| |
| Deleted keys (0) for shot A |
| |
| New keys (1) for shot B |
| [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\bgbennyboyGrimReplacementSetup_is1] |
| |
| Deleted values (0) for shot A |
| |
| New values (32) for shot B |
| [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LucasArts Entertainment Company LLC\Grim Fandango\v1.0] |
| "Executable"="C:\\Grim\\GrimFandango.exe" |
| "Install Path"="C:\\Grim" |
| "Source Path"="D:\\" |
| "CD Path"="D:\\" |
| "Analyze Path"="D:\\INSTALL\\DXDIAG.exe" |
| "Source Dir"="D:\\" |
| "GrimDataDir"="D:\\GRIMDATA" |
| "InstallType"=dword:00000009 |
| [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\bgbennyboyGrimReplacementSetup_is1] |
| "Inno Setup: Setup Version"="5.2.0" |
| "Inno Setup: App Path"="C:\\Grim" |
| "InstallLocation"="C:\\Grim\\" |
| "Inno Setup: Icon Group"="Lucasarts\\Grim Fandango" |
| "Inno Setup: User"="Administrator" |
| "Inno Setup: Selected Tasks"="desktopicon" |
| "Inno Setup: Deselected Tasks"="" |
| "DisplayName"="Grim Fandango" |
| "DisplayIcon"="C:\\Grim\\Grim Fandango Launcher.exe" |
| "UninstallString"="\"C:\\Grim\\unins000.exe\"" |
| "QuietUninstallString"="\"C:\\Grim\\unins000.exe\" /SILENT" |
| "DisplayVersion"="1.0" |
| "Publisher"="Quick and Easy Software" |
| "URLInfoAbout"="http://quick.mixnmojo.com" |
| "HelpLink"="http://quick.mixnmojo.com" |
| "URLUpdateInfo"="http://quick.mixnmojo.com" |
| "Contact"="http://quick.mixnmojo.com/contact" |
| "Comments"="Contact me via my contact page" |
| "NoModify"=dword:00000001 |
| "NoRepair"=dword:00000001 |
| "InstallDate"="20120218" |
| [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted] |
| "\\\\allvideo\\pictures\\GrimSetup1.0.exe"=dword:00000001 |
| [HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\83\52C64B7E] |
| "@C:\\WINDOWS\\regedit.exe,-309"="Registration Entries" |
| "@C:\\WINDOWS\\system32\\NetworkExplorer.dll,-1"="Network" |
| |
| Changed values (21) for shot A |
| [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.] |
| "TotalScanned"=dword:00019040 |
| "TotalScanned"=dword:000190f8 |
| "LastScannedFileName"="C:\\WINDOWS\\system32\\perfh009.da" |
| "LastScannedFileName"="C:\\WINDOWS\\Prefetch\\IGFXSRVC.EXE-67E7A62F.p" |
| [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nsi\{eb004a03-9b1a-11d4-9123-0050047759bc}\24] |
"ffffffffffffffffffffffffffffff02"=hex:00,00,00,00,96,99,00,00,a1,0b,00,00,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff |
"ffffffffffffffffffffffffffffff02"=hex:00,00,00,00,96,99,00,00,a2,0b,00,00,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff |
| [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdyboost\Parameters] |
"BootPlan"=hex:02,00,0c,00,f4,2d,00,00,42,12,00,00,1a,00,00,00,4f,0e,f4,c5,5c,\
ee,cc,01,00,00,00,00,00,00,00,00,00,70,00,00,01,00,00,00,00,80,00,00,00,00,\
00,00,00,10,00,00,01,00,00,00,00,b0,00,00,00,00,00,00,00,10,00,00,01,00,00,\
00,00,d0,00,00,00,00,00,00,00,10,00,00,01,00,00,00,00,10,01,00,00,00,00,00,\
00,10,00,00,01,00,00,00,00,b0,01,00,00,00,00,00,00,20,00,00,01,00,00,00,00,\
10,02,00,00,00,00,00,00,... |
"BootPlan"=hex:02,00,0c,00,02,2e,00,00,42,12,00,00,1a,00,00,00,86,b1,28,e5,86,\
ee,cc,01,00,00,00,00,00,00,00,00,00,70,00,00,01,00,00,00,00,80,00,00,00,00,\
00,00,00,10,00,00,01,00,00,00,00,b0,00,00,00,00,00,00,00,10,00,00,01,00,00,\
00,00,d0,00,00,00,00,00,00,00,10,00,00,01,00,00,00,00,10,01,00,00,00,00,00,\
00,10,00,00,01,00,00,00,00,b0,01,00,00,00,00,00,00,20,00,00,01,00,00,00,00,\
10,02,00,00,00,00,00,00,... |
| "LastBootPlanUserTime"="Sat, Feb 18 12, 04:45:51 PM 껊nj◐流߾ ŀ Ѐ 溜߾" |
| "LastBootPlanUserTime"="Sat, Feb 18 12, 09:47:22 PM 췾nj◐流߾ ŀ Ѐ 溜߾" |
