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000042
    20    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000041
    19    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000040
    18    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003f
    17    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003e
    16    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003d
    15    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003c
    14    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003b
    13    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00003a
    12    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000039
    11    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000038
    10    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000037
    9    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000036
    8    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000035
    7    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000034
    6    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000033
    5    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000032
    4    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000031
    3    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000030
    24    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&00002f
    23    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&5ee67ff&0&000000
    48    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000000
    49    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00002f
    50    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000030
    51    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000031
    52    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000032
    53    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000033
    54    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000034
    55    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000035
    56    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000036
    57    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000037
    58    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000038
    59    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000039
    60    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003a
    61    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003b
    62    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003c
    63    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003d
    64    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003e
    65    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&00003f
    66    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000040
    67    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000041
    68    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000042
    47    REG_SZ    SCSI\Disk&Ven_EMC&Prod_SYMMETRIX&Rev_5771\5&1d231980&0&000043
    69    REG_SZ    SCSI\Disk&Ven_EMC&Prod_Power&\emcp&0001&0001&3_0_0_0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PatrolAgent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\BMC Software\Patrol3\bin\PatrolAgent.exe"
    DisplayName    REG_SZ    PatrolAgent
    ObjectName    REG_SZ    eur\ldnwassvcgtspatmon01
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PatrolAgent\Parameters
    Port    REG_DWORD    0xc6d

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PatrolAgent\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD010200010200000000000520000000230200000000240072000000010500000000000515000000093A2A2432621F2A828BA628300E1200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PatrolAgent\Enum
    0    REG_SZ    Root\LEGACY_PATROLAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCI
    ErrorControl    REG_DWORD    0x3
    Group    REG_SZ    Boot Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x2
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    PCI Bus Driver
    ImagePath    REG_SZ    system32\DRIVERS\pci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCI\Parameters
    1045C621    REG_BINARY    0400000000000000
    10950640    REG_BINARY    0400000000000000
    80861230    REG_BINARY    0400000000000000
    80867010    REG_BINARY    0400000000000000
    104B0140    REG_BINARY    0800000000000000
    11790603    REG_BINARY    0800000000000000
    80867113    REG_BINARY    0800000000000000
    497884C5    REG_BINARY    0800000000000000
    11063040    REG_BINARY    0800000000000000
    0E111000    REG_BINARY    1000000000000000
    0E112000    REG_BINARY    1000000000000000
    10390406    REG_BINARY    1000000000000000
    80860482    REG_BINARY    0040000000000000
    80860008    REG_BINARY    1000000000000000
    10140002    REG_BINARY    1000000000000000
    10800600    REG_BINARY    2000000000000000
    10131100    REG_BINARY    4000000000000000
    10B95219    REG_BINARY    8000000000000000
    1C1C0001    REG_BINARY    0001000000000000
    10970038    REG_BINARY    0001000000000000
    100BD001    REG_BINARY    0004000000000000
    808604A3    REG_BINARY    0008000000000000
    10AA0000    REG_BINARY    0008000000000000
    533388D1    REG_BINARY    0000000001000000
    11790605    REG_BINARY    0010000000000000
    10131110    REG_BINARY    0020000000000000
    11800478    REG_BINARY    0020000000000000
    11800475    REG_BINARY    0020000000000000
    11800476    REG_BINARY    0020000000000000
    10040101    REG_BINARY    0040000000000000
    10421000    REG_BINARY    0040000000000000
    104CAC12    REG_BINARY    0000010000000000
    11800466    REG_BINARY    0000010000000000
    10140095    REG_BINARY    0000040000000000
    80862418    REG_BINARY    0000040000000000
    80862428    REG_BINARY    0000040000000000
    8086244E    REG_BINARY    0000040000000000
    80862448    REG_BINARY    0000040000000000
    8086122E    REG_BINARY    0000080000000000
    80867000    REG_BINARY    0000080000000000
    80867110    REG_BINARY    0000080000000000
    80867600    REG_BINARY    0000080000000000
    10024747    REG_BINARY    0000400000000000
    10024754    REG_BINARY    0000000001000000
    53338901    REG_BINARY    0000000001000000
    101300D6    REG_BINARY    0000400000000000
    104CAC15    REG_BINARY    0000400000000000
    110B0004    REG_BINARY    0000400000000000
    1000000F    REG_BINARY    0000400000000000
    104CAC17    REG_BINARY    0000400000000000
    10239397    REG_BINARY    0000400000000000
    10024742    REG_BINARY    0000400000000000
    10024744    REG_BINARY    0000400000000000
    10024749    REG_BINARY    0000400000000000
    10024750    REG_BINARY    0000400000000000
    10024751    REG_BINARY    0000400000000000
    10024755    REG_BINARY    0000400000000000
    10024757    REG_BINARY    0000402000000000
    10024759    REG_BINARY    0000402000000000
    10024C42    REG_BINARY    0000400000000000
    10024C44    REG_BINARY    0000400000000000
    10024C47    REG_BINARY    0000400000000000
    10024C49    REG_BINARY    0000400000000000
    10024C50    REG_BINARY    0000400000000000
    10024C51    REG_BINARY    0000400000000000
    10025654    REG_BINARY    0000000001000000
    10025655    REG_BINARY    0000400000000000
    10025656    REG_BINARY    0000400000000000
    121A0003    REG_BINARY    0000400000000000
    11C15811    REG_BINARY    0000400000000000
    1045C861107B9300    REG_BINARY    0000400000000000
    1045C8611045C861    REG_BINARY    0000400000000000
    80861231    REG_BINARY    0000000100000000
    12730002    REG_BINARY    0000000100000000
    1014007D    REG_BINARY    0000000100000000
    12850100    REG_BINARY    0000000100000000
    12176836    REG_BINARY    0000000800000000
    12176832    REG_BINARY    0000000800000000
    109107A0    REG_BINARY    0000002000000000
    80867800    REG_BINARY    0000002000000000
    10c88005    REG_BINARY    0000002000000000
    10c88006    REG_BINARY    0000002000000000
    10c80005    REG_BINARY    0000002000000000
    10c80006    REG_BINARY    0000002000000000
    102B1001    REG_BINARY    0000008000000000
    10DD0100    REG_BINARY    0000002000000000
    10950646    REG_BINARY    0000002000000000
    10950670    REG_BINARY    0000002000000000
    10950648    REG_BINARY    0000002000000000
    10110026    REG_BINARY    0000002000000000
    8086B154    REG_BINARY    0000002000000000
    53338904    REG_BINARY    0000002000000000
    11068598    REG_BINARY    0000002000000000
    11068605    REG_BINARY    0000002000000000
    11790609    REG_BINARY    0000004000000000
    10140047    REG_BINARY    0000004000000000
    102B051B    REG_BINARY    0000008000000000
    102B0520    REG_BINARY    0000008000000000
    102B0521    REG_BINARY    0000008000000000
    102B1025    REG_BINARY    0000008000000000
    102B0525    REG_BINARY    0000008000000000
    102B2527    REG_BINARY    0000008000000000
    102B2537    REG_BINARY    0000008000000000
    102B0527    REG_BINARY    0000008000000000
    102B0528    REG_BINARY    0000008000000000
    80867121    REG_BINARY    0000008000000000
    80867123    REG_BINARY    0000008000000000
    80867125    REG_BINARY    0000008000000000
    80861132    REG_BINARY    0000008000000000
    90050050    REG_BINARY    0000008000000000
    9005005F    REG_BINARY    0000008000000000
    10024752    REG_BINARY    0000008000000000
    1002474F    REG_BINARY    0000008000000000
    1002474D    REG_BINARY    0000008000000000
    10024753    REG_BINARY    0000008000000000
    1002474C    REG_BINARY    0000008000000000
    1002474E    REG_BINARY    0000008000000000
    10024C4D    REG_BINARY    0000008000000000
    10024C4E    REG_BINARY    0000008000000000
    10024C52    REG_BINARY    0000008000000000
    10024C53    REG_BINARY    0000008000000000
    10239880    REG_BINARY    0000008000000000
    10DE00A0    REG_BINARY    0000008000000000
    10DE00A1    REG_BINARY    0000008000000000
    10DE00A3    REG_BINARY    0000008000000000
    10DE00B0    REG_BINARY    0000008000000000
    10DE00B1    REG_BINARY    0000008000000000
    10DE00B3    REG_BINARY    0000008000000000
    10DE0100    REG_BINARY    0000008000000000
    10DE0101    REG_BINARY    0000008000000000
    10DE0102    REG_BINARY    0000008000000000
    10DE0103    REG_BINARY    0000008000000000
    10DE0120    REG_BINARY    0000008000000000
    10DE0121    REG_BINARY    0000008000000000
    10DE0122    REG_BINARY    0000008000000000
    10DE0123    REG_BINARY    0000008000000000
    10DE0150    REG_BINARY    0000008000000000
    10DE0151    REG_BINARY    0000008000000000
    10DE0152    REG_BINARY    0000008000000000
    10DE0153    REG_BINARY    0000008000000000
    10DE0200    REG_BINARY    0000008000000000
    10DE0201    REG_BINARY    0000008000000000
    10DE0202    REG_BINARY    0000008000000000
    10DE0203    REG_BINARY    0000008000000000
    12D20018    REG_BINARY    0000008000000000
    12D20019    REG_BINARY    0000008000000000
    10136003    REG_BINARY    0000008000000000
    3D3D000A    REG_BINARY    0000008000000000
    10024158    REG_BINARY    0000000001000000
    10024354    REG_BINARY    0000000001000000
    10024358    REG_BINARY    0000000001000000
    10024554    REG_BINARY    0000000001000000
    10024758    REG_BINARY    0000000001000000
    10024C54    REG_BINARY    0000000001000000
    53338810    REG_BINARY    0000000001000000
    53338811    REG_BINARY    0000000001000000
    53338812    REG_BINARY    0000000001000000
    53338814    REG_BINARY    0000000001000000
    53338880    REG_BINARY    0000000001000000
    533388B0    REG_BINARY    0000000001000000
    533388C0    REG_BINARY    0000000001000000
    533388C1    REG_BINARY    0000000001000000
    533388D0    REG_BINARY    0000000001000000
    533388F0    REG_BINARY    0000000001000000
    53338902    REG_BINARY    0000000001000000
    0E11B109    REG_BINARY    0000000002000000
    100C3202    REG_BINARY    008A000000000000
    10668002    REG_BINARY    0000300000000000
    10660002    REG_BINARY    0000300000000000
    10040102    REG_BINARY    0040000200000000
    1045C814    REG_BINARY    0000402000000000
    10024756    REG_BINARY    0000402000000000
    1002475A    REG_BINARY    0000402000000000
    1000000B    REG_BINARY    000000A000000000
    10DE0020    REG_BINARY    000000A000000000
    10DE0028    REG_BINARY    000000A000000000
    10DE0029    REG_BINARY    000000A000000000
    10DE002A    REG_BINARY    000000A000000000
    10DE002B    REG_BINARY    000000A000000000
    10DE002C    REG_BINARY    000000A000000000
    10DE002D    REG_BINARY    000000A000000000
    10DE002E    REG_BINARY    000000A000000000
    10DE002F    REG_BINARY    000000A000000000
    101300D6101880D6    REG_BINARY    0000000000000000
    0E11B2040E11B206    REG_BINARY    0000004000000000
    0E11B204103C3304    REG_BINARY    0000004000000000
    0E11B204103C3305    REG_BINARY    0000004000000000
    111D801C    REG_BINARY    00000000A0000000
    11660103    REG_BINARY    00000000A0000000
    10DFFE00    REG_BINARY    00000000A0000000
    10772432    REG_BINARY    00000000A0000000
    10B58114    REG_BINARY    00000000A0000000
    10B58533    REG_BINARY    00000000A0000000
    103C3203    REG_BINARY    00000000A0000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCI\Enum
    0    REG_SZ    ACPI\PNP0A03\7
    Count    REG_DWORD    0xc
    NextInstance    REG_DWORD    0xc
    1    REG_SZ    ACPI\PNP0A03\8
    2    REG_SZ    PCI\VEN_10DE&DEV_005C&SUBSYS_00000000&REV_A2\3&20fea912&0&48
    3    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&20fea912&0&60
    4    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&20fea912&0&68
    5    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&20fea912&0&70
    6    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&33b859b7&0&58
    7    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&33b859b7&0&60
    8    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&33b859b7&0&68
    9    REG_SZ    PCI\VEN_10DE&DEV_005D&SUBSYS_00000000&REV_A3\3&33b859b7&0&70
    10    REG_SZ    PCI\VEN_1022&DEV_7458&SUBSYS_00000000&REV_12\3&33b859b7&0&80
    11    REG_SZ    PCI\VEN_1022&DEV_7458&SUBSYS_00000000&REV_12\3&33b859b7&0&88

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCIIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0x3
    Type    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\pciide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCIIde\Enum
    0    REG_SZ    PCI\VEN_10DE&DEV_0053&SUBSYS_31F8103C&REV_A3\3&20fea912&0&30
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Pcmcia
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Pcmcia\Parameters
    SoundsEnabled    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcstrc
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\pcstrc.sys
    DisplayName    REG_SZ    Process monitor driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcstrc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcstrc\Enum
    0    REG_SZ    Root\LEGACY_PCSTRC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PDCOMP
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PDFRAME
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PDRELI
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PDRFRAME
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perc2
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perc2\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perc2\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perc2hib
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Filter
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfDisk

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfDisk\Performance
    Close    REG_SZ    CloseDiskObject
    Collect    REG_SZ    CollectDiskObjectData
    Collect Timeout    REG_DWORD    0x7d0
    Library    REG_SZ    perfdisk.dll
    Object List    REG_SZ    234 236
    Open    REG_SZ    OpenDiskObject
    Open Timeout    REG_DWORD    0x1388
    WbemAdapFileSignature    REG_BINARY    C81B170946AFE7E4F8D7E2E6B7B56DC7
    WbemAdapFileTime    REG_BINARY    E87B68B95862C701
    WbemAdapFileSize    REG_DWORD    0x7000
    WbemAdapStatus    REG_DWORD    0x0
    Disable Performance Counters    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfNet

