> lpClass most likely is a class name in COM/OLE sense. I don't think that is true. In the original Windows 3.1 registry, lpClass did not exist. You only had t

> lpClass most likely is a class name in COM/OLE sense. I don't think that is true. In the original Windows 3.1 registry, lpClass did not exist. You only had the RegCreateKey() function which had no lpClass parameter, that parameter was added in RegCreateKeyEx() which was only in NT (and later Windows 95 too). COM/OLE never used lpClass. Out-of-the-box, very few Windows registry keys have lpClass set, and those that do it is mostly some meaningless value like "Shell" or "Setup", which COM/OLE completely ignores. The one place (that I know of) which it is (or was) actually used, is to store the syskey encryption key [0]. I think using lpClass for that is just abusing it for a bit of security-by-obscurity, it is a way to store data in the registry but hide it from most registry tools (which provide no access to lpClass because almost nobody uses it.) Possibly other people are doing the same thing (to store license keys, detect expiration of trial periods, malware hiding stuff, etc.) [0] http://moyix.blogspot.com/2008/02/syskey-and-sam.html http://moyix.blogspot.com/2008/02/syskey-and-sam.html