| [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{ABE63A85-7260-40BD-81A9-1CBEA578F720}] |
"DhcpInterfaceOptions"=hex:fc,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,8e,\
5a,40,4f,06,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,c7,89,41,4f,c0,a8,\
01,01,44,ed,a1,0c,03,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,\
4f,c0,a8,01,01,0f,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,\
68,6f,6d,65,01,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,ff,\
ff,ff,00,33,00,00,00,00,00,00,00,04,... |
"DhcpInterfaceOptions"=hex:fc,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f9,\
61,40,4f,06,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,c7,89,41,4f,c0,a8,\
01,01,44,ed,a1,0c,03,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,\
4f,c0,a8,01,01,0f,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,\
68,6f,6d,65,01,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,ff,\
ff,ff,00,33,00,00,00,00,00,00,00,04,... |
| [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VolSnap] |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Enter)"=hex:48,00,\
00,00,00,00,00,00,25,75,5a,84,b0,ee,cc,01,00,00,00,00,00,00,00,00,12,00,00,\
00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Enter)"=hex:48,00,\
00,00,00,00,00,00,e2,60,cc,9a,b0,ee,cc,01,00,00,00,00,00,00,00,00,12,00,00,\
00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Leave)"=hex:48,00,\
00,00,00,00,00,00,9b,44,1b,85,b0,ee,cc,01,00,00,00,00,00,00,00,00,13,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Leave)"=hex:48,00,\
00,00,00,00,00,00,e2,60,cc,9a,b0,ee,cc,01,00,00,00,00,00,00,00,00,13,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
| [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nsi\{eb004a03-9b1a-11d4-9123-0050047759bc}\24] |
"ffffffffffffffffffffffffffffff02"=hex:00,00,00,00,96,99,00,00,a1,0b,00,00,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff |
"ffffffffffffffffffffffffffffff02"=hex:00,00,00,00,96,99,00,00,a2,0b,00,00,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff |
| [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rdyboost\Parameters] |
"BootPlan"=hex:02,00,0c,00,f4,2d,00,00,42,12,00,00,1a,00,00,00,4f,0e,f4,c5,5c,\
ee,cc,01,00,00,00,00,00,00,00,00,00,70,00,00,01,00,00,00,00,80,00,00,00,00,\
00,00,00,10,00,00,01,00,00,00,00,b0,00,00,00,00,00,00,00,10,00,00,01,00,00,\
00,00,d0,00,00,00,00,00,00,00,10,00,00,01,00,00,00,00,10,01,00,00,00,00,00,\
00,10,00,00,01,00,00,00,00,b0,01,00,00,00,00,00,00,20,00,00,01,00,00,00,00,\
10,02,00,00,00,00,00,00,... |
"BootPlan"=hex:02,00,0c,00,02,2e,00,00,42,12,00,00,1a,00,00,00,86,b1,28,e5,86,\
ee,cc,01,00,00,00,00,00,00,00,00,00,70,00,00,01,00,00,00,00,80,00,00,00,00,\
00,00,00,10,00,00,01,00,00,00,00,b0,00,00,00,00,00,00,00,10,00,00,01,00,00,\
00,00,d0,00,00,00,00,00,00,00,10,00,00,01,00,00,00,00,10,01,00,00,00,00,00,\
00,10,00,00,01,00,00,00,00,b0,01,00,00,00,00,00,00,20,00,00,01,00,00,00,00,\
10,02,00,00,00,00,00,00,... |
| "LastBootPlanUserTime"="Sat, Feb 18 12, 04:45:51 PM 껊nj◐流߾ ŀ Ѐ 溜߾" |
| "LastBootPlanUserTime"="Sat, Feb 18 12, 09:47:22 PM 췾nj◐流߾ ŀ Ѐ 溜߾" |
| [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ABE63A85-7260-40BD-81A9-1CBEA578F720}] |
"DhcpInterfaceOptions"=hex:fc,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,8e,\
5a,40,4f,06,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,c7,89,41,4f,c0,a8,\
01,01,44,ed,a1,0c,03,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,\
4f,c0,a8,01,01,0f,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,\
68,6f,6d,65,01,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,ff,\
ff,ff,00,33,00,00,00,00,00,00,00,04,... |
