Registered User Name (as seen in VER command) starts at 
raw offset 0x34EEE (Trw2000.sys).

======
CrackZ
======