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfNet\Performance
    Close    REG_SZ    CloseNetSvcsObject
    Collect    REG_SZ    CollectNetSvcsObjectData
    Collect Timeout    REG_DWORD    0x1388
    Library    REG_SZ    perfnet.dll
    Object List    REG_SZ    52 262 330 1300
    Open    REG_SZ    OpenNetSvcsObject
    Open Timeout    REG_DWORD    0x1f40
    WbemAdapFileSignature    REG_BINARY    3C13F47EF1F720882B74A0C51AE9ADAF
    WbemAdapFileTime    REG_BINARY    E87B68B95862C701
    WbemAdapFileSize    REG_DWORD    0x4e00
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfOS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfOS\Performance
    Close    REG_SZ    CloseOSObject
    Collect    REG_SZ    CollectOSObjectData
    Collect Timeout    REG_DWORD    0x1f40
    Library    REG_SZ    perfos.dll
    Object List    REG_SZ    2 4 86 238 260 700
    Open    REG_SZ    OpenOSObject
    Open Timeout    REG_DWORD    0x1388
    WbemAdapFileSignature    REG_BINARY    974B3771F714F817EAC61CDB02FF2F00
    WbemAdapFileTime    REG_BINARY    42DE6AB95862C701
    WbemAdapFileSize    REG_DWORD    0x6a00
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance
    Close    REG_SZ    CloseSysProcessObject
    Collect    REG_SZ    CollectSysProcessObjectData
    Collect Timeout    REG_DWORD    0x1f40
    Library    REG_SZ    perfproc.dll
    Object List    REG_SZ    230 232 786 740 816 1408 1500 1548 1760
    Open    REG_SZ    OpenSysProcessObject
    Open Timeout    REG_DWORD    0x2710
    WbemAdapFileSignature    REG_BINARY    C484D6625785B449630583A3138ADA3A
    WbemAdapFileTime    REG_BINARY    42DE6AB95862C701
    WbemAdapFileSize    REG_DWORD    0x8c00
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plugin_Host
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    "C:\Program Files\Veritas\winsolutions\bin\PluginHost.exe"
    DisplayName    REG_SZ    Symantec Plug-in Host Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Hosts all the plug-ins that enable discovery and commit operations.
    Environment    REG_MULTI_SZ    EAT_HOME_DIR=C:\Program Files\Veritas\VRTSobc\pal33\

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plugin_Host\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plugin_Host\Enum
    0    REG_SZ    Root\LEGACY_PLUGIN_HOST\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
    Description    REG_SZ    Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
    DisplayName    REG_SZ    Plug and Play
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    PlugPlay
    ImagePath    REG_SZ    C:\WINNT\system32\services.exe
    ObjectName    REG_SZ    LocalSystem
    PlugPlayServiceType    REG_DWORD    0x3
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PnSson

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PnSson\NetworkProvider
    ProviderPath    REG_SZ    C:\Program Files\Citrix\ICA Client\pnsson.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\lsass.exe
    DisplayName    REG_SZ    IPSEC Services
    DependOnService    REG_MULTI_SZ    RPCSS\0Tcpip\0IPSec
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides end-to-end security between clients and servers on TCP/IP networks. If this service is stopped, TCP/IP security between clients and servers on the network will be impaired. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley
    NLBSFlags    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D00020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Enum
    0    REG_SZ    Root\LEGACY_POLICYAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PptpMiniport
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\raspptp.sys
    DisplayName    REG_SZ    WAN Miniport (PPTP)
    Description    REG_SZ    WAN Miniport (PPTP)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PptpMiniport\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PptpMiniport\Enum
    0    REG_SZ    Root\MS_PPTPMINIPORT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\prgnDiscAgent
    Type    REG_DWORD    0x110
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Hewlett-Packard\Discovery Agent\bin32\discagnt.exe"
    DisplayName    REG_SZ    HP Enterprise Discovery Agent
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables communication between remote computers and the HP Enterprise Discovery Server
    FailureActions    REG_BINARY    000000000000000000000000010000000000000001000000E0930400

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\prgnDiscAgent\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\prgnDiscAgent\Enum
    0    REG_SZ    Root\LEGACY_PRGNDISCAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x3
    ImagePath    REG_SZ    system32\DRIVERS\processr.sys
    DisplayName    REG_SZ    Processor Driver
    Group    REG_SZ    Extended Base

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor\Enum
    0    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_0
    Count    REG_DWORD    0x8
    NextInstance    REG_DWORD    0x8
    1    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_1
    2    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_2
    3    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_3
    4    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_4
    5    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_5
    6    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_6
    7    REG_SZ    ACPI\AuthenticAMD_-_x86_Family_15_Model_65\_7

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage
    DependOnService    REG_MULTI_SZ    RpcSs
    Description    REG_SZ    Protects storage of sensitive information, such as private keys, and prevents access by unauthorized services, processes, or users. If this service is stopped, protected storage will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Protected Storage
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\lsass.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x120

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage\Enum
    0    REG_SZ    Root\LEGACY_PROTECTEDSTORAGE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProxyServer
    Type    REG_DWORD    0x110
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "D:\IntellectFlow\ProxyServer\ProxyServer.exe"
    ObjectName    REG_SZ    LocalSystem
    DisplayName    REG_SZ    ProxyServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProxyServer\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProxyServer\Enum
    0    REG_SZ    Root\LEGACY_PROXYSERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ptilink
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\ptilink.sys
    DisplayName    REG_SZ    Direct Parallel Link Driver
    Description    REG_SZ    Direct Parallel Link Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ptilink\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ptilink\Enum
    0    REG_SZ    Root\MS_PTIMINIPORT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1080
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3d
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1080\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1080\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ql10wnt
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x23
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ql10wnt\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ql10wnt\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql12160
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3f
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql12160\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql12160\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1240
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x31
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1240\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1240\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1280
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3f
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1280\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql1280\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2100
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x28
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2100\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2100\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2200
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x28
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2200\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2200\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2300
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x28
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2300\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2300\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAcd
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\rasacd.sys
    DisplayName    REG_SZ    Remote Access Auto Connection Driver
    Group    REG_SZ    Streams Drivers
    Description    REG_SZ    Remote Access Auto Connection Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAcd\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAcd\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAcd\Enum
    0    REG_SZ    Root\LEGACY_RASACD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Remote Access Auto Connection Manager
    DependOnService    REG_MULTI_SZ    RasMan\0Tapisrv
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\rasauto.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto\Security
    Security    REG_BINARY    0100148078000000840000001400000044000000020030000200000002801400FF010F000101000000000001000000000240140070000C00010100000000000100000000020034000200000000001800FF010F000102000000000005200000002002000000001400FF010F00010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rasl2tp
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\rasl2tp.sys
    DisplayName    REG_SZ    WAN Miniport (L2TP)
    Description    REG_SZ    WAN Miniport (L2TP)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rasl2tp\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rasl2tp\Enum
    0    REG_SZ    Root\MS_L2TPMINIPORT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Remote Access Connection Manager
    DependOnService    REG_MULTI_SZ    Tapisrv
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Creates a network connection.
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters
    Medias    REG_MULTI_SZ    rastapi
    ServiceDll    REG_SZ    C:\WINNT\System32\rasmans.dll
    IpOutLowWatermark    REG_DWORD    0x1
    IpOutHighWatermark    REG_DWORD    0x5

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP
    MaxConfigure    REG_DWORD    0xa
    MaxFailure    REG_DWORD    0xa
    MaxReject    REG_DWORD    0x5
    MaxTerminate    REG_DWORD    0x2
    Multilink    REG_DWORD    0x0
    NegotiateTime    REG_DWORD    0x96
    RestartTimer    REG_DWORD    0x3

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\ControlProtocols

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\ControlProtocols\BuiltIn
    Path    REG_SZ    C:\WINNT\System32\rasppp.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\ControlProtocols\Chap
    Path    REG_SZ    C:\WINNT\System32\raschap.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP
    Path    REG_SZ    C:\WINNT\System32\rasppp.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13
    FriendlyName    REG_SZ    Smart Card or other certificate
    Path    REG_SZ    C:\WINNT\System32\rastls.dll
    ConfigUiPath    REG_SZ    C:\WINNT\System32\rastls.dll
    IdentityPath    REG_SZ    C:\WINNT\System32\rastls.dll
    InteractiveUIPath    REG_SZ    C:\WINNT\System32\rastls.dll
    InvokeUsernameDialog    REG_DWORD    0x0
    InvokePasswordDialog    REG_DWORD    0x0
    MPPEEncryptionSupported    REG_DWORD    0x1
    ConfigCLSID    REG_SZ    {58AB2366-D597-11d1-B90E-00C04FC9B263}
    StandaloneSupported    REG_DWORD    0x0
    NoRootRevocationCheck    REG_DWORD    0x1
    RolesSupported    REG_DWORD    0x3
    PerPolicyConfig    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\25
    FriendlyName    REG_SZ    Protected EAP (PEAP)
    Path    REG_SZ    C:\WINNT\System32\rastls.dll
    ConfigUiPath    REG_SZ    C:\WINNT\System32\rastls.dll
    IdentityPath    REG_SZ    C:\WINNT\System32\rastls.dll
    InteractiveUIPath    REG_SZ    C:\WINNT\System32\rastls.dll
    InvokeUsernameDialog    REG_DWORD    0x0
    InvokePasswordDialog    REG_DWORD    0x0
    MPPEEncryptionSupported    REG_DWORD    0x1
    ConfigCLSID    REG_SZ    {58AB2366-D597-11d1-B90E-00C04FC9B263}
    StandaloneSupported    REG_DWORD    0x1
    NoRootRevocationCheck    REG_DWORD    0x1
    RolesSupported    REG_DWORD    0x13
    PerPolicyConfig    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\26
    FriendlyName    REG_SZ    Secured password (EAP-MSCHAP v2)
    Path    REG_SZ    C:\WINNT\System32\raschap.dll
    ConfigUiPath    REG_SZ    C:\WINNT\System32\raschap.dll
    IdentityPath    REG_SZ    C:\WINNT\System32\raschap.dll
    InteractiveUIPath    REG_SZ    C:\WINNT\System32\raschap.dll
    InvokeUsernameDialog    REG_DWORD    0x0
    InvokePasswordDialog    REG_DWORD    0x0
    MPPEEncryptionSupported    REG_DWORD    0x1
    ConfigCLSID    REG_SZ    {2af6bcaa-f526-4803-aeb8-5777ce386647}
    StandaloneSupported    REG_DWORD    0x1
    RolesSupported    REG_DWORD    0x17
    PerPolicyConfig    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\4
    FriendlyName    REG_SZ    MD5-Challenge
    Path    REG_SZ    C:\WINNT\System32\raschap.dll
    InvokeUsernameDialog    REG_DWORD    0x1
    InvokePasswordDialog    REG_DWORD    0x1
    RolesSupported    REG_DWORD    0xb
    PerPolicyConfig    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Security
    Security    REG_BINARY    0100148078000000840000001400000044000000020030000200000002801400FF010F000101000000000001000000000240140070000C00010100000000000100000000020034000200000000001800FF010F000102000000000005200000002002000000001400FF010F00010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Enum
    0    REG_SZ    Root\LEGACY_RASMAN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasPppoe
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\raspppoe.sys
    DisplayName    REG_SZ    Remote Access PPPOE Driver
    Description    REG_SZ    Remote Access PPPOE Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasPppoe\Linkage
    Bind    REG_MULTI_SZ    \Device\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    Route    REG_MULTI_SZ    "{1C720EB3-65F4-44B5-A616-874B801E4A74}"
    Export    REG_MULTI_SZ    \Device\RasPppoe_{1C720EB3-65F4-44B5-A616-874B801E4A74}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasPppoe\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasPppoe\Enum
    0    REG_SZ    Root\MS_PPPOEMINIPORT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Raspti
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\raspti.sys
    DisplayName    REG_SZ    Direct Parallel
    Description    REG_SZ    Direct Parallel

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Raspti\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Raspti\Enum
    0    REG_SZ    Root\MS_PTIMINIPORT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdbss
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x4
    ImagePath    REG_SZ    system32\DRIVERS\rdbss.sys
    DisplayName    REG_SZ    Rdbss
    Group    REG_SZ    Network
    Description    REG_SZ    Rdbss

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdbss\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdbss\Enum
    0    REG_SZ    Root\LEGACY_RDBSS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPCDD
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Video Save
    ImagePath    REG_SZ    System32\DRIVERS\RDPCDD.sys
    Start    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPCDD\Device0
    Device Description    REG_SZ    RDPDD Chained DD
    InstalledDisplayDrivers    REG_MULTI_SZ    RDPDD
    MirrorDriver    REG_DWORD    0x1
    VgaCompatible    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPCDD\Video
    VideoID    REG_SZ    {DEB039CC-B704-4F53-B43E-9DD4432FA2E9}
    Service    REG_SZ    RDPCDD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPCDD\Enum
    0    REG_SZ    Root\LEGACY_RDPCDD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPDD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPDD\Device0
    InstalledDisplayDrivers    REG_MULTI_SZ    RDPDD
    VgaCompatible    REG_DWORD    0x0
    Attach.RelativeX    REG_DWORD    0x0
    Attach.RelativeY    REG_DWORD    0x0
    Attach.ToDesktop    REG_DWORD    0x1
    DefaultSettings.XResolution    REG_DWORD    0x320
    DefaultSettings.YResolution    REG_DWORD    0x258

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdpdr
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\rdpdr.sys
    DisplayName    REG_SZ    Terminal Server Device Redirector Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdpdr\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdpdr\Enum
    0    REG_SZ    Root\RDPDR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
    DeviceName    REG_SZ    \Device\RdpDr
    Name    REG_SZ    Microsoft Terminal Services
    ProviderPath    REG_SZ    C:\WINNT\System32\drprov.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\Enum
    0    REG_SZ    Root\LEGACY_RDPNP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPWD
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPWD\Enum
    0    REG_SZ    Root\LEGACY_RDPWD\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\sessmgr.exe
    DisplayName    REG_SZ    Remote Desktop Help Session Manager
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\redbook
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x3
    ImagePath    REG_SZ    system32\DRIVERS\redbook.sys
    DisplayName    REG_SZ    Digital CD Audio Playback Filter Driver
    Group    REG_SZ    Pnp Filter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\redbook\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\redbook\Enum
    0    REG_SZ    IDE\CdRomTSSTcorp_DVD-ROM_TS-L332A_______________HG00____\5&2270d2f8&0&0.0.0
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Routing and Remote Access
    DependOnService    REG_MULTI_SZ    RpcSS
    DependOnGroup    REG_MULTI_SZ    NetBIOSGroup
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Offers routing services to businesses in local area and wide area network environments.
    (Default)    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting\Providers
    ActiveProvider    REG_SZ    {1AA7F846-C7F5-11D0-A376-00C04FC9DA04}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting\Providers\{1AA7F840-C7F5-11D0-A376-00C04FC9DA04}
    ConfigClsid    REG_SZ    {1AA7F840-C7F5-11D0-A376-00C04FC9DA04}
    DisplayName    REG_SZ    RADIUS Accounting
    Path    REG_SZ    C:\WINNT\System32\rasrad.dll
    ProviderTypeGUID    REG_SZ    {76560D80-2BFD-11d2-9539-3078302C2030}
    VendorName    REG_SZ    Microsoft

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting\Providers\{1AA7F846-C7F5-11D0-A376-00C04FC9DA04}
    ConfigClsid    REG_SZ    
    DisplayName    REG_SZ    Windows Accounting
    Path    REG_SZ    C:\WINNT\System32\mprddm.dll
    ProviderTypeGUID    REG_SZ    {76560D81-2BFD-11d2-9539-3078302C2030}
    VendorName    REG_SZ    Microsoft