"DhcpInterfaceOptions"=hex:fc,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f9,\
61,40,4f,06,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,c7,89,41,4f,c0,a8,\
01,01,44,ed,a1,0c,03,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,\
4f,c0,a8,01,01,0f,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,\
68,6f,6d,65,01,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,c7,89,41,4f,ff,\
ff,ff,00,33,00,00,00,00,00,00,00,04,... |
| [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VolSnap] |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Enter)"=hex:48,00,\
00,00,00,00,00,00,25,75,5a,84,b0,ee,cc,01,00,00,00,00,00,00,00,00,12,00,00,\
00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Enter)"=hex:48,00,\
00,00,00,00,00,00,e2,60,cc,9a,b0,ee,cc,01,00,00,00,00,00,00,00,00,12,00,00,\
00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Leave)"=hex:48,00,\
00,00,00,00,00,00,9b,44,1b,85,b0,ee,cc,01,00,00,00,00,00,00,00,00,13,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
"Volume{9145ca47-f344-11df-938c-806e6f6e6963}DeleteProcess (Leave)"=hex:48,00,\
00,00,00,00,00,00,e2,60,cc,9a,b0,ee,cc,01,00,00,00,00,00,00,00,00,13,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 |
| [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume{d9fe82c5-f346-11df-bd2a-806e6f6e6963}\Current Media] |
| "TotalBytes"=hex:00,68,19,20,00,00,00,00 |
| "TotalBytes"=hex:00,68,80,27,00,00,00,00 |
| "Disc Label"="Hexplore" |
| "Disc Label"="GRIM_DISC_B" |
| [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9fe82c5-f346-11df-bd2a-806e6f6e6963}] |
"Data"=hex:d6,0d,00,00,00,00,00,00,01,00,00,00,10,00,00,00,ff,03,00,84,00,00,\
00,00,00,00,00,30,01,00,00,80,23,00,00,00,05,00,08,01,6e,00,00,00,10,00,00,\
00,d4,e7,33,dd,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,5c,00,5c,00,3f,00,5c,00,49,00,44,00,45,00,23,\
00,43,00,64,00,52,00,6f,00,6d,00,54,00,53,00,53,00,54,00,63,00,6f,00,72,00,\
70,00,5f,00,44,00,56,... |
"Data"=hex:d6,0d,00,00,00,00,00,00,01,00,00,00,10,00,00,00,ff,03,00,84,00,00,\
00,00,00,00,00,30,01,00,00,80,23,00,00,00,01,00,08,01,dd,00,00,00,10,00,00,\
00,54,f9,ad,ef,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,5c,00,5c,00,3f,00,5c,00,49,00,44,00,45,00,23,\
00,43,00,64,00,52,00,6f,00,6d,00,54,00,53,00,53,00,54,00,63,00,6f,00,72,00,\
70,00,5f,00,44,00,56,... |
| "Generation"=dword:00000006 |
| "Generation"=dword:0000000c |
| [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9fe82c5-f346-11df-bd2a-806e6f6e6963}\shell\AutoRun\command] |
| @="D:\\setup.exe" |
| @="D:\\AUTOSTUB.EXE" |
| [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9fe82c5-f346-11df-bd2a-806e6f6e6963}\_Autorun\DefaultIcon] |
| @="D:\\hexplore.exe" |
| @="D:\\FLOWER.ICO" |
| [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2] |
"ProgramsCache"=hex:13,00,00,00,c3,53,5b,62,48,ab,c1,4e,ba,1f,a1,ef,41,46,fc,\
19,00,80,00,00,00,7e,00,31,00,00,00,00,00,2a,3d,0c,af,11,00,50,72,6f,67,72,\
61,6d,73,00,00,66,00,08,00,04,00,ef,be,2a,3d,d9,ae,2a,3d,0c,af,2a,00,00,00,\
de,01,00,00,00,00,02,00,00,00,00,00,00,00,00,00,3c,00,00,00,00,00,50,00,72,\
00,6f,00,67,00,72,00,61,00,6d,00,73,00,00,00,40,00,73,00,68,00,65,00,6c,00,\
6c,00,33,00,32,00,2e,00,64,00,... |
"ProgramsCache"=hex:13,00,00,00,c3,53,5b,62,48,ab,c1,4e,ba,1f,a1,ef,41,46,fc,\
19,00,80,00,00,00,7e,00,31,00,00,00,00,00,2a,3d,0c,af,11,00,50,72,6f,67,72,\
61,6d,73,00,00,66,00,08,00,04,00,ef,be,2a,3d,d9,ae,2a,3d,0c,af,2a,00,00,00,\
de,01,00,00,00,00,02,00,00,00,00,00,00,00,00,00,3c,00,00,00,00,00,50,00,72,\
00,6f,00,67,00,72,00,61,00,6d,00,73,00,00,00,40,00,73,00,68,00,65,00,6c,00,\
6c,00,33,00,32,00,2e,00,64,00,... |
| |