ForensicArtifacts/artifacts

Check WindowsUninstallKeys

joachimmetz opened this issue · 1 comments

WindowsUninstallKeys defines:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Userdata\%%users.sid%%\Products\*\InstallProperties

No mention of Userdata sub key in https://docs.microsoft.com/en-us/windows/desktop/Msi/uninstall-registry-key

And websearch (https://superuser.com/questions/473569/where-does-windows-store-msi-files-for-uninstallation) indicates this should likely be a different key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\<SID>\Products\

Also changing %%users.sid%% to * is likely to be a more inclusive definition:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Userdata\S-*\Products\*\InstallProperties