HKEY_DYN_DATA
HKDD is a fake key--it doesn't really exist. It serves as a convenient
doorway to device driver, Win32 application, and native NT performance
counters via the Registry API. When a Win32 program queries a value or
key in HKDD, the request gets routed as an I/O request to the appropriate
driver or Win32 program, which returns information that looks like the
result of an authentic Registry access. The Performance Monitor (Perfmon)
program accesses this root key to provide the intricate performance information
it displays.