Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList] "ProfilesDirectory"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,\ 00,69,00,76,00,65,00,25,00,5c,00,55,00,73,00,65,00,72,00,73,00,00,00 "Default"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,\ 76,00,65,00,25,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,00,44,00,65,00,66,\ 00,61,00,75,00,6c,00,74,00,00,00 "Public"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,76,\ 00,65,00,25,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,00,50,00,75,00,62,00,\ 6c,00,69,00,63,00,00,00 "ProgramData"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,\ 00,76,00,65,00,25,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,44,00,\ 61,00,74,00,61,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18] "Flags"=dword:0000000c "State"=dword:00000000 "RefCount"=dword:00000001 "Sid"=hex:01,01,00,00,00,00,00,05,12,00,00,00 "ProfileImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,\ 00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\ 5c,00,63,00,6f,00,6e,00,66,00,69,00,67,00,5c,00,73,00,79,00,73,00,74,00,65,\ 00,6d,00,70,00,72,00,6f,00,66,00,69,00,6c,00,65,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19] "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,\ 00,73,00,5c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,50,00,72,00,6f,00,\ 66,00,69,00,6c,00,65,00,73,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,\ 00,72,00,76,00,69,00,63,00,65,00,00,00 "Flags"=dword:00000000 "State"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20] "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,\ 00,73,00,5c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,50,00,72,00,6f,00,\ 66,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,\ 00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00 "Flags"=dword:00000000 "State"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1961491539-2329674821-46184744-1000] "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,\ 00,54,00,45,00,4d,00,50,00,2e,00,47,00,61,00,6d,00,65,00,72,00,2d,00,50,00,\ 43,00,00,00 "Flags"=dword:00000000 "State"=dword:00004a04 "Sid"=hex:01,05,00,00,00,00,00,05,15,00,00,00,53,fc,e9,74,45,04,dc,8a,28,b9,c0,\ 02,e8,03,00,00 "ProfileLoadTimeLow"=dword:00000000 "ProfileLoadTimeHigh"=dword:00000000 "RefCount"=dword:00000003 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1961491539-2329674821-46184744-1000.bak] "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,\ 00,47,00,61,00,6d,00,65,00,72,00,00,00 "Flags"=dword:00000000 "State"=dword:00008000 "Sid"=hex:01,05,00,00,00,00,00,05,15,00,00,00,53,fc,e9,74,45,04,dc,8a,28,b9,c0,\ 02,e8,03,00,00 "ProfileLoadTimeLow"=dword:00000000 "ProfileLoadTimeHigh"=dword:00000000 "RefCount"=dword:00000000 "RunLogonScriptSync"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1961491539-2329674821-46184744-1004.bak] "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,\ 00,55,00,72,00,67,00,6f,00,00,00 "Flags"=dword:00000000 "State"=dword:00008000 "Sid"=hex:01,05,00,00,00,00,00,05,15,00,00,00,53,fc,e9,74,45,04,dc,8a,28,b9,c0,\ 02,ec,03,00,00 "ProfileLoadTimeLow"=dword:00000000 "ProfileLoadTimeHigh"=dword:00000000 "RefCount"=dword:00000000 "RunLogonScriptSync"=dword:00000000