#include $ProgToRun = "filemon.exe" $Path = @ScriptDir $InFilter = $ProgToRun $ExFilter = "" $HiFilter = "" $Settings="AE0100006400000064000000580200002C010000230000005A0000004600000046000000C800000032000000460000000000000001000000FFFFFF00FF00000000010100000000000800000000000000000000000000000090010000000000CC010202224D532053616E7320536572696600000000000000000000000000000000000000" $regmonfilename = "regmon.exe" FileDelete("outp1.log") ProcessClose("regmon.exe") RegWrite("HKEY_CURRENT_USER\Software\Sysinternals\Regmon","HiFilters","REG_BINARY",_StringToHex($HiFilter)) RegWrite("HKEY_CURRENT_USER\Software\Sysinternals\Regmon","InFilters","REG_BINARY",_StringToHex($InFilter)) RegWrite("HKEY_CURRENT_USER\Software\Sysinternals\Regmon","ExFilters","REG_BINARY",_StringToHex($ExFilter)) RegWrite("HKEY_CURRENT_USER\Software\Sysinternals\Regmon","Settings","REG_BINARY",$Settings) Run($regmonfilename & " -q","",@SW_MINIMIZE ) ;MsgBox(0,"",$Path & "\" & $ProgToRun) Run($ProgToRun) ProcessWaitClose($ProgToRun) WinActivate("Registry Monitor") WinWaitActive("Registry Monitor") Sleep(200) Send("{CTRLDOWN}") Send("^s") Send("{CTRLUP}") Sleep(100) WinActivate("Save Regmon Output") Sleep(100) WinWaitActive("Save Regmon Output") Sleep(100) ControlSetText("Save Regmon Output","","Edit1","c:\outp1.log") ControlClick("Save Regmon Output","","Button2") RunWait("gawk.exe -f splitkeyname.awk outp1.log") FileDelete("outp1.log") $file= FileOpen("regmon.awl",0) $outfile = FileOpen("output.reg",2) FileWriteLine($outfile,"REGEDIT4") While @error <> -1 $regval= FileReadLine($file) $regval = StringStripWS(StringStripCR($regval),7) $regval = StringSplit($regval," ") $regkey = $regval[1] $regvalue = $regval[2] WEnd