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication\Providers
    ActiveProvider    REG_SZ    {1AA7F841-C7F5-11D0-A376-00C04FC9DA04}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication\Providers\{1AA7F83F-C7F5-11D0-A376-00C04FC9DA04}
    ConfigClsid    REG_SZ    {1AA7F83F-C7F5-11D0-A376-00C04FC9DA04}
    DisplayName    REG_SZ    RADIUS Authentication
    Path    REG_SZ    C:\WINNT\System32\rasrad.dll
    VendorName    REG_SZ    Microsoft
    ProviderTypeGUID    REG_SZ    {76560D00-2BFD-11d2-9539-3078302C2030}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication\Providers\{1AA7F841-C7F5-11D0-A376-00C04FC9DA04}
    ConfigClsid    REG_SZ    
    DisplayName    REG_SZ    Windows Authentication
    Path    REG_SZ    C:\WINNT\System32\mprddm.dll
    VendorName    REG_SZ    Microsoft
    ProviderTypeGUID    REG_SZ    {76560D01-2BFD-11d2-9539-3078302C2030}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\DemandDialManager
    DllPath    REG_SZ    C:\WINNT\System32\mprddm.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\0
    InterfaceName    REG_SZ    Loopback
    Type    REG_DWORD    0x5
    Enabled    REG_DWORD    0x1
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\0\Ip
    ProtocolId    REG_DWORD    0x21
    InterfaceInfo    REG_BINARY    0100000068000000030000000500FFFF3800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\1
    InterfaceName    REG_SZ    Internal
    Type    REG_DWORD    0x4
    Enabled    REG_DWORD    0x1
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\1\Ip
    ProtocolId    REG_DWORD    0x21
    InterfaceInfo    REG_BINARY    0100000068000000030000000500FFFF3800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\2
    InterfaceName    REG_SZ    {DF7DB703-FE56-4F72-89FB-371431019CD1}
    Type    REG_DWORD    0x3
    Enabled    REG_DWORD    0x1
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\3
    InterfaceName    REG_SZ    {EE812484-03FC-4739-9BC2-B9D094470C3D}
    Type    REG_DWORD    0x3
    Enabled    REG_DWORD    0x1
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\4
    InterfaceName    REG_SZ    {1C720EB3-65F4-44B5-A616-874B801E4A74}
    Type    REG_DWORD    0x3
    Enabled    REG_DWORD    0x1
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\4\Ip
    ProtocolId    REG_DWORD    0x21
    InterfaceInfo    REG_BINARY    0100000068000000030000000500FFFF3800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters
    RouterType    REG_DWORD    0x1
    ServerFlags    REG_DWORD    0x802702
    ServiceDll    REG_SZ    C:\WINNT\System32\mprdim.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AppleTalk
    EnableIn    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip
    AllowClientIpAddresses    REG_DWORD    0x0
    AllowNetworkAccess    REG_DWORD    0x1
    EnableIn    REG_DWORD    0x1
    IpAddress    REG_SZ    0.0.0.0
    IpMask    REG_SZ    0.0.0.0
    UseDhcpAddressing    REG_DWORD    0x1
    EnableRoute    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip\StaticAddressPool

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip\StaticAddressPool\0
    From    REG_DWORD    0x0
    To    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ipx
    EnableIn    REG_DWORD    0x1
    AcceptRemoteNodeNumber    REG_DWORD    0x1
    AllowNetworkAccess    REG_DWORD    0x1
    AutoWanNetAllocation    REG_DWORD    0x1
    FirstWanNet    REG_DWORD    0x0
    GlobalWanNet    REG_DWORD    0x1
    LastWanNet    REG_DWORD    0x0
    EnableRoute    REG_DWORD    0x1
    WanNetPoolSize    REG_DWORD    0x3e8

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Nbf
    EnableIn    REG_DWORD    0x1
    AllowNetworkAccess    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Performance
    Open    REG_SZ    OpenRasPerformanceData
    Close    REG_SZ    CloseRasPerformanceData
    Collect    REG_SZ    CollectRasPerformanceData
    Library    REG_SZ    C:\WINNT\System32\rasctrs.dll
    PerfIniFile    REG_SZ    rasctrs.ini
    Last Counter    REG_DWORD    0x7ba
    Last Help    REG_DWORD    0x7bb
    First Counter    REG_DWORD    0x794
    First Help    REG_DWORD    0x795
    WbemAdapFileSignature    REG_BINARY    011371893BFC7C9DD03F3A03284D6D06
    WbemAdapFileTime    REG_BINARY    88A18EB95862C701
    WbemAdapFileSize    REG_DWORD    0x3600
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy
    LicenseType    REG_DWORD    0x2
    ProductDir    REG_SZ    C:\WINNT\system32\IAS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\01
    (Default)    REG_SZ    IAS.ProxyPolicyEnforcer
    Requests    REG_SZ    0 1 2
    Responses    REG_SZ    0 1 2 3 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\02
    (Default)    REG_SZ    IAS.PEAPUpfront
    Providers    REG_SZ    1
    Requests    REG_SZ    0 2
    Responses    REG_SZ    0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\03
    (Default)    REG_SZ    IAS.Realm
    Providers    REG_SZ    1
    Requests    REG_SZ    0 1
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1 2 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\04
    (Default)    REG_SZ    IAS.Realm
    Providers    REG_SZ    0 2
    Requests    REG_SZ    0 1 2
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1 2 3 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\05
    (Default)    REG_SZ    IAS.NTSamNames
    Providers    REG_SZ    1
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\06
    (Default)    REG_SZ    IAS.BaseCampHost
    Replays    REG_SZ    0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\07
    (Default)    REG_SZ    IAS.RadiusProxy
    Providers    REG_SZ    2
    Replays    REG_SZ    0
    Responses    REG_SZ    0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\08
    (Default)    REG_SZ    IAS.ExternalAuthNames
    Providers    REG_SZ    2
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\09
    (Default)    REG_SZ    IAS.NTSamAuthentication
    Providers    REG_SZ    1
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\10
    (Default)    REG_SZ    IAS.AccountValidation
    Providers    REG_SZ    1 3
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1
    Reasons    REG_SZ    33

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\11
    (Default)    REG_SZ    IAS.PolicyEnforcer
    Providers    REG_SZ    1 3
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1
    Reasons    REG_SZ    33

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\12
    (Default)    REG_SZ    IAS.NTSamPerUser
    Providers    REG_SZ    1 3
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1
    Reasons    REG_SZ    33

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\13
    (Default)    REG_SZ    IAS.URHandler
    Providers    REG_SZ    0 1 3
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1
    Reasons    REG_SZ    33

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\14
    (Default)    REG_SZ    IAS.EAP
    Providers    REG_SZ    1
    Requests    REG_SZ    0 2
    Replays    REG_SZ    0
    Responses    REG_SZ    0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\15
    (Default)    REG_SZ    IAS.PostEapRestrictions
    Providers    REG_SZ    0 1 3
    Requests    REG_SZ    0 2
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\16
    (Default)    REG_SZ    IAS.ChangePassword
    Providers    REG_SZ    1
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\17
    (Default)    REG_SZ    IAS.AuthorizationHost
    Replays    REG_SZ    0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\18
    (Default)    REG_SZ    IAS.EAPTLV
    Providers    REG_SZ    1
    Requests    REG_SZ    0 2
    Replays    REG_SZ    0
    Responses    REG_SZ    0 1 2 3 5

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\19
    (Default)    REG_SZ    IAS.Accounting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\20
    (Default)    REG_SZ    IAS.DatabaseAccounting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\21
    (Default)    REG_SZ    IAS.MSChapErrorReporter
    Providers    REG_SZ    0 1 3
    Requests    REG_SZ    0
    Replays    REG_SZ    0
    Responses    REG_SZ    2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers
    Stamp    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip
    ProtocolId    REG_DWORD    0x21
    GlobalInfo    REG_BINARY    0100000080000000020000000300FFFF0800000001000000300000000600FFFF3C0000000100000038000000000000000000000001000000070000000200000001000000030000000A0000001627000003000000172700000500000012270000070000000D0000006E0000000800000078000000000000000000000000000000
    DLLPath    REG_SZ    C:\WINNT\System32\iprtrmgr.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
    Description    REG_SZ    Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.
    DependOnService    REG_MULTI_SZ    RPCSS
    DisplayName    REG_SZ    Remote Registry
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k regsvc
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Group    REG_SZ    
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20
    FailureActions    REG_BINARY    00000000000000000000000001000000E0AD080001000000E8030000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\regsvc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Enum
    0    REG_SZ    Root\LEGACY_REMOTEREGISTRY\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RendezvousManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\rndzmgr.exe
    DisplayName    REG_SZ    WMS Rendezvous Manager
    ObjectName    REG_SZ    eur\ldngtssvcorb01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RendezvousManager\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RendezvousManager\Enum
    0    REG_SZ    Root\LEGACY_RENDEZVOUSMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RouteEngine
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\rtengine.exe
    DisplayName    REG_SZ    WMS Route Engine
    ObjectName    REG_SZ    eur\ldngtssvcorb01
    DependOnService    REG_MULTI_SZ    Wmi

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RouteEngine\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RouteEngine\Enum
    0    REG_SZ    Root\LEGACY_ROUTEENGINE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\locator.exe
    DisplayName    REG_SZ    Remote Procedure Call (RPC) Locator
    DependOnService    REG_MULTI_SZ    LanmanWorkstation
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Description    REG_SZ    Enables remote procedure call (RPC) clients using the RpcNs* family of APIs to locate RPC servers. If this service is stopped or disabled, RPC clients using RpcNs* APIs may be unable to locate servers or fail to start. RpcNs* APIs are not used internally in Windows.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator\Parameters
    ExpirationAge    REG_DWORD    0xe10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
    Description    REG_SZ    Serves as the endpoint mapper and COM Service Control Manager. If this service is stopped or disabled, programs using COM or Remote Procedure Call (RPC) services will not function properly.
    DisplayName    REG_SZ    Remote Procedure Call (RPC)
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    COM Infrastructure
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k rpcss
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x10
    FailureActions    REG_BINARY    00000000000000000000000001000000000000000200000060EA0000
    ServiceSidType    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\rpcss.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200780005000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000000018009D00000001020000000000052000000021020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum
    0    REG_SZ    Root\LEGACY_RPCSS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSoPProv
    Description    REG_SZ    Enables a user to connect to a remote computer, access the Windows Management Instrumentation database for that computer, and either verify the current Group Policy settings made for the computer or check settings before they are applied. If this service is stopped, remote verification will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Resultant Set of Policy Provider
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\RSoPProv.exe
    ObjectName    REG_SZ    LocalSystem
    DependOnService    REG_MULTI_SZ    RPCSS
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sacdrv
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sacsvr
    Description    REG_SZ    Allows administrators to remotely access a command prompt using Emergency Management Services.
    DisplayName    REG_SZ    Special Administration Console Helper
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sacsvr\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\sacsvr.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sacsvr\Enum
    0    REG_SZ    Root\LEGACY_SACSVR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs
    Description    REG_SZ    The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests.  Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly.  This service should not be disabled.
    DisplayName    REG_SZ    Security Accounts Manager
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\lsass.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20
    Group    REG_SZ    MS_WindowsLocalValidation
    DependOnService    REG_MULTI_SZ    RPCSS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200780005000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000000018009D00000001020000000000052000000021020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs\Enum
    0    REG_SZ    Root\LEGACY_SAMSS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\System32\SCardSvr.exe
    Description    REG_SZ    Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Smart Card
    DependOnService    REG_MULTI_SZ    PlugPlay
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Group    REG_SZ    SmartCardGroup

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001400FD01020001010000000000051300000000001800FF010F0001020000000000052000000020020000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000025020000000014009D010200010100000000000200000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
    AtTaskMaxHours    REG_DWORD    0x48
    Description    REG_SZ    Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Task Scheduler
    Group    REG_SZ    SchedulerGroup
    DependOnService    REG_MULTI_SZ    RpcSs
    ObjectName    REG_SZ    LocalSystem
    FailureActions    REG_BINARY    805101000000000000000000030000006100700001000000701700000100000060EA00000000000000000000
    NextAtJobId    REG_DWORD    0x3

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\schedsvc.dll
    ServiceMain    REG_SZ    SchedServiceMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule\Enum
    0    REG_SZ    Root\LEGACY_SCHEDULE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ScsiPort
    ImagePath    REG_SZ    C:\WINNT\system32\drivers\scsiport.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Secdrv
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\secdrv.sys
    DisplayName    REG_SZ    Secdrv
    Description    REG_SZ    SafeDisc driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Secdrv\Security
    Security    REG_BINARY    010014807800000084000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200480003000000000014009D01020001010000000000050400000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon
    Description    REG_SZ    Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Secondary Logon
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    Objectname    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\seclogon.dll
    ServiceMain    REG_SZ    SvcEntry_Seclogon

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon\Enum
    0    REG_SZ    Root\LEGACY_SECLOGON\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\secmgr.exe
    DisplayName    REG_SZ    WMS Security Manager
    ObjectName    REG_SZ    eur\ldngtssvcorb01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityManager\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityManager\Enum
    0    REG_SZ    Root\LEGACY_SECURITYMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS
    DependOnService    REG_MULTI_SZ    EventSystem
    Description    REG_SZ    Monitors system events and notifies subscribers to COM+ Event System of these events. If this service is stopped, COM+ Event System subscribers will not receive system event notifications. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    System Event Notification
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Group    REG_SZ    Network
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\sens.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS\Enum
    0    REG_SZ    Root\LEGACY_SENS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\serenum
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    Serenum Filter Driver
    ImagePath    REG_SZ    system32\DRIVERS\serenum.sys
    Group    REG_SZ    PNP Filter
    Tag    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\serenum\Enum
    0    REG_SZ    Root\*PNP0501\1_0_17_1_0_0
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    ACPI\PNP0501\0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serial
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Extended base
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1
    ForceFifoEnable    REG_DWORD    0x1
    RxFIFO    REG_DWORD    0x8
    TxFIFO    REG_DWORD    0xe
    PermitShare    REG_DWORD    0x0
    LogFifo    REG_DWORD    0x0
    DisplayName    REG_SZ    Serial port driver
    ImagePath    REG_SZ    system32\DRIVERS\serial.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serial\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serial\Enum
    0    REG_SZ    Root\*PNP0501\1_0_17_1_0_0
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    ACPI\PNP0501\0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sfloppy
    DependOnGroup    REG_MULTI_SZ    SCSI miniport
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Primary disk
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sfloppy\Enum
    Count    REG_DWORD    0x0
    NextInstance    REG_DWORD    0x0
    INITSTARTFAILED    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
    DependOnGroup    REG_MULTI_SZ    
    DependOnService    REG_MULTI_SZ    Netman\0WinMgmt
    Description    REG_SZ    Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
    DisplayName    REG_SZ    Windows Firewall/Internet Connection Sharing (ICS)
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch
    Epoch    REG_DWORD    0xdf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\ipnathlp.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
    EnableFirewall    REG_DWORD    0x0
    DoNotAllowExceptions    REG_DWORD    0x0
    DisableNotifications    REG_DWORD    0x0
    DisableUnicastResponsesToMulticastBroadcast    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
    C:\apps_srv\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe    REG_SZ    C:\apps_srv\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe:*:Enabled:lcfd
    C:\WINNT\system32\CPQMgmt\CqMgHost\cqmghost.exe    REG_SZ    C:\WINNT\system32\CPQMgmt\CqMgHost\cqmghost.exe:*:Enabled:HP Insight Foundation Agents
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe    REG_SZ    C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service
    C:\Program Files\Hewlett-Packard\Discovery Agent\bin32\discagnt.exe    REG_SZ    C:\Program Files\Hewlett-Packard\Discovery Agent\bin32\discagnt.exe:*:Enabled:HP Enterprise Discovery Agent

