search

EricZimmerman / Srum

MIT License
37 stars 5 forks source link

Resolve Unknown Table Names #8

Closed AndrewRathbun closed 2 years ago

AndrewRathbun commented 2 years ago

From my Windows 11 box:

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{5C8CF1C7-7257-4F13-B223-970EF5939312}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: App Timeline Provider

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{7ACBBAA3-D029-4BE4-9A7A-0885927F1D8F}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: vfuprov
Slack: 00-00-00-00

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{973F5D5C-1D90-4944-BE8E-24B94231A174}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: Windows Network Data Usage Monitor
Slack: 00-00-00-00-00-00

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{B6D82AF1-F780-4E17-8077-6CB9AD8A6FC4}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: Tagged Energy Provider
Slack: 00-00-00-00-00-00

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{d10ca2fe-6fcf-4f6d-848e-b2e99266fa86}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: WPN SRUM Provider

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{d10ca2fe-6fcf-4f6d-848e-b2e99266fa89}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: Application Resource Usage Provider
Slack: 00-00-00-00

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{DA73FB89-2BEA-4DDC-86B8-6E048C6DA477}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: Energy Estimation Provider
Slack: 00-00-00-00-00-00

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{DD6636C4-8929-4683-974E-22C046A43763}
Last write: 2021-06-05 12:13:58
Value: (default) (RegSz)
Data: Windows Network Connectivity Usage Monitor
Slack: 00-00-00-00-00-00

Registry file: REDACTED\C\Windows\System32\config\SOFTWARE
Key: Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\{fee4e14f-02a9-4550-b5ce-5fa2da202e37}
Last write: 2022-01-31 21:55:26
Value: (default) (RegSz)
Data: Energy Usage Provider
EricZimmerman commented 2 years ago

The first 2 unknowns have been renamed in SrumECmd.