System data like:
Boot programs at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Programs begin in the boot registry by the user
Boot programs at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Programs begin in the boot registry by the machine
Boot programs at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Httpd
Programs data when is a service: imagepath, displayname ...
Data server
Vars of the system ( system calls ): user, computer name, time...
System variables from environment
Vars of the system ( cmd vars ): exec path, extensions ...
Data connection
remote ip, cookie, browser