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
    3389:TCP    REG_SZ    3389:TCP:*:Enabled:@xpsp2res.dll,-22009

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    EnableFirewall    REG_DWORD    0x0
    DoNotAllowExceptions    REG_DWORD    0x0
    DisableNotifications    REG_DWORD    0x0
    DisableUnicastResponsesToMulticastBroadcast    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe    REG_SZ    C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service
    C:\WINNT\system32\CpqMgmt\cqmghost\cqmghost.exe    REG_SZ    C:\WINNT\system32\CpqMgmt\cqmghost\cqmghost.exe:*:Enabled:HP Insight Foundation Agents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
    3389:TCP    REG_SZ    3389:TCP:*:Enabled:@xpsp2res.dll,-22009

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup
    ServiceUpgrade    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate
    All    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum
    0    REG_SZ    Root\LEGACY_SHAREDACCESS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Shell Hardware Detection
    Group    REG_SZ    ShellSvcGroup
    DependOnService    REG_MULTI_SZ    RpcSs
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides notifications for AutoPlay hardware events.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\shsvcs.dll
    ServiceMain    REG_SZ    HardwareDetectionServiceMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection\Enum
    0    REG_SZ    Root\LEGACY_SHELLHWDETECTION\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\shstrc
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\shstrc.sys
    DisplayName    REG_SZ    shstrc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\shstrc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\shstrc\Enum
    0    REG_SZ    Root\LEGACY_SHSTRC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Simbad
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Filter
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\snmp.exe
    DisplayName    REG_SZ    SNMP Service
    DependOnService    REG_MULTI_SZ    EventLog
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables Simple Network Management Protocol (SNMP) requests to be processed by this computer. If this service is stopped, the computer will be unable to process SNMP requests. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters
    EnableAuthenticationTraps    REG_DWORD    0x0
    NameResolutionRetries    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents
    1    REG_SZ    SOFTWARE\Microsoft\LANManagerMIB2Agent\CurrentVersion
    2    REG_SZ    SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion
    3    REG_SZ    SOFTWARE\Microsoft\HostMIB\CurrentVersion
    4    REG_SZ    SOFTWARE\Microsoft\SNMPMIB\CurrentVersion
    5    REG_SZ    SOFTWARE\Microsoft\SNMP_EVENTS\CurrentVersion
    6    REG_SZ    SOFTWARE\Microsoft\IGMPMibAgent\CurrentVersion
    7    REG_SZ    SOFTWARE\Microsoft\IPMulticastMibAgent\CurrentVersion
    8    REG_SZ    SOFTWARE\Microsoft\RIPMibAgent\CurrentVersion
    9    REG_SZ    SOFTWARE\Microsoft\OSPFMibAgent\CurrentVersion
    10    REG_SZ    SOFTWARE\Microsoft\BOOTPMibAgent\CurrentVersion
    (Default)    REG_SZ    
    0    REG_SZ    Software\Microsoft\W3SVC\CurrentVersion
    MCVSSNMP    REG_SZ    SOFTWARE\McAfee\VSCore\MCVSSNMP
    CPQHOSTSNMP    REG_SZ    System\CurrentControlSet\Services\CqMgHost\CPQSNMP
    CPQMIB1K    REG_SZ    System\CurrentControlSet\Services\CqMgHost\Parameters\CPQMIB1K
    CPQNISNMP    REG_SZ    System\CurrentControlSet\Services\CpqNicMgmt\CPQNISNMP
    CPQNICS    REG_SZ    System\CurrentControlSet\Services\CpqNicMgmt\Parameters\NICMIB
    CPQSERVSNMP    REG_SZ    System\CurrentControlSet\Services\CqMgServ\CPQSNMP
    CPQSTORSNMP    REG_SZ    System\CurrentControlSet\Services\CqMgStor\CPQSNMP
    CPQISCSI    REG_SZ    System\CurrentControlSet\Services\CqMgStor\CPQISCSI

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\PermittedManagers
    1    REG_SZ    localhost
    2    REG_SZ    ukcteprsnt10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent
    sysContact    REG_SZ    
    sysLocation    REG_SZ    
    sysServices    REG_DWORD    0x4c

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration\fe03h20
    1    REG_SZ    localhost
    2    REG_SZ    ukcteprsnt10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities
    fe03h20    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\W3SVC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Enum
    0    REG_SZ    Root\LEGACY_SNMP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMPTRAP
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\snmptrap.exe
    DisplayName    REG_SZ    SNMP Trap Service
    DependOnService    REG_MULTI_SZ    EventLog
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Receives trap messages generated by local or remote Simple Network Management Protocol (SNMP) agents and forwards the messages to SNMP management programs running on this computer. If this service is stopped, SNMP-based programs on this computer will not receive SNMP trap messages. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMPTRAP\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SOE Wrap Send Service
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\system32\SndServ.exe
    DisplayName    REG_SZ    SOE Send Service
    ObjectName    REG_SZ    LocalSystem
    RunDpcAtStart    REG_SZ    no

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SOE Wrap Send Service\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SOE Wrap Send Service\Enum
    0    REG_SZ    Root\LEGACY_SOE_WRAP_SEND_SERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
    DependOnService    REG_MULTI_SZ    RPCSS
    Description    REG_SZ    Manages all local and network print queues and controls all printing jobs. If this service is stopped, printing on the local machine will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Print Spooler
    ErrorControl    REG_DWORD    0x1
    FailureActions    REG_BINARY    60540000000000000000000003000000E8470C000100000060EA00000100000060EA00000000000000000000
    Group    REG_SZ    SpoolerGroup
    ImagePath    REG_SZ    C:\WINNT\system32\spoolsv.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x110

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Performance
    Close    REG_SZ    PerfClose
    Collect    REG_SZ    PerfCollect
    Collect Timeout    REG_DWORD    0x7d0
    Library    REG_SZ    winspool.drv
    Object List    REG_SZ    1450
    Open    REG_SZ    PerfOpen
    Open Timeout    REG_DWORD    0xfa0
    WbemAdapFileSignature    REG_BINARY    9CF0558B41CAB02E7D6F81BC59CD21A7
    WbemAdapFileTime    REG_BINARY    0EDD2FBB5862C701
    WbemAdapFileSize    REG_DWORD    0x24c00
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Enum
    0    REG_SZ    Root\LEGACY_SPOOLER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQL-BackTrack Agent
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\BMC software\utilities\bin\btagent.exe"
    DisplayName    REG_SZ    SQL-BackTrack Agent
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQL-BackTrack Agent\Security
    Security    REG_BINARY    01001480300000003C000000140000000000000002001C000100000002801400FF010F00010100000000000100000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLBrowser
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
    DisplayName    REG_SZ    SQL Server Browser
    ObjectName    REG_SZ    eur\ldnwassvcsysadm01
    Description    REG_SZ    Provides SQL Server connection information to client computers.
    FailureActions    REG_BINARY    80510100000000000000000003000000610073000100000060EA00000100000060EA00000100000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLBrowser\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLBrowser\Enum
    0    REG_SZ    Root\LEGACY_SQLBROWSER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLSERVERAGENT
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\apps_srv\mssql\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE -i MSSQLSERVER
    DisplayName    REG_SZ    SQL Server Agent (MSSQLSERVER)
    DependOnService    REG_MULTI_SZ    MSSQLSERVER
    ObjectName    REG_SZ    eur\ldnwassvcsysadm01
    Description    REG_SZ    Executes jobs, monitors SQL Server, and fires alerts, and allows automation of some administrative tasks.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLSERVERAGENT\Linkage
    Export    REG_MULTI_SZ    MSSQLSERVER

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLSERVERAGENT\Performance
    Library    REG_SZ    SQLAGENTCTR90.DLL
    Open    REG_SZ    OpenSQLPerformanceData1
    Collect    REG_SZ    CollectSQLPerformanceData1
    Close    REG_SZ    CloseSQLPerformanceData1
    PerfIniFile    REG_SZ    perf-MSSQLSERVERsqlagtctr.ini
    Last Counter    REG_DWORD    0x254c
    Last Help    REG_DWORD    0x254d
    First Counter    REG_DWORD    0x252c
    First Help    REG_DWORD    0x252d

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLSERVERAGENT\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLSERVERAGENT\Enum
    0    REG_SZ    Root\LEGACY_SQLSERVERAGENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLWriter
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
    DisplayName    REG_SZ    SQL Server VSS Writer
    ObjectName    REG_SZ    eur\ldnwassvcsysadm01
    Description    REG_SZ    Provides the interface to backup/restore Microsoft SQL server through the Windows VSS infrastructure.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLWriter\Security
    Security    REG_BINARY    01001480000100000C010000140000003000000002001C000100000002801400FF010F000101000000000001000000000200D0000800000000042400FF010F00010500000000000515000000948BA859A7902635A89CBBAEFD0300000004240011000200010500000000000515000000948BA859A7902635A89CBBAEFA03000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLWriter\Enum
    0    REG_SZ    Root\LEGACY_SQLWRITER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Srv
    Type    REG_DWORD    0x2
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x6
    ImagePath    REG_SZ    system32\DRIVERS\srv.sys
    DisplayName    REG_SZ    Srv
    Group    REG_SZ    Network
    Description    REG_SZ    Srv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Srv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Srv\Enum
    0    REG_SZ    Root\LEGACY_SRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSH Certificate Daemon
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\SSH Communications Security\SSH Secure Shell Server\ssh_certd.exe"
    DisplayName    REG_SZ    SSH Certificate Daemon
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSH Certificate Daemon\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSH Certificate Daemon\Enum
    0    REG_SZ    Root\LEGACY_SSH_CERTIFICATE_DAEMON\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSHSecureShell2Server
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\apps_srv\SSH Communications Security\SSH Secure Shell Server\ssh2master.exe"
    DisplayName    REG_SZ    SSH Tectia Server
    DependOnService    REG_MULTI_SZ    SSH Certificate Daemon
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSHSecureShell2Server\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSHSecureShell2Server\Enum
    0    REG_SZ    Root\LEGACY_SSHSECURESHELL2SERVER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k imgsvc
    DisplayName    REG_SZ    Windows Image Acquisition (WIA)
    DependOnService    REG_MULTI_SZ    RpcSs\0ShellHWDetection
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Provides image acquisition services for scanners and cameras.
    ServiceSidType    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\wiaservc.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Software Bus Driver
    ImagePath    REG_SZ    system32\DRIVERS\swenum.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum\Devices

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum\Devices\{eeab7790-c514-11d1-b42b-00805fc1270e}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum\Devices\{eeab7790-c514-11d1-b42b-00805fc1270e}\asyncmac

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum\Devices\{eeab7790-c514-11d1-b42b-00805fc1270e}\asyncmac\{ad498944-762f-11d0-8dcb-00c04fc3358c}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum\Enum
    0    REG_SZ    Root\SYSTEM\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k swprv
    DisplayName    REG_SZ    Microsoft Software Shadow Copy Provider
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\swprv.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv\Enum
    0    REG_SZ    Root\LEGACY_SWPRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symc810
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x1a
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symc810\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symc810\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symc8xx
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1
    Tag    REG_DWORD    0x36

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symc8xx\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symc8xx\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symmpi
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symmpi\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symmpi\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sym_hi
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1
    Tag    REG_DWORD    0x37

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sym_hi\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sym_hi\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sym_u3
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x1
    Tag    REG_DWORD    0x37

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sym_u3\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sym_u3\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysdown
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\sysdown.exe
    DisplayName    REG_SZ    HP ProLiant System Shutdown Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Shuts down the system in the event of overheating or loss of cooling in response to commands from the HP ProLiant iLO 2 Management Controller driver.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysdown\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysdown\Enum
    0    REG_SZ    Root\LEGACY_SYSDOWN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysExec
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\system32\sysexec.exe
    DisplayName    REG_SZ    SOE Admin Service
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysExec\Parameters
    ServiceStartNum    REG_DWORD    0x18

