Merge pull request #977 from SecurityAura/master

Update RegistryHivesUser.tkape
EricZimmerman · Oct 13, 2024 · 37874d5 · 37874d5
2 parents ad2180c + 5aa09d0
commit 37874d5
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/Targets/Windows/RegistryHivesUser.tkape b/Targets/Windows/RegistryHivesUser.tkape
@@ -8,12 +8,12 @@ Targets:
         Name: NTUSER.DAT registry hive XP
         Category: Registry
         Path: C:\Documents and Settings\%user%\
-        FileMask: NTUSER.DAT
+        FileMask: NTUSER.DAT*
     -
         Name: NTUSER.DAT registry hive
         Category: Registry
         Path: C:\Users\%user%\
-        FileMask: NTUSER.DAT
+        FileMask: NTUSER.DAT*
     -
         Name: NTUSER.DAT registry transaction files
         Category: Registry
@@ -43,7 +43,7 @@ Targets:
         Name: UsrClass.dat registry hive
         Category: Registry
         Path: C:\Users\%user%\AppData\Local\Microsoft\Windows\
-        FileMask: UsrClass.dat
+        FileMask: UsrClass.dat*
     -
         Name: UsrClass.dat registry transaction files
         Category: Registry