From 73278dac6457bdc4bbbe32ef6434b8ba50d68371 Mon Sep 17 00:00:00 2001
From: Andrew Rathbun <andrew.d.rathbun@gmail.com>
Date: Fri, 6 Sep 2024 21:45:21 -0400
Subject: [PATCH] remove errant WinSCP entry, standardize UsrClass

---
 BatchExamples/DFIRBatch.reb | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/BatchExamples/DFIRBatch.reb b/BatchExamples/DFIRBatch.reb
index 0abcf1d..399dc24 100644
--- a/BatchExamples/DFIRBatch.reb
+++ b/BatchExamples/DFIRBatch.reb
@@ -2591,13 +2591,6 @@ Keys:
         KeyPath: Software\Martin Prikryl
         Recursive: true
         Comment: "WinSCP"
-    -
-        Description: WinSCP
-        HiveType: Other
-        Category: Third Party Applications
-        KeyPath: Software\Martin Prikryl
-        Recursive: true
-        Comment: "WinSCP"
     -
         Description: WinSCP
         HiveType: SOFTWARE
@@ -3579,7 +3572,7 @@ Keys:
 
     -
         Description: Exefile Shell Open Command
-        HiveType: usrclass
+        HiveType: UsrClass
         Category: Threat Hunting
         KeyPath: Exefile\Shell\Open\Command
         ValueName: (default)