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysExec\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysExec\Enum
    0    REG_SZ    Root\LEGACY_SYSEXEC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMgmtHp
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\hp\hpsmh\bin\smhstart.exe
    DisplayName    REG_SZ    HP System Management Homepage
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    The HP System Management Homepage allows an administrator to monitor the web-apps on the system.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMgmtHp\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMgmtHp\Enum
    0    REG_SZ    Root\LEGACY_SYSMGMTHP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog
    Description    REG_SZ    Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Performance Logs and Alerts
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\smlogsvc.exe
    ObjectName    REG_SZ    NT Authority\NetworkService
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x10
    FailureActions    REG_BINARY    80510100000000000000000003000000530065000100000060EA00000100000060EA00000000000060EA0000
    DefaultLogFileFolder    REG_SZ    C:\PerfLogs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries
    Defaults Installed    REG_DWORD    0x1
    Configuration    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries\{79483e19-8dd0-4001-b5ba-a45f611ce66c}
    Current State    REG_DWORD    0x0
    Log Type    REG_DWORD    0x0
    Collection Name    REG_SZ    System Overview
    Collection Name Indirect    REG_SZ    @C:\WINNT\system32\smlogcfg.dll,-731
    Counter List    REG_MULTI_SZ    \Processor(_Total)\% Processor Time\0\Memory\Pages/sec\0\PhysicalDisk(_Total)\Avg. Disk Queue Length
    Sample Interval    REG_BINARY    02000400030000000F00000001000000
    Comment    REG_SZ    This sample log provides an overview of system performance.
    Comment Indirect    REG_SZ    @C:\WINNT\system32\smlogcfg.dll,-735
    RealTime DataSource    REG_DWORD    0x1
    Log File Max Size    REG_DWORD    0xffffffff
    Data Store Attributes    REG_DWORD    0x21
    Log File Base Name    REG_SZ    System_Overview
    Log File Base Name Indirect    REG_SZ    @C:\WINNT\system32\smlogcfg.dll,-744
    Sql Log Base Name    REG_SZ    SQL:!System Overview
    Log File Serial Number    REG_DWORD    0x1
    Log File Folder    REG_SZ    C:\PerfLogs
    Log File Auto Format    REG_DWORD    0xffffffff
    Log File Type    REG_DWORD    0x2
    Start    REG_BINARY    0100010000000000FFFFFFFFFFFFFF7F
    Stop    REG_BINARY    01000200000000000000000000000000
    Restart    REG_BINARY    00000000
    Last Modified    REG_BINARY    010005000000000011FEAF498C12C901
    ExecuteOnly    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries\{e2f7aefa-0586-41a8-870f-9fb279d1a5c4}
    Current State    REG_DWORD    0x0
    Log Type    REG_DWORD    0x0
    Collection Name    REG_SZ    VR
    Counter List    REG_MULTI_SZ    \\UKEBUUASD99\.NET CLR Memory(*)\# of Pinned Objects\0\\UKEBUUASD99\.NET CLR Memory(*)\% Time in GC\0\\UKEBUUASD99\LogicalDisk(*)\% Idle Time\0\\UKEBUUASD99\LogicalDisk(*)\Current Disk Queue Length\0\\UKEBUUASD99\LogicalDisk(*)\Disk Reads/sec\0\\UKEBUUASD99\LogicalDisk(*)\Disk Transfers/sec\0\\UKEBUUASD99\LogicalDisk(*)\Disk Writes/sec\0\\UKEBUUASD99\LogicalDisk(*)\Free Megabytes\0\\UKEBUUASD99\Memory\Available Bytes\0\\UKEBUUASD99\Memory\Available MBytes\0\\UKEBUUASD99\Memory\Page Faults/sec\0\\UKEBUUASD99\Memory\Page Writes/sec\0\\UKEBUUASD99\Memory\Pages Input/sec\0\\UKEBUUASD99\Memory\Pages Output/sec\0\\UKEBUUASD99\Memory\Pages/sec\0\\UKEBUUASD99\Memory\Pool Paged Bytes\0\\UKEBUUASD99\Memory\System Code Resident Bytes\0\\UKEBUUASD99\Network Interface(*)\Bytes Total/sec\0\\UKEBUUASD99\Network Interface(*)\Current Bandwidth\0\\UKEBUUASD99\Network Interface(*)\Output Queue Length\0\\UKEBUUASD99\Objects\Processes\0\\UKEBUUASD99\Objects\Threads\0\\UKEBUUASD99\PhysicalDisk(*)\% Idle Time\0\\UKEBUUASD99\PhysicalDisk(*)\Avg. Disk Queue Length\0\\UKEBUUASD99\PhysicalDisk(*)\Current Disk Queue Length\0\\UKEBUUASD99\PhysicalDisk(*)\Disk Reads/sec\0\\UKEBUUASD99\PhysicalDisk(*)\Disk Transfers/sec\0\\UKEBUUASD99\PhysicalDisk(*)\Disk Writes/sec\0\\UKEBUUASD99\Process(*)\% Privileged Time\0\\UKEBUUASD99\Process(*)\% Processor Time\0\\UKEBUUASD99\Process(*)\% User Time\0\\UKEBUUASD99\Process(*)\Handle Count\0\\UKEBUUASD99\Process(*)\Working Set\0\\UKEBUUASD99\Processor(*)\% Interrupt Time\0\\UKEBUUASD99\Processor(*)\% Privileged Time\0\\UKEBUUASD99\Processor(*)\% Processor Time\0\\UKEBUUASD99\SQLServer:Access Methods\Forwarded Records/sec\0\\UKEBUUASD99\SQLServer:Access Methods\FreeSpace Scans/sec\0\\UKEBUUASD99\SQLServer:Access Methods\Full Scans/sec\0\\UKEBUUASD99\SQLServer:Access Methods\Index Searches/sec\0\\UKEBUUASD99\SQLServer:Access Methods\Scan Point Revalidations/sec\0\\UKEBUUASD99\SQLServer:Access Methods\Workfiles Created/sec\0\\UKEBUUASD99\SQLServer:Access Methods\Worktables Created/sec\0\\UKEBUUASD99\SQLServer:Buffer Manager\Buffer cache hit ratio\0\\UKEBUUASD99\SQLServer:Buffer Partition(*)\*\0\\UKEBUUASD99\SQLServer:Databases(*)\Active Transactions\0\\UKEBUUASD99\SQLServer:Databases(*)\Data File(s) Size (KB)\0\\UKEBUUASD99\SQLServer:Databases(*)\Log File(s) Size (KB)\0\\UKEBUUASD99\SQLServer:Databases(*)\Transactions/sec\0\\UKEBUUASD99\SQLServer:Latches\Latch Waits/sec\0\\UKEBUUASD99\SQLServer:Locks(*)\Lock Requests/sec\0\\UKEBUUASD99\SQLServer:Locks(*)\Lock Timeouts/sec\0\\UKEBUUASD99\SQLServer:Locks(*)\Lock Waits/sec\0\\UKEBUUASD99\SQLServer:Locks(*)\Number of Deadlocks/sec\0\\UKEBUUASD99\SQLServer:Memory Manager\Connection Memory (KB)\0\\UKEBUUASD99\SQLServer:Memory Manager\Memory Grants Pending\0\\UKEBUUASD99\SQLServer:Memory Manager\Target Server Memory (KB)\0\\UKEBUUASD99\SQLServer:Memory Manager\Total Server Memory (KB)\0\\UKEBUUASD99\SQLServer:SQL Statistics\Batch Requests/sec\0\\UKEBUUASD99\SQLServer:SQL Statistics\SQL Compilations/sec\0\\UKEBUUASD99\SQLServer:SQL Statistics\SQL Re-Compilations/sec\0\\UKEBUUASD99\System\Context Switches/sec\0\\UKEBUUASD99\System\Processor Queue Length\0\\UKEBUUASD99\System\System Up Time
    Sample Interval    REG_BINARY    02000400030000000F00000001000000
    Comment    REG_SZ    VR5957775
    RealTime DataSource    REG_DWORD    0x1
    Log File Max Size    REG_DWORD    0x19000
    Data Store Attributes    REG_DWORD    0x21
    Log File Base Name    REG_SZ    VR
    Sql Log Base Name    REG_SZ    SQL:!VR
    Log File Serial Number    REG_DWORD    0x3
    Log File Folder    REG_SZ    E:\data\data_srv\dbagroup\dbamaint\DBA_Working_Area\Perflogs\
    Log File Auto Format    REG_DWORD    0x1
    Log File Type    REG_DWORD    0x1
    Start    REG_BINARY    0100010000000000FFFFFFFFFFFFFF7F
    Stop    REG_BINARY    01000200000000000000000000000000
    Restart    REG_BINARY    00000000
    Last Modified    REG_BINARY    0100050000000000FC3CCD28A5FCCA01
    Current Log File Name    REG_SZ    E:\data\data_srv\dbagroup\dbamaint\DBA_Working_Area\Perflogs\VR_000002.tsv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Security
    Security    REG_BINARY    0100148094000000A0000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200640004000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD01020001010000000000051200000000001800950100000102000000000005200000002F020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Enum
    0    REG_SZ    Root\LEGACY_SYSMONLOG\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
    DependOnService    REG_MULTI_SZ    PlugPlay\0RpcSs
    Description    REG_SZ    Provides Telephony API (TAPI) support for clients using programs that control telephony devices and IP-based voice connections. If this service is stopped, the function of all dependent programs will be impaired. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Telephony
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k tapisrv
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\tapisrv.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv\Performance
    Close    REG_SZ    CloseTapiPerformanceData
    Collect    REG_SZ    CollectTapiPerformanceData
    Library    REG_SZ    tapiperf.dll
    ObjectList    REG_SZ    1150
    Open    REG_SZ    OpenTapiPerformanceData
    WbemAdapFileSignature    REG_BINARY    E1AB0CAC57CCEE9227875A13FB07D98A
    WbemAdapFileTime    REG_BINARY    A2E575BA5862C701
    WbemAdapFileSize    REG_DWORD    0x1800
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv\Security
    Security    REG_BINARY    010014806C000000780000001400000034000000020020000100000002801800FF010F0001010000000000010000000020020000020038000200000000031800FF010F0001020000000000052000000020020000000318009D00000001020000000000052000000021020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv\Enum
    0    REG_SZ    Root\LEGACY_TAPISRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x3
    ImagePath    REG_SZ    system32\DRIVERS\tcpip.sys
    DisplayName    REG_SZ    TCP/IP Protocol Driver
    Group    REG_SZ    PNP_TDI
    DependOnService    REG_MULTI_SZ    IPSec
    Description    REG_SZ    TCP/IP Protocol Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
    Bind    REG_MULTI_SZ    \Device\{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\NdisWanIp
    Route    REG_MULTI_SZ    "{1C720EB3-65F4-44B5-A616-874B801E4A74}"\0"NdisWanIp"
    Export    REG_MULTI_SZ    \Device\Tcpip_{1C720EB3-65F4-44B5-A616-874B801E4A74}\0\Device\Tcpip_{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0\Device\Tcpip_{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    EnableTCPA    REG_DWORD    0x0
    EnableRSS    REG_DWORD    0x0
    EnableTCPChimney    REG_DWORD    0x0
    NV Hostname    REG_SZ    ukebuuasd99
    DataBasePath    REG_SZ    C:\WINNT\System32\drivers\etc
    NameServer    REG_SZ    
    ForwardBroadcasts    REG_DWORD    0x0
    IPEnableRouter    REG_DWORD    0x0
    Domain    REG_SZ    eur.nsroot.net
    Hostname    REG_SZ    ukebuuasd99
    SearchList    REG_SZ    eur.nsroot.net,eu.ssmb.com,ny.ssmb.com,nj.ssmb.com,sbi.com
    UseDomainNameDevolution    REG_DWORD    0x1
    EnableICMPRedirect    REG_DWORD    0x1
    DeadGWDetectDefault    REG_DWORD    0x1
    DontAddDefaultGatewayDefault    REG_DWORD    0x0
    EnableSecurityFilters    REG_DWORD    0x0
    ReservedPorts    REG_MULTI_SZ    1433-1434\03343-3343
    NV Domain    REG_SZ    eur.nsroot.net
    TcpTimedWaitDelay    REG_DWORD    0x3c
    MaxUserPort    REG_DWORD    0x4e20
    CitrixBackupTcpWindowSize    REG_DWORD    0x0
    TcpWindowSize    REG_DWORD    0xfc00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\NdisWanIp
    LLInterface    REG_SZ    WANARP
    IpConfig    REG_MULTI_SZ    Tcpip\Parameters\Interfaces\{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}\0Tcpip\Parameters\Interfaces\{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}
    NumInterfaces    REG_DWORD    0x2
    IpInterfaces    REG_BINARY    D7AB6B64AC2FAC4C848EA6F6B81A92779BFE54DE6797A84AB6E09F98A5B1A62B

