####################### Registry Scan ###########################################
# AK - Add Key,   DK - Delete Key
# AV - Add Value, DV - Delete Value, EV1 - Edit Value(old), EV2 - Edit Value(new)
#################################################################################
AK	-1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: Setup Version	35 2E 33 2E 39 20 28 75 29 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: App Path	25 49 6E 73 74 61 6C 6C 44 69 72 25 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	InstallLocation	25 49 6E 73 74 61 6C 6C 44 69 72 25 5C 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: Icon Group	B6 A1 BF CB D0 A1 C9 AD C1 D6 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: User	41 64 6D 69 6E 69 73 74 72 61 74 6F 72 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: Selected Tasks	64 65 73 6B 74 6F 70 69 63 6F 6E 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: Deselected Tasks	
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Inno Setup: Language	63 68 69 6E 65 73 65 73 69 6D 70 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	DisplayName	B6 A1 BF CB D0 A1 C9 AD C1 D6 20 2D 20 CA A5 B3 C7 BC D2 D4 B0 D3 CE CF B7 BA BA BB AF 20 76 31 2E 30 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	DisplayIcon	5C 64 69 6E 6B 2E 69 63 6F 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	UninstallString	22 25 49 6E 73 74 61 6C 6C 44 69 72 25 5C 75 6E 69 6E 73 30 30 30 2E 65 78 65 22 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	QuietUninstallString	22 25 49 6E 73 74 61 6C 6C 44 69 72 25 5C 75 6E 69 6E 73 30 30 30 2E 65 78 65 22 20 2F 53 49 4C 45 4E 54 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	Publisher	CA A5 B3 C7 BC D2 D4 B0 CD F8 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	URLInfoAbout	68 74 74 70 3A 2F 2F 62 62 73 2E 63 6E 73 63 67 2E 63 6F 6D 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	HelpLink	68 74 74 70 3A 2F 2F 62 62 73 2E 63 6E 73 63 67 2E 63 6F 6D 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	URLUpdateInfo	68 74 74 70 3A 2F 2F 62 62 73 2E 63 6E 73 63 67 2E 63 6F 6D 
AV	4	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	NoModify	01 
AV	4	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	NoRepair	01 
AV	1	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CC41119-CEEA-4F21-B2DF-88366DC63BB1}_is1\	InstallDate	32 30 31 30 30 35 31 38 
EV1	4	HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\	Count	01 
EV2	4	HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\	Count	
EV1	4	HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\	NextInstance	01 
EV2	4	HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\	NextInstance	
DV	1	HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\0	53 57 5C 7B 62 37 65 61 66 64 63 30 2D 61 36 38 30 2D 31 31 64 30 2D 39 36 64 38 2D 30 30 61 61 30 30 35 31 65 35 31 64 7D 5C 7B 39 42 33 36 35 38 39 30 2D 31 36 35 46 2D 31 31 44 30 2D 41 31 39 35 2D 30 30 32 30 41 46 44 31 35 36 45 34 7D 
EV1	4	HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\	Count	01 
EV2	4	HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\	Count	
EV1	4	HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\	NextInstance	01 
EV2	4	HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\	NextInstance	
DV	1	HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\0	53 57 5C 7B 62 37 65 61 66 64 63 30 2D 61 36 38 30 2D 31 31 64 30 2D 39 36 64 38 2D 30 30 61 61 30 30 35 31 65 35 31 64 7D 5C 7B 39 42 33 36 35 38 39 30 2D 31 36 35 46 2D 31 31 44 30 2D 41 31 39 35 2D 30 30 32 30 41 46 44 31 35 36 45 34 7D 
AV	3	HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\	HRZR_EHACVQY:%pfvqy2%\丁克小森林	01 
AV	3	HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\	HRZR_EHACVQY:%pfvqy2%\丁克小森林\丁克小森林 - 圣城家园游戏汉化.yax	01 
EV1	3	HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\	MRUListEx	
EV2	3	HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\	MRUListEx	01 
EV1	3	HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\	MRUListEx	02 
EV2	3	HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\	MRUListEx	
EV1	4	HKCU\SessionInformation\	ProgramCount	05 
EV2	4	HKCU\SessionInformation\	ProgramCount	04 
####################### Dir Scan ################################################
# AD - Add Dir,   DD - Delete Dir
# AF - Add File,  DF - Delete File, EF - Edit File
#################################################################################
EF	C:\WINDOWS\system32\config\software.LOG
EF	C:\WINDOWS\system32\config\system.LOG
