Changed definition of WindowsUninstallKeys #329 (#330)

ForensicArtifacts · Mar 30, 2019 · 367efaa · 367efaa
1 parent bf5cd59
commit 367efaa
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/data/windows.yaml b/data/windows.yaml
@@ -2130,10 +2130,7 @@ name: WindowsUninstallKeys
 doc: Uninstall Registry keys
 sources:
 - type: REGISTRY_KEY
-  attributes:
+  attributes: {keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*']}
-    keys:
-      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*'
-      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Userdata\%%users.sid%%\Products\*\InstallProperties'
 supported_os: [Windows]
 urls: ['https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx']
 ---