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    LLInterface    REG_SZ    
    IpConfig    REG_MULTI_SZ    Tcpip\Parameters\Interfaces\{1C720EB3-65F4-44B5-A616-874B801E4A74}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{DF7DB703-FE56-4F72-89FB-371431019CD1}
    LLInterface    REG_SZ    
    IpConfig    REG_MULTI_SZ    Tcpip\Parameters\Interfaces\{DF7DB703-FE56-4F72-89FB-371431019CD1}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{EE812484-03FC-4739-9BC2-B9D094470C3D}
    LLInterface    REG_SZ    
    IpConfig    REG_MULTI_SZ    Tcpip\Parameters\Interfaces\{EE812484-03FC-4739-9BC2-B9D094470C3D}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1C720EB3-65F4-44B5-A616-874B801E4A74}
    UseZeroBroadcast    REG_DWORD    0x0
    EnableDeadGWDetect    REG_DWORD    0x1
    EnableDHCP    REG_DWORD    0x0
    IPAddress    REG_MULTI_SZ    169.182.203.49
    SubnetMask    REG_MULTI_SZ    255.255.255.0
    DefaultGateway    REG_MULTI_SZ    169.182.203.1\0169.182.203.2
    DefaultGatewayMetric    REG_MULTI_SZ    1\02
    NameServer    REG_SZ    192.193.215.69,192.193.215.73,192.193.215.65
    Domain    REG_SZ    
    RegistrationEnabled    REG_DWORD    0x0
    RegisterAdapterName    REG_DWORD    0x0
    TCPAllowedPorts    REG_MULTI_SZ    0
    UDPAllowedPorts    REG_MULTI_SZ    0
    RawIPAllowedProtocols    REG_MULTI_SZ    0
    NTEContextList    REG_MULTI_SZ    0x00000002
    DhcpClassIdBin    REG_BINARY    
    DhcpServer    REG_SZ    255.255.255.255
    Lease    REG_DWORD    0xe10
    LeaseObtainedTime    REG_DWORD    0x45f118bf
    T1    REG_DWORD    0x45f11fc7
    T2    REG_DWORD    0x45f1250d
    LeaseTerminatesTime    REG_DWORD    0x45f126cf
    IPAutoconfigurationAddress    REG_SZ    0.0.0.0
    IPAutoconfigurationMask    REG_SZ    255.255.0.0
    IPAutoconfigurationSeed    REG_DWORD    0x0
    AddressType    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{646BABD7-2FAC-4CAC-848E-A6F6B81A9277}
    UseZeroBroadcast    REG_DWORD    0x0
    EnableDHCP    REG_DWORD    0x0
    IPAddress    REG_MULTI_SZ    0.0.0.0
    SubnetMask    REG_MULTI_SZ    0.0.0.0
    EnableDeadGWDetect    REG_DWORD    0x1
    DontAddDefaultGateway    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE54FE9B-9767-4AA8-B6E0-9F98A5B1A62B}
    UseZeroBroadcast    REG_DWORD    0x0
    EnableDHCP    REG_DWORD    0x0
    IPAddress    REG_MULTI_SZ    0.0.0.0
    SubnetMask    REG_MULTI_SZ    0.0.0.0
    EnableDeadGWDetect    REG_DWORD    0x1
    DontAddDefaultGateway    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DF7DB703-FE56-4F72-89FB-371431019CD1}
    UseZeroBroadcast    REG_DWORD    0x0
    EnableDeadGWDetect    REG_DWORD    0x1
    EnableDHCP    REG_DWORD    0x1
    IPAddress    REG_MULTI_SZ    0.0.0.0
    SubnetMask    REG_MULTI_SZ    0.0.0.0
    NameServer    REG_SZ    
    Domain    REG_SZ    
    RegistrationEnabled    REG_DWORD    0x1
    RegisterAdapterName    REG_DWORD    0x0
    TCPAllowedPorts    REG_MULTI_SZ    0
    UDPAllowedPorts    REG_MULTI_SZ    0
    RawIPAllowedProtocols    REG_MULTI_SZ    0
    DhcpClassIdBin    REG_BINARY    
    DhcpServer    REG_SZ    255.255.255.255
    Lease    REG_DWORD    0xe10
    LeaseObtainedTime    REG_DWORD    0x45f11882
    T1    REG_DWORD    0x45f11f8a
    T2    REG_DWORD    0x45f124d0
    LeaseTerminatesTime    REG_DWORD    0x45f12692
    IPAutoconfigurationAddress    REG_SZ    0.0.0.0
    IPAutoconfigurationMask    REG_SZ    255.255.0.0
    IPAutoconfigurationSeed    REG_DWORD    0x0
    AddressType    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{EE812484-03FC-4739-9BC2-B9D094470C3D}
    UseZeroBroadcast    REG_DWORD    0x0
    EnableDeadGWDetect    REG_DWORD    0x1
    EnableDHCP    REG_DWORD    0x0
    IPAddress    REG_MULTI_SZ    169.182.203.49
    SubnetMask    REG_MULTI_SZ    255.255.255.0
    DefaultGateway    REG_MULTI_SZ    169.182.203.1\0169.182.203.2
    DefaultGatewayMetric    REG_MULTI_SZ    1\02
    NameServer    REG_SZ    192.193.215.69,192.193.215.73,192.193.215.65
    Domain    REG_SZ    
    RegistrationEnabled    REG_DWORD    0x0
    RegisterAdapterName    REG_DWORD    0x0
    TCPAllowedPorts    REG_MULTI_SZ    0
    UDPAllowedPorts    REG_MULTI_SZ    0
    RawIPAllowedProtocols    REG_MULTI_SZ    0
    DhcpClassIdBin    REG_BINARY    
    DhcpServer    REG_SZ    255.255.255.255
    Lease    REG_DWORD    0xe10
    LeaseObtainedTime    REG_DWORD    0x45f11374
    T1    REG_DWORD    0x45f11a7c
    T2    REG_DWORD    0x45f11fc2
    LeaseTerminatesTime    REG_DWORD    0x45f12184
    IPAutoconfigurationAddress    REG_SZ    0.0.0.0
    IPAutoconfigurationMask    REG_SZ    255.255.0.0
    IPAutoconfigurationSeed    REG_DWORD    0x0
    AddressType    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Winsock
    UseDelayedAcceptance    REG_DWORD    0x0
    HelperDllName    REG_SZ    C:\WINNT\System32\wshtcpip.dll
    MaxSockAddrLength    REG_DWORD    0x10
    MinSockAddrLength    REG_DWORD    0x10
    Mapping    REG_BINARY    0B00000003000000020000000100000006000000020000000100000000000000020000000000000006000000000000000000000006000000000000000100000006000000020000000200000011000000020000000200000000000000020000000000000011000000000000000000000011000000000000000200000011000000020000000300000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Performance
    Close    REG_SZ    CloseTcpIpPerformanceData
    Collect    REG_SZ    CollectTcpIpPerformanceData
    Library    REG_SZ    Perfctrs.dll
    Open    REG_SZ    OpenTcpIpPerformanceData
    Object List    REG_SZ    502 510 546 548 582 638 658 1530 1532 1534
    WbemAdapFileSignature    REG_BINARY    417D105CFABA20615FABA58BFBA55898
    WbemAdapFileTime    REG_BINARY    8E1966B95862C701
    WbemAdapFileSize    REG_DWORD    0xb200
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider
    Class    REG_DWORD    0x8
    DnsPriority    REG_DWORD    0x7d0
    HostsPriority    REG_DWORD    0x1f4
    LocalPriority    REG_DWORD    0x1f3
    ProviderPath    REG_SZ    C:\WINNT\System32\wsock32.dll
    NetbtPriority    REG_DWORD    0x7d1
    Name    REG_SZ    TCP/IP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Enum
    0    REG_SZ    Root\LEGACY_TCPIP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDPIPE
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDPIPE\Enum
    0    REG_SZ    Root\LEGACY_TDPIPE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDTCP
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDTCP\Enum
    0    REG_SZ    Root\LEGACY_TDTCP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD
    Start    REG_DWORD    0x1
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\termdd.sys
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Terminal Device Driver
    PortDriverEnable    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD\Enum
    0    REG_SZ    Root\RDP_KBD\0000
    Count    REG_DWORD    0x2
    NextInstance    REG_DWORD    0x2
    1    REG_SZ    Root\RDP_MOU\0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Allows users to connect interactively to a remote computer. Remote Desktop, Fast User Switching, Remote Assistance, and Terminal Server depend on this service - stopping or disabling this service may make your computer unreliable.  To prevent remote use of this computer, clear the checkboxes on the Remote tab of the System properties control panel item.
    DisplayName    REG_SZ    Terminal Services
    DependOnService    REG_MULTI_SZ    RPCSS
    Type    REG_DWORD    0x20
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k termsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\termsrv.dll
    Certificate    REG_BINARY    01000000010000000100000006005C005253413148000000000200003F00000001000100E321C8A1E1F56631D8C7F6B8623FD3FDF6C7AE527116CCB71784B9E923BD5DEF14E2678A72685CEBC0B67A36F24A675242213373166885A6EC89F9F6844E6BCD0000000000000000080048003177BB31AC2616117A671E20497DF2917354AB8151C2E05E18D9665B4D63207ED1C5E978096272826CF0BE3F44F627EEB5F005ADAA703E53FBE6D05EA499713E0000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Performance
    Close    REG_SZ    CloseTSObject
    Collect Timeout    REG_DWORD    0x3e8
    Collect    REG_SZ    CollectTSObjectData
    Open Timeout    REG_DWORD    0x3e8
    Open    REG_SZ    OpenTSObject
    Library    REG_SZ    perfts.dll
    PerfIniFile    REG_SZ    tslabels.ini
    Last Counter    REG_DWORD    0x83c
    Last Help    REG_DWORD    0x83d
    First Counter    REG_DWORD    0x7bc
    First Help    REG_DWORD    0x7bd
    Object List    REG_SZ    1980 2102
    Library Validation Code    REG_BINARY    0089F7B95862C7010038000000000000
    WbemAdapFileSignature    REG_BINARY    F48CA6D4DB3878CDFD166F8DFD4F8F2C
    WbemAdapFileTime    REG_BINARY    42DE6AB95862C701
    WbemAdapFileSize    REG_DWORD    0x3800
    WbemAdapStatus    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Enum
    0    REG_SZ    Root\LEGACY_TERMSERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Themes
    Group    REG_SZ    UIGroup
    ObjectName    REG_SZ    LocalSystem
    FailureActions    REG_BINARY    80510100000000000000000003000000010100000100000060EA00000100000060EA00000000000000000000
    Description    REG_SZ    Provides user experience theme management.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\shsvcs.dll
    ServiceMain    REG_SZ    ThemeServiceMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\tlntsvr.exe
    DisplayName    REG_SZ    Telnet
    DependOnService    REG_MULTI_SZ    RPCSS\0TCPIP\0NTLMSSP
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TosIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransferManager
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    D:\eistream\Server\BIN\transfer.exe
    DisplayName    REG_SZ    WMS Transfer Manager
    ObjectName    REG_SZ    eur\ldngtssvcorb01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransferManager\Security
    Security    REG_BINARY    01001480DC000000E8000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200AC000700000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD0102000102000000000005200000002302000000002400740000000105000000000005150000005729024C507B9E5F07E53B2BE7D30200010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransferManager\Enum
    0    REG_SZ    Root\LEGACY_TRANSFERMANAGER\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkSvr
    Description    REG_SZ    Enables the Distributed Link Tracking Client service within the same domain to provide more reliable and efficient maintenance of links within the domain. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Distributed Link Tracking Server
    DependOnService    REG_MULTI_SZ    RpcSs
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20
    Group    REG_SZ    

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkSvr\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\trksvr.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
    Description    REG_SZ    Enables client programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. If this service is stopped, the links on this computer will not be maintained or tracked. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Distributed Link Tracking Client
    DependOnService    REG_MULTI_SZ    RpcSs
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\trkwks.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Enum
    0    REG_SZ    Root\LEGACY_TRKWKS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TSDDD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TSDDD\Device0
    InstalledDisplayDrivers    REG_MULTI_SZ    TSDDD
    VgaCompatible    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tssdis
    ErrorControl    REG_DWORD    0x1
    Type    REG_DWORD    0x10
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x4
    Description    REG_SZ    Enables a user connection request to be routed to the appropriate terminal server in a cluster. If this service is stopped, connection requests will be routed to the first available server.
    DisplayName    REG_SZ    Terminal Services Session Directory
    ImagePath    REG_SZ    C:\WINNT\System32\tssdis.exe
    DependOnService    REG_MULTI_SZ    RPCSS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Udfs
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    File system
    Start    REG_DWORD    0x4
    Type    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ultra
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    SCSI miniport
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x3b
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ultra\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ultra\Parameters\PnpInterface
    5    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UMWdf
    Description    REG_SZ    Enables Windows user mode drivers.
    DisplayName    REG_SZ    Windows User Mode Driver Framework
    DependOnService    REG_MULTI_SZ    RpcSs
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\wdfmgr.exe
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Microcode Update Driver
    ImagePath    REG_SZ    system32\DRIVERS\update.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update\Devices

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update\Enum
    0    REG_SZ    Root\SYSTEM\0001
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS
    Description    REG_SZ    Manages an uninterruptible power supply (UPS) connected to the computer.
    DisplayName    REG_SZ    Uninterruptible Power Supply
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\ups.exe
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbccgp
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    Microsoft USB Generic Parent Driver
    ImagePath    REG_SZ    system32\DRIVERS\usbccgp.sys
    Group    REG_SZ    Base
    Tag    REG_DWORD    0x14

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbccgp\Enum
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1
    0    REG_SZ    USB\Vid_03f0&Pid_1027\6&5f1b1e&0&1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbehci
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    Microsoft USB 2.0 Enhanced Host Controller Miniport Driver
    ImagePath    REG_SZ    system32\DRIVERS\usbehci.sys
    Group    REG_SZ    Base
    Tag    REG_DWORD    0xf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbehci\Enum
    0    REG_SZ    PCI\VEN_10DE&DEV_005B&SUBSYS_31F8103C&REV_A4\3&20fea912&0&11
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    Microsoft USB Standard Hub Driver
    ImagePath    REG_SZ    system32\DRIVERS\usbhub.sys
    Group    REG_SZ    Base
    Tag    REG_DWORD    0x12

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub\Enum
    0    REG_SZ    USB\ROOT_HUB\4&1efc638d&0
    Count    REG_DWORD    0x4
    NextInstance    REG_DWORD    0x4
    1    REG_SZ    USB\ROOT_HUB\5&246eae08&0
    2    REG_SZ    USB\ROOT_HUB20\4&26db321c&0
    3    REG_SZ    USB\Vid_04b4&Pid_6560\5&2941608a&0&6

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    Microsoft USB Open Host Controller Miniport Driver
    ImagePath    REG_SZ    system32\DRIVERS\usbohci.sys
    Group    REG_SZ    Base
    Tag    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci\Enum
    0    REG_SZ    PCI\VEN_10DE&DEV_005A&SUBSYS_31F8103C&REV_A2\3&20fea912&0&10
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbstor
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    USB Mass Storage Driver
    ImagePath    REG_SZ    system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbuhci
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    DisplayName    REG_SZ    Microsoft USB Universal Host Controller Miniport Driver
    ImagePath    REG_SZ    system32\DRIVERS\usbuhci.sys
    Group    REG_SZ    Base
    Tag    REG_DWORD    0x11

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbuhci\Enum
    0    REG_SZ    PCI\VEN_103C&DEV_3300&SUBSYS_3305103C&REV_00\4&21887ae&0&2448
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds
    DependOnService    REG_MULTI_SZ    RpcSs\0PlugPlay
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\vds.exe
    DisplayName    REG_SZ    Virtual Disk Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides software volume and hardware volume management service.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020078000500000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D01020001010000000000050B00000000001800FD01020001020000000000052000000023020000000018007000000001020000000000052000000027020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds\SoftwareProviders

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds\SoftwareProviders\{CA7DE14F-5BC8-48fd-93DE-A19527B0459E}
    (Default)    REG_SZ    Microsoft Virtual Disk Service Basic Provider
    Clsid    REG_SZ    {DE010DA1-289B-4232-8CD0-5112DCA6A7B3}
    Version    REG_SZ    1.1.0.1
    VersionId    REG_SZ    {21CBA22B-9418-43c7-8B77-80F0B410D503}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds\SoftwareProviders\{CF885AA5-A305-4D1F-B2A1-FCFF4701DD28}
    Clsid    REG_SZ    {0971BD76-95DD-4212-89FB-A0BD750BA5C2}
    (Default)    REG_SZ    VERITAS Virtual Disk Service Dynamic Provider
    Version    REG_SZ    1.1
    VersionId    REG_SZ    {FF6E9D48-7200-4D22-9945-E8DCF33C2080}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds\Enum
    0    REG_SZ    Root\LEGACY_VDS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Veritas Scheduler Service
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Veritas\Veritas Volume Manager 5.1\VxSchedService.exe"
    DisplayName    REG_SZ    Veritas Scheduler Service
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Veritas Scheduler Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Veritas Scheduler Service\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Veritas Scheduler Service\Enum
    0    REG_SZ    Root\LEGACY_VERITAS_SCHEDULER_SERVICE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vga
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x0
    Tag    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\vgapnp.sys
    Group    REG_SZ    Video

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vga\Device0
    InstalledDisplayDrivers    REG_MULTI_SZ    vga\0framebuf\0vga256\0vga64k
    VgaCompatible    REG_DWORD    0x1
    Acceleration.Level    REG_DWORD    0x5
    Device Description    REG_SZ    Standard VGA Graphics Adapter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vga\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vga\Video
    Service    REG_SZ    vga

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VgaSave
    Description    REG_SZ    Controls the VGA display adapter to provide basic display capabilities.
    DisplayName    REG_SZ    VGA Display Controller.
    ErrorControl    REG_DWORD    0x0
    Group    REG_SZ    Video Save
    ImagePath    REG_SZ    \SystemRoot\System32\drivers\vga.sys
    Start    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VgaSave\Device0
    InstalledDisplayDrivers    REG_MULTI_SZ    vga\0framebuf\0vga256\0vga64k
    VgaCompatible    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VgaSave\Video
    VideoID    REG_SZ    {23A77BF7-ED96-40EC-AF06-9B1F4867732A}
    Service    REG_SZ    VgaSave

