Reverse engineering and event log correlation identified four primary defects:
Windows Registry Editor Version 5.00
In memory or on disk: