Working on the Dominion "before" and "after" torrents.
Got the Registry extracted and compressed, uploaded here, about 15 MB (text compresses well; it's ~500 MB uncompressed): files.catbox.moe/zvnwny.7z
Am trying to find an algorithm mapping location data to a (latitude,longitude) pair.
Pretty sure this is the location data from the Registry, below.
Anybody that can help, appreciated! This section of the Registry hasn't changed. It's in the "SYSTEM" hive; I connected it to the "OFFLINE" stub while investigating, i.e., didn't boot from the cloned drive, just accessed it from a Windows 10 box.
Rest is from Registry:
[HKEY_LOCAL_MACHINE\OFFLINE\ControlSet001\Services\lfsvc\TriggerInfo]
[HKEY_LOCAL_MACHINE\OFFLINE\ControlSet001\Services\lfsvc\TriggerInfo\0]
"Type"=dword:00000007
"Action"=dword:00000001
"GUID"=hex:16,28,7a,2d,5e,0c,fc,45,9c,e7,57,0e,5e,cd,e9,c9
"Data0"=hex:75,b0,bc,a3,3e,0b,84,41
"DataType0"=dword:00000001
[HKEY_LOCAL_MACHINE\OFFLINE\ControlSet001\Services\lfsvc\TriggerInfo\1]
"Type"=dword:00000006
"Action"=dword:00000001
"GUID"=hex:67,d1,90,bc,70,94,39,41,a9,ba,be,0b,bb,f5,b7,4d
"Data0"=hex:44,00,30,00,39,00,42,00,44,00,45,00,42,00,35,00,2d,00,36,00,31,00,\
37,00,31,00,2d,00,34,00,41,00,33,00,34,00,2d,00,42,00,46,00,45,00,32,00,2d,\
00,30,00,36,00,46,00,41,00,38,00,32,00,36,00,35,00,32,00,35,00,36,00,38,00,\
3a,00,35,00,38,00,32,00,41,00,34,00,37,00,42,00,32,00,2d,00,42,00,43,00,44,\
00,38,00,2d,00,34,00,44,00,33,00,43,00,2d,00,38,00,41,00,43,00,42,00,2d,00,\
46,00,45,00,30,00,39,00,44,00,35,00,42,00,44,00,36,00,45,00,45,00,43,00,00,\
00
"DataType0"=dword:00000002
[HKEY_LOCAL_MACHINE\OFFLINE\ControlSet001\Services\lfsvc\TriggerInfo\2]
"Type"=dword:00000001
"Action"=dword:00000001
"GUID"=hex:e4,e5,36,33,8a,01,69,46,84,c5,bd,05,f3,bd,36,8b
[HKEY_LOCAL_MACHINE\OFFLINE\ControlSet001\Services\lfsvc\TriggerInfo\3]
"Type"=dword:00000007
"Action"=dword:00000001
"GUID"=hex:16,28,7a,2d,5e,0c,fc,45,9c,e7,57,0e,5e,cd,e9,c9
"Data0"=hex:75,38,bc,a3,3e,06,8a,41
"DataType0"=dword:00000001