Default User Run

Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"="\"C:\\Documents and Settings\\NetworkService\\Local Settings\\Application Data\\smss.exe\""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"