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VgaSave\Enum
    0    REG_SZ    Root\LEGACY_VGASAVE\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ViaIde
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x4
    Tag    REG_DWORD    0x4
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    System Bus Extender
    Start    REG_DWORD    0x0
    Type    REG_DWORD    0x1
    DisplayName    REG_SZ    Storage volumes
    ImagePath    REG_SZ    system32\DRIVERS\volsnap.sys
    Tag    REG_DWORD    0x2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap\Enum
    0    REG_SZ    Root\LEGACY_VOLSNAP\0000
    Count    REG_DWORD    0x4
    NextInstance    REG_DWORD    0x4
    1    REG_SZ    STORAGE\Volume\1&30a96598&0&Signature5ECE94BEOffset4000Length222C314000
    2    REG_SZ    STORAGE\Volume\1&30a96598&0&Signature6BB04372Offset7E00Length222C48EA00
    3    REG_SZ    STORAGE\Volume\VXVM#{d1591b61-d6ad-4f76-ac6c-e1c62815a05e}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VRTSpbx
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\WINNT\system32\cmd.exe" /D /S /Q /C""C:\Program Files\Veritas\VxPBX\bin\pbxservice.cmd" "C:\Program Files\Veritas\VxPBX\bin\pbx_exchange.exe""
    DisplayName    REG_SZ    Symantec Private Branch Exchange
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Symantec Private Branch Exchange provides single-port access to clients outside the firewall connecting to various services offered by Symantec products.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VRTSpbx\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VRTSpbx\Enum
    0    REG_SZ    Root\LEGACY_VRTSPBX\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS
    DependOnService    REG_MULTI_SZ    RPCSS
    Description    REG_SZ    Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Volume Shadow Copy
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\vssvc.exe
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}
    (Default)    REG_SZ    Microsoft Software Shadow Copy provider 1.0
    Type    REG_DWORD    0x1
    Version    REG_SZ    1.0.0.7
    VersionId    REG_SZ    {00000001-0000-0000-0007-000000000001}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}\CLSID
    (Default)    REG_SZ    {65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
    PagePoolTrimmingLevel    REG_DWORD    0x1
    TornComponentsBlockRevert    REG_DWORD    0x1
    MSDEVersionChecking    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings\WritersBlockingRevert
    {2707761B-2324-473D-88EB-EB007A359533}    REG_SZ    FRS2 Writer
    {D76F5A28-3092-4589-BA48-2958FB88CE29}    REG_SZ    FRS Writer
    {B2014C9E-8711-4C5C-A5A9-3CF384484757}    REG_SZ    AD Writer
    {DD846AAA-A1B6-42a8-AAF8-03DCB6114BFD}    REG_SZ    ADAM Writer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Enum
    0    REG_SZ    Root\LEGACY_VSS\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxboot
    ErrorControl    REG_DWORD    0x1
    Group    REG_SZ    Filter
    ImagePath    REG_SZ    System32\drivers\vxboot.sys
    Start    REG_DWORD    0x0
    Tag    REG_DWORD    0xb
    Type    REG_DWORD    0x1
    VolumeRecoveryNeeded    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxboot\Enum
    0    REG_SZ    Root\LEGACY_VXBOOT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxcache
    Type    REG_DWORD    0x1
    ImagePath    REG_SZ    System32\drivers\vxcache.sys
    Tag    REG_DWORD    0xa
    Start    REG_DWORD    0x0
    Group    REG_SZ    System Bus Extender
    ErrorControl    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxcache\Enum
    0    REG_SZ    Root\LEGACY_VXCACHE\0000
    Count    REG_DWORD    0x4
    NextInstance    REG_DWORD    0x4
    1    REG_SZ    STORAGE\Volume\1&30a96598&0&Signature5ECE94BEOffset4000Length222C314000
    2    REG_SZ    STORAGE\Volume\1&30a96598&0&Signature6BB04372Offset7E00Length222C48EA00
    3    REG_SZ    STORAGE\Volume\VXVM#{d1591b61-d6ad-4f76-ac6c-e1c62815a05e}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VxDgDI
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Veritas\Veritas Volume Manager 5.1\LateStartSvc.exe"
    DisplayName    REG_SZ    Veritas DG Delayed Import Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Veritas DG Delayed Import Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VxDgDI\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxgn
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Veritas\VRTSobc\pal33\bin\vxpal.exe" -a gridnode
    DisplayName    REG_SZ    Veritas GridNode
    DependOnService    REG_MULTI_SZ    VRTSpbx
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides Veritas Enterprise GridNode Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxgn\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxgn\Enum
    0    REG_SZ    Root\LEGACY_VXGN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x8
    ImagePath    REG_SZ    system32\DRIVERS\vxio.sys
    DisplayName    REG_SZ    Veritas Storage Foundation 5.1 for Windows Driver
    Group    REG_SZ    System Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Boot Info
    Boot ID    REG_SZ    35ce3042-ce12-11db-96c1-806e6f6e6963

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Boot Info\Disk Group 1
    Name    REG_SZ    ukebuuasd99dg0
    ID    REG_SZ    5486f4ec-3dd4-48ed-8a28-a4531a5a7030
    DiskSetID    REG_SZ    25f34d2d-d82e-4fb4-8f90-ee2756ee6114

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Late Start
    Rescan    REG_DWORD    0x0
    Timeout    REG_DWORD    0x384

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Performance
    PerfIniFile    REG_SZ    vmperf.ini
    Close    REG_SZ    CloseVmStatObject
    Collect    REG_SZ    CollectVmStatObjectData
    Library    REG_SZ    C:\Program Files\Veritas\Veritas Volume Manager 5.1\providers\vmperf.dll
    Open    REG_SZ    OpenVmStatObject
    Last Counter    REG_DWORD    0x1b2e
    Last Help    REG_DWORD    0x1b2f
    First Counter    REG_DWORD    0x1b12
    First Help    REG_DWORD    0x1b13
    1008    REG_NONE    DE0C85C18D0FCB01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Tunable
    MAX_MEMORY    REG_SZ    32768

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\VOLGUIDS
    VolGUIDAvailCnt    REG_DWORD    0x1
    VolGUIDMisses    REG_DWORD    0x0
    VolGUIDHits    REG_DWORD    0x0
    1    REG_BINARY    5317D8D25E6CE64DA9F3349FEBCDBD27

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxio\Enum
    0    REG_SZ    Root\VXIO\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxob
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    "C:\Program Files\Veritas\Veritas Object Bus\Bin\vxsvc.exe"
    DisplayName    REG_SZ    Veritas Enterprise Administrator Service
    DependOnService    REG_MULTI_SZ    VRTSpbx
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Veritas Enterprise Administrator Service
    FailureActions    REG_BINARY    00000000000000000000000001000000000000000100000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxob\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxob\Enum
    0    REG_SZ    Root\LEGACY_VXOB\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxvm
    FailureActions    REG_BINARY    000000000000000000000000010000002D0058000100000060EA0000
    Description    REG_SZ    Veritas Storage Agent
    ErrorControl    REG_DWORD    0x1
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x2
    ImagePath    REG_SZ    "C:\Program Files\Veritas\VRTSobc\pal33\bin\vxpal.exe" -a StorageAgent
    DisplayName    REG_SZ    Veritas Storage Agent
    ObjectName    REG_SZ    LocalSystem
    DependOnService    REG_MULTI_SZ    VRTSpbx
    Tag    REG_DWORD    0x88

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vxvm\Enum
    0    REG_SZ    Root\LEGACY_VXVM\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time
    Description    REG_SZ    Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.


    DisplayName    REG_SZ    Windows Time
    ErrorControl    REG_DWORD    0x1
    FailureActions    REG_BINARY    05000000000000000000000002000000640020000100000060EA00000100000060EA0000
    Group    REG_SZ    
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k LocalService
    Objectname    REG_SZ    NT AUTHORITY\LocalService
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
    LastClockRate    REG_DWORD    0x26255
    MinClockRate    REG_DWORD    0x260d4
    MaxClockRate    REG_DWORD    0x263e0
    FrequencyCorrectRate    REG_DWORD    0x4
    PollAdjustFactor    REG_DWORD    0x5
    LargePhaseOffset    REG_DWORD    0x2faf080
    SpikeWatchPeriod    REG_DWORD    0x384
    HoldPeriod    REG_DWORD    0x5
    LocalClockDispersion    REG_DWORD    0xa
    EventLogFlags    REG_DWORD    0x2
    PhaseCorrectRate    REG_DWORD    0x1
    MinPollInterval    REG_DWORD    0xa
    MaxPollInterval    REG_DWORD    0xf
    UpdateInterval    REG_DWORD    0x7530
    MaxNegPhaseCorrection    REG_DWORD    0xffffffff
    MaxPosPhaseCorrection    REG_DWORD    0xffffffff
    AnnounceFlags    REG_DWORD    0xa
    MaxAllowedPhaseOffset    REG_DWORD    0x12c

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
    ServiceMain    REG_SZ    SvchostEntry_W32Time
    ServiceDll    REG_SZ    C:\WINNT\system32\w32time.dll
    Type    REG_SZ    NT5DS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Security
    Security    REG_BINARY    01001480A8000000B4000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200780005000000000014008D00020001010000000000050B00000000001800FF010F0001020000000000052000000020020000000018008D00020001020000000000052000000023020000000014009D000000010100000000000504000000000018009D00000001020000000000052000000021020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
    Enabled    REG_DWORD    0x1
    InputProvider    REG_DWORD    0x1
    AllowNonstandardModeCombinations    REG_DWORD    0x1
    CrossSiteSyncFlags    REG_DWORD    0x2
    ResolvePeerBackoffMinutes    REG_DWORD    0xf
    ResolvePeerBackoffMaxTimes    REG_DWORD    0x7
    CompatibilityFlags    REG_DWORD    0x80000000
    EventLogFlags    REG_DWORD    0x1
    LargeSampleSkew    REG_DWORD    0x3
    DllName    REG_SZ    C:\WINNT\system32\w32time.dll
    SpecialPollInterval    REG_DWORD    0xe10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
    InputProvider    REG_DWORD    0x0
    AllowNonstandardModeCombinations    REG_DWORD    0x1
    DllName    REG_SZ    C:\WINNT\system32\w32time.dll
    Enabled    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Enum
    0    REG_SZ    Root\LEGACY_W32TIME\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k iissvcs
    DisplayName    REG_SZ    World Wide Web Publishing Service
    DependOnService    REG_MULTI_SZ    RPCSS\0HTTPFilter\0IISADMIN
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides Web connectivity and administration through the Internet Information Services Manager
    FailureActions    REG_BINARY    8051010001000000000000000300000053006500010000000100000001000000010000000100000001000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
    MajorVersion    REG_DWORD    0x6
    MinorVersion    REG_DWORD    0x0
    InstallPath    REG_SZ    C:\WINNT\system32\inetsrv
    AccessDeniedMessage    REG_SZ    Error: Access is Denied.
    ServiceDll    REG_SZ    C:\WINNT\system32\inetsrv\iisw3adm.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Performance
    Library    REG_SZ    C:\WINNT\system32\inetsrv\w3ctrs.dll
    Open    REG_SZ    OpenW3PerformanceData
    Close    REG_SZ    CloseW3PerformanceData
    Collect    REG_SZ    CollectW3PerformanceData
    PerfIniFile    REG_SZ    w3ctrs.ini
    Last Counter    REG_DWORD    0xa9e
    Last Help    REG_DWORD    0xa9f
    First Counter    REG_DWORD    0x9a8
    First Help    REG_DWORD    0x9a9
    Object List    REG_SZ    2472 2646
    Library Validation Code    REG_BINARY    0002D51634A5C801005E000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Enum
    0    REG_SZ    Root\LEGACY_W3SVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wanarp
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\wanarp.sys
    DisplayName    REG_SZ    Remote Access IP ARP Driver
    Description    REG_SZ    Remote Access IP ARP Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wanarp\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wanarp\Enum
    0    REG_SZ    Root\LEGACY_WANARP\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x0
    ErrorControl    REG_DWORD    0x1
    Tag    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\Wdf01000.sys
    DisplayName    REG_SZ    Wdf01000
    Group    REG_SZ    WdfLoadGroup

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000\Enum
    0    REG_SZ    Root\LEGACY_WDF01000\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000\Parameters
    MajorVersion    REG_DWORD    0x1
    MinorVersion    REG_DWORD    0x7
    BuildNumber    REG_DWORD    0x1771

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDICA
    ErrorControl    REG_DWORD    0x0
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k LocalService
    DisplayName    REG_SZ    WebClient
    Group    REG_SZ    NetworkProvider
    DependOnService    REG_MULTI_SZ    MRxDAV
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Description    REG_SZ    Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.
    ServiceSidType    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
    Name    REG_SZ    Web Client Network
    ProviderPath    REG_SZ    C:\WINNT\System32\davclnt.dll
    DeviceName    REG_SZ    \Device\WebDavRedirector

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\webclnt.dll
    ServerNotFoundCacheLifeTimeInSec    REG_DWORD    0x3c
    AcceptOfficeAndTahoeServers    REG_DWORD    0x0
    SupportLocking    REG_DWORD    0x1
    ServiceDebug    REG_DWORD    0x0
    FileSizeLimitInBytes    REG_DWORD    0x2faf080
    FileAttributesLimitInBytes    REG_DWORD    0xf4240
    ClientDebug    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Enum
    0    REG_SZ    Root\LEGACY_WEBCLIENT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
    Description    REG_SZ    Implements the Web Proxy Auto-Discovery (WPAD) protocol for Windows HTTP Services (WinHTTP). WPAD is a protocol to enable an HTTP client to automatically discover a proxy configuration. If this service is stopped or disabled, the WPAD protocol will be executed within the HTTP client's process instead of an external service process; there would be no loss of functionality as a result.
    DependOnService    REG_MULTI_SZ    Dhcp
    DisplayName    REG_SZ    WinHTTP Web Proxy Auto-Discovery Service
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k LocalService
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20
    FailureActions    REG_BINARY    005C2605000000000000000001000000570044000100000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Parameters
    ServiceDll    REG_SZ    winhttp.dll
    ServiceManifest    REG_SZ    C:\WINNT\System32\whttpsvc.man
    ServiceMain    REG_SZ    WinHttpAutoProxySvcMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Enum
    0    REG_SZ    Root\LEGACY_WINHTTPAUTOPROXYSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x0
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Windows Management Instrumentation
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    FailureActions    REG_BINARY    80510100000000000000000002000000610073000100000060EA00000100000060EA0000
    Description    REG_SZ    Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\wbem\WMIsvc.dll
    ServiceMain    REG_SZ    ServiceMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt\Enum
    0    REG_SZ    Root\LEGACY_WINMGMT\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Parameters
    Transports    REG_MULTI_SZ    Tcpip\0NetBIOS\0Gpc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration
    Setup Version    REG_DWORD    0x1009
    Provider List    REG_MULTI_SZ    Tcpip\0NetBIOS\0Gpc
    Known Static Providers    REG_MULTI_SZ    Tcpip\0NwlnkIpx\0NwlnkSpx\0AppleTalk\0IsoTp\0Gpc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers\Gpc
    WinSock 2.0 Provider ID    REG_BINARY    E0A9609D7A33D011BD880000C082E69A

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers\NetBIOS
    WinSock 1.1 Provider Data    REG_BINARY    0E10000011000000140000001400000005000000FCFFFFFF00FA00003E0400000912000011000000140000001400000002000000FCFFFFFF00FA0000C40300000E10000011000000140000001400000005000000FBFFFFFF00FA00004E0300000912000011000000140000001400000002000000FBFFFFFF00FA0000D80200000E10000011000000140000001400000005000000FEFFFFFF00FA0000620200000912000011000000140000001400000002000000FEFFFFFF00FA0000EC0100000E10000011000000140000001400000005000000FDFFFFFF00FA0000760100000912000011000000140000001400000002000000FDFFFFFF00FA0000000100005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00440045003500340046004500390042002D0039003700360037002D0034004100410038002D0042003600450030002D003900460039003800410035004200310041003600320042007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00440045003500340046004500390042002D0039003700360037002D0034004100410038002D0042003600450030002D003900460039003800410035004200310041003600320042007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360034003600420041004200440037002D0032004600410043002D0034004300410043002D0038003400380045002D004100360046003600420038003100410039003200370037007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360034003600420041004200440037002D0032004600410043002D0034004300410043002D0038003400380045002D004100360046003600420038003100410039003200370037007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D0000005C004400650076006900630065005C004E0065007400420054005F004300500051005400650061006D005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D0000005C004400650076006900630065005C004E0065007400420054005F004300500051005400650061006D005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D000000
    WinSock 2.0 Provider ID    REG_BINARY    30185F8D73C2CF1195C800805F48A192

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers\Tcpip
    WinSock 2.0 Provider ID    REG_BINARY    A01A0FE78BABCF118CA300805F48A192

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Well Known Guids
    IsoTp    REG_BINARY    B0CBE489C1B9CF1195C800805F48A192
    McsXns    REG_BINARY    B1CBE489C1B9CF1195C800805F48A192
    AppleTalk    REG_BINARY    A0173B2CDFC6CF1195C800805F48A192

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters
    WinSock_Registry_Version    REG_SZ    2.0
    Current_NameSpace_Catalog    REG_SZ    NameSpace_Catalog5
    Current_Protocol_Catalog    REG_SZ    Protocol_Catalog9

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5
    Num_Catalog_Entries    REG_DWORD    0x3
    Serial_Access_Num    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
    LibraryPath    REG_SZ    %SystemRoot%\System32\mswsock.dll
    DisplayString    REG_SZ    Tcpip
    ProviderId    REG_BINARY    409D05229E7ECF11AE5A00AA00A7112B
    SupportedNameSpace    REG_DWORD    0xc
    Enabled    REG_DWORD    0x1
    Version    REG_DWORD    0x0
    StoresServiceClassInfo    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
    LibraryPath    REG_SZ    %SystemRoot%\System32\winrnr.dll
    DisplayString    REG_SZ    NTDS
    ProviderId    REG_BINARY    EE37263B80E5CF11A55500C04FD8D4AC
    SupportedNameSpace    REG_DWORD    0x20
    Enabled    REG_DWORD    0x1
    Version    REG_DWORD    0x0
    StoresServiceClassInfo    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
    LibraryPath    REG_SZ    %SystemRoot%\System32\mswsock.dll
    DisplayString    REG_SZ    Network Location Awareness (NLA) Namespace
    ProviderId    REG_BINARY    3A244266A83BA64ABAA52E0BD71FDD83
    SupportedNameSpace    REG_DWORD    0xf
    Enabled    REG_DWORD    0x1
    Version    REG_DWORD    0x0
    StoresServiceClassInfo    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
    Num_Catalog_Entries    REG_DWORD    0xd
    Next_Catalog_Entry_ID    REG_DWORD    0x40e
    Serial_Access_Num    REG_DWORD    0xa

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006600020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192E9030000010000000000000000000000000000000000000000000000000000000000000002000000020000001000000010000000010000000600000000000000000000000000000000000000000000004D00530041004600440020005400630070006900700020005B005400430050002F00490050005D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000906020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192EA0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000BBFF0000000000004D00530041004600440020005400630070006900700020005B005500440050002F00490050005D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090602000000000000000000000000000C000000A01A0FE78BABCF118CA300805F48A192EB0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000300000000000000FF0000000000000000000000BBFF0000000000004D00530041004600440020005400630070006900700020005B005200410057002F00490050005D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF00300000100000000000000000000000000000000000000000000000000000000000000060000000200000010000000100000000200000011000000000000000000000000000000BBFF00000000000052005300560050002000550044005000200053006500720076006900630065002000500072006F0076006900640065007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF10300000100000000000000000000000000000000000000000000000000000000000000060000000200000010000000100000000100000006000000000000000000000000000000000000000000000052005300560050002000540043005000200053006500720076006900630065002000500072006F0076006900640065007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920604000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FCFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F004300500051005400650061006D005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D005D0020005300450051005000410043004B004500540020003400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920704000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FCFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F004300500051005400650061006D005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D005D00200044004100540041004700520041004D00200034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920804000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FBFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D005D0020005300450051005000410043004B00450054002000350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920904000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FBFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00310043003700320030004500420033002D0036003500460034002D0034003400420035002D0041003600310036002D003800370034004200380030003100450034004100370034007D005D00200044004100540041004700520041004D0020003500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920A04000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FEFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360034003600420041004200440037002D0032004600410043002D0034004300410043002D0038003400380045002D004100360046003600420038003100410039003200370037007D005D0020005300450051005000410043004B00450054002000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920B04000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FEFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360034003600420041004200440037002D0032004600410043002D0034004300410043002D0038003400380045002D004100360046003600420038003100410039003200370037007D005D00200044004100540041004700520041004D0020003200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920C04000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FDFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00440045003500340046004500390042002D0039003700360037002D0034004100410038002D0042003600450030002D003900460039003800410035004200310041003600320042007D005D0020005300450051005000410043004B00450054002000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
    PackedCatalogItem    REG_BINARY    2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1920D04000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FDFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00440045003500340046004500390042002D0039003700360037002D0034004100410038002D0042003600450030002D003900460039003800410035004200310041003600320042007D005D00200044004100540041004700520041004D0020003300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1
    $DLL    REG_SZ    C:\WINNT\system32\MsSip1.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2
    $DLL    REG_SZ    C:\WINNT\system32\MsSip2.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3
    $DLL    REG_SZ    C:\WINNT\system32\MsSip3.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust\TrustProviders

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinTrust\TrustProviders\Software Publisher
    $DLL    REG_SZ    C:\WINNT\system32\SoftPub.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winvnc
    Type    REG_DWORD    0x110
    Start    REG_DWORD    0x2
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    winvnc.exe -service
    DisplayName    REG_SZ    VNC Server
    ObjectName    REG_SZ    LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winvnc\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winvnc\Enum
    0    REG_SZ    Root\LEGACY_WINVNC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WLBS
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\DRIVERS\wlbs.sys
    DisplayName    REG_SZ    Network Load Balancing
    Description    REG_SZ    Network Load Balancing

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WLBS\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Portable Media Serial Number Service
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\mspmsnsv.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN\Enum
    0    REG_SZ    Root\LEGACY_WMDMPMSN\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi
    Description    REG_SZ    Monitors all drivers and event trace providers that are configured to publish Windows Management Instrumentation (WMI) or event trace information. If this service is disabled, any services that explicitly depend on it will fail to start.
    DisplayName    REG_SZ    Windows Management Instrumentation Driver Extensions
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\advapi32.dll
    ServiceMain    REG_SZ    WdmWmiServiceMain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020060000400000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D01020001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi\Enum
    0    REG_SZ    Root\LEGACY_WMI\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApRpl

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance
    Library    REG_SZ    C:\WINNT\system32\wbem\wmiaprpl.dll
    Open    REG_SZ    WmiOpenPerfData
    Collect    REG_SZ    WmiCollectPerfData
    Close    REG_SZ    WmiClosePerfData
    PerfIniFile    REG_SZ    WmiApRpl.ini
    1008    REG_NONE    DE0C85C18D0FCB01
    Last Counter    REG_DWORD    0x27e6
    Last Help    REG_DWORD    0x27e7
    First Counter    REG_DWORD    0x27e2
    First Help    REG_DWORD    0x27e3
    Object List    REG_SZ    10210

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrv
    Type    REG_DWORD    0x10
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\wbem\wmiapsrv.exe
    DisplayName    REG_SZ    WMI Performance Adapter
    DependOnService    REG_MULTI_SZ    RPCSS
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Provides performance library information from Windows Management Instrumentation (WMI) providers to clients on the network. This service only runs when Performance Data Helper is activated.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrv\Enum
    0    REG_SZ    Root\LEGACY_WMIAPSRV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPRO_41_1742
    Type    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    system32\drivers\WPRO_41_1742.sys
    DisplayName    REG_SZ    WinPcap Packet Driver (WPRO_41_1742)
    TimestampMode    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPRO_41_1742\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPRO_41_1742\Enum
    0    REG_SZ    Root\LEGACY_WPRO_41_1742\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL
    Start    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x3
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\system32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Automatic Updates
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters
    ServiceDll    REG_SZ    C:\WINNT\system32\wuauserv.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum
    0    REG_SZ    Root\LEGACY_WUAUSERV\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC
    Type    REG_DWORD    0x20
    Start    REG_DWORD    0x4
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    DisplayName    REG_SZ    Wireless Configuration
    Group    REG_SZ    TDI
    DependOnService    REG_MULTI_SZ    RpcSs\0Ndisuio
    ObjectName    REG_SZ    LocalSystem
    Description    REG_SZ    Enables automatic configuration for IEEE 802.11 adapters. If this service is stopped, automatic configuration will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\wzcsvc.dll
    ServiceMain    REG_SZ    WZCSvcMain
    ServiceDllUnloadOnStop    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC\Security
    Security    REG_BINARY    01001480B8000000C4000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020088000600000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000000014000001000001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC\Enum
    0    REG_SZ    Root\LEGACY_WZCSVC\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov
    DependOnService    REG_MULTI_SZ    RpcSs
    Description    REG_SZ    Manages XML configuration files on a domain basis for automatic network provisioning.
    DisplayName    REG_SZ    Network Provisioning Service
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_SZ    C:\WINNT\System32\svchost.exe -k netsvcs
    ObjectName    REG_SZ    LocalSystem
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters
    ServiceDll    REG_SZ    C:\WINNT\System32\xmlprov.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Branding

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Branding\http://www.microsoft.com/provisioning/Branding
    QueryAlias    REG_SZ    branding
    SchemaFile    REG_SZ    branding.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Connection

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Connection\http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1
    QueryAlias    REG_SZ    baseeapconnectionpropertiesv1
    SchemaFile    REG_SZ    baseeapconnectionpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Connection\http://www.microsoft.com/provisioning/EapConnectionPropertiesV1
    QueryAlias    REG_SZ    eapconnectionpropertiesv1
    SchemaFile    REG_SZ    eapconnectionpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Connection\http://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1
    QueryAlias    REG_SZ    mschapv2connectionpropertiesv1
    SchemaFile    REG_SZ    mschapv2connectionpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Connection\http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1
    QueryAlias    REG_SZ    mspeapconnectionpropertiesv1
    SchemaFile    REG_SZ    mspeapconnectionpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Help

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Help\http://www.microsoft.com/provisioning/Help
    QueryAlias    REG_SZ    help
    SchemaFile    REG_SZ    help.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Locations

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Locations\http://www.microsoft.com/provisioning/Locations
    QueryAlias    REG_SZ    locations
    SchemaFile    REG_SZ    locations.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Master

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Master\http://www.microsoft.com/provisioning/Master
    QueryAlias    REG_SZ    master
    SchemaFile    REG_SZ    masterfile.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Register

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\Register\http://www.microsoft.com/provisioning/Register
    QueryAlias    REG_SZ    register
    SchemaFile    REG_SZ    register.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\SSID

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\SSID\http://www.microsoft.com/provisioning/SSID
    QueryAlias    REG_SZ    ssid
    SchemaFile    REG_SZ    ssid.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\User

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/BaseEapUserPropertiesV1
    QueryAlias    REG_SZ    baseeapuserpropertiesv1
    SchemaFile    REG_SZ    baseeapuserpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/EapUserPropertiesV1
    QueryAlias    REG_SZ    eapuserpropertiesv1
    SchemaFile    REG_SZ    eapuserpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/MsChapV2UserPropertiesV1
    QueryAlias    REG_SZ    mschapv2userpropertiesv1
    SchemaFile    REG_SZ    mschapv2userpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/MsPeapUserPropertiesV1
    QueryAlias    REG_SZ    mspeapuserpropertiesv1
    SchemaFile    REG_SZ    mspeapuserpropertiesv1.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\WirelessProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov\Parameters\SchemaGroups\WirelessProfile\http://www.microsoft.com/provisioning/WirelessProfile
    QueryAlias    REG_SZ    wirelessprofile
    SchemaFile    REG_SZ    wirelessprofile.xdr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{1C720EB3-65F4-44B5-A616-874B801E4A74}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{1C720EB3-65F4-44B5-A616-874B801E4A74}\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{1C720EB3-65F4-44B5-A616-874B801E4A74}\Parameters\Tcpip
    EnableDHCP    REG_DWORD    0x0
    IPAddress    REG_MULTI_SZ    169.182.203.49
    SubnetMask    REG_MULTI_SZ    255.255.255.0
    DefaultGateway    REG_MULTI_SZ    169.182.203.1\0169.182.203.2
    DhcpIPAddress    REG_SZ    0.0.0.0
    DhcpSubnetMask    REG_SZ    255.0.0.0
    DhcpServer    REG_SZ    255.255.255.255
    Lease    REG_DWORD    0xe10
    LeaseObtainedTime    REG_DWORD    0x45f118bf
    T1    REG_DWORD    0x45f11fc7
    T2    REG_DWORD    0x45f1250d
    LeaseTerminatesTime    REG_DWORD    0x45f126cf

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{DF7DB703-FE56-4F72-89FB-371431019CD1}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{DF7DB703-FE56-4F72-89FB-371431019CD1}\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{DF7DB703-FE56-4F72-89FB-371431019CD1}\Parameters\Tcpip
    EnableDHCP    REG_DWORD    0x1
    IPAddress    REG_MULTI_SZ    0.0.0.0
    SubnetMask    REG_MULTI_SZ    0.0.0.0
    DhcpIPAddress    REG_SZ    0.0.0.0
    DhcpSubnetMask    REG_SZ    255.0.0.0
    DhcpServer    REG_SZ    255.255.255.255
    Lease    REG_DWORD    0xe10
    LeaseObtainedTime    REG_DWORD    0x45f11882
    T1    REG_DWORD    0x45f11f8a
    T2    REG_DWORD    0x45f124d0
    LeaseTerminatesTime    REG_DWORD    0x45f12692

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{EE812484-03FC-4739-9BC2-B9D094470C3D}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{EE812484-03FC-4739-9BC2-B9D094470C3D}\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{EE812484-03FC-4739-9BC2-B9D094470C3D}\Parameters\Tcpip
    EnableDHCP    REG_DWORD    0x0
    IPAddress    REG_MULTI_SZ    169.182.203.49
    SubnetMask    REG_MULTI_SZ    255.255.255.0
    DefaultGateway    REG_MULTI_SZ    169.182.203.1\0169.182.203.2
    DhcpIPAddress    REG_SZ    0.0.0.0
    DhcpSubnetMask    REG_SZ    255.0.0.0
    DhcpServer    REG_SZ    255.255.255.255
    Lease    REG_DWORD    0xe10
    LeaseObtainedTime    REG_DWORD    0x45f11374
    T1    REG_DWORD    0x45f11a7c
    T2    REG_DWORD    0x45f11fc2
    LeaseTerminatesTime    REG_DWORD    0x45f12184

