Merge remote-tracking branch 'upstream/master'

Core/src/org/sleuthkit/autopsy/casemodule/Case.java

@@ -194,9 +194,9 @@ public class Case {
     }
 
     /**
-     * Creates a new case (create the XML config file and the directory)
+     * Creates a new case (create the XML config file and database) 
      *
-     * @param caseDir the base directory where the configuration file is saved
+     * @param caseDir The directory to store case data in.  Will be created if it doesn't already exist. If it exists, it should have all of the needed sub dirs that createCaseDirectory() will create. 
      * @param caseName the name of case
      * @param caseNumber the case number
      * @param examiner the examiner for this case
@@ -204,6 +204,11 @@ public class Case {
     public static void create(String caseDir, String caseName, String caseNumber, String examiner) throws CaseActionException {
         logger.log(Level.INFO, "Creating new case.\ncaseDir: {0}\ncaseName: {1}", new Object[]{caseDir, caseName});
 
+        // create case directory if it doesn't already exist.
+        if (new File(caseDir).exists() == false) {
+            Case.createCaseDirectory(caseDir);
+        }
+        
         String configFilePath = caseDir + File.separator + caseName + CASE_DOT_EXTENSION;
 
         XMLCaseManagement xmlcm = new XMLCaseManagement();
@@ -775,12 +780,22 @@ public class Case {
     /**
      * to create the case directory
      *
-     * @param caseDir the case directory path
-     * @param caseName the case name
+     * @param caseDir Path to the case directory (typically base + case name)
+     * @param caseName the case name (used only for error messages)
      * @throws CaseActionException throw if could not create the case dir
+     * @Deprecated
      */
     static void createCaseDirectory(String caseDir, String caseName) throws CaseActionException {
-        boolean result = false;
+        createCaseDirectory(caseDir);
+        
+    }
+    /**
+     * Create the case directory and its needed subfolders. 
+     *
+     * @param caseDir Path to the case directory (typically base + case name)
+     * @throws CaseActionException throw if could not create the case dir
+     */
+    static void createCaseDirectory(String caseDir) throws CaseActionException {
 
         File caseDirF = new File(caseDir);
         if (caseDirF.exists()) {
@@ -792,7 +807,7 @@ public class Case {
         }
 
         try {
-            result = (caseDirF).mkdirs(); // create root case Directory
+            boolean result = (caseDirF).mkdirs(); // create root case Directory
             if (result == false) {
                 throw new CaseActionException("Cannot create case dir: " + caseDir);
             }
@@ -804,17 +819,17 @@ public class Case {
                     && (new File(caseDir + File.separator + XMLCaseManagement.CACHE_FOLDER_RELPATH)).mkdir();
 
             if (result == false) {
-                throw new CaseActionException("Could not create case directory: " + caseDir + " for case: " + caseName);
+                throw new CaseActionException("Could not create case directory: " + caseDir );
             }
 
             final String modulesOutDir = caseDir + File.separator + getModulesOutputDirRelPath();
             result = new File(modulesOutDir).mkdir();
             if (result == false) {
-                throw new CaseActionException("Could not create modules output directory: " + modulesOutDir + " for case: " + caseName);
+                throw new CaseActionException("Could not create modules output directory: " + modulesOutDir );
             }
 
         } catch (Exception e) {
-            throw new CaseActionException("Could not create case directory: " + caseDir + " for case: " + caseName, e);
+            throw new CaseActionException("Could not create case directory: " + caseDir , e);
         }
     }
 

Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java

@@ -228,7 +228,7 @@ class NewCaseWizardPanel1 implements WizardDescriptor.ValidatingPanel<WizardDesc
                         if (res2 != null && res2 == DialogDescriptor.YES_OPTION) {
                             // if user say yes
                             try {
-                                createDirectory(caseDirPath, caseName);
+                                createDirectory(caseDirPath);
                             } catch (Exception ex) {
                                 String errorMsg = "Error: Couldn't create case parent directory " + caseParentDir;
                                 logger.log(Level.WARNING, errorMsg, ex);
@@ -241,7 +241,7 @@ class NewCaseWizardPanel1 implements WizardDescriptor.ValidatingPanel<WizardDesc
                         }
                     } else {
                         try {
-                            createDirectory(caseDirPath, caseName);
+                            createDirectory(caseDirPath);
                         } catch (Exception ex) {
                             String errorMsg = "Error: Couldn't create directory.";
                             logger.log(Level.WARNING, errorMsg, ex);
@@ -264,11 +264,11 @@ class NewCaseWizardPanel1 implements WizardDescriptor.ValidatingPanel<WizardDesc
     /*
      * create the directory and create a new case
      */
-    private void createDirectory(final String caseDirPath, final String caseName) throws WizardValidationException {
+    private void createDirectory(final String caseDirPath) throws WizardValidationException {
         // try to create the directory with the case name in the choosen parent directory
         boolean success = false;
         try {
-            Case.createCaseDirectory(caseDirPath, caseName);
+            Case.createCaseDirectory(caseDirPath);
             success = true;
         } catch (CaseActionException ex) {
             logger.log(Level.SEVERE, "Could not createDirectory for the case, ", ex);

Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java

@@ -197,7 +197,8 @@ public class FileManager implements Closeable {
     }
 
     /**
-     * Interface for receiving notifications on folders being added via a callback
+     * Interface for receiving notifications on folders being added via a
+     * callback
      */
     public interface FileAddProgressUpdater {
 
@@ -304,12 +305,18 @@ public class FileManager implements Closeable {
         if (isDir) {
             //create virtual folder
             final VirtualDirectory childVd = tskCase.addVirtualDirectory(parentVd.getId(), childLocalFile.getName());
-            if (childVd != null && addProgressUpdater != null ) {
+            if (childVd != null && addProgressUpdater != null) {
                 addProgressUpdater.fileAdded(childVd);
             }
             //add children recursively
-            for (java.io.File childChild : childLocalFile.listFiles()) {
-                addLocalDirectoryRecInt(childVd, childChild, addProgressUpdater);
+            final java.io.File[] childrenFiles = childLocalFile.listFiles();
+            if (childrenFiles != null) {
+                for (java.io.File childChild : childrenFiles) {
+                    addLocalDirectoryRecInt(childVd, childChild, addProgressUpdater);
+                }
+            } else {
+                //add leaf file, base case
+                this.addLocalFileSingle(childLocalFile.getAbsolutePath(), parentVd);
             }
         } else {
             //add leaf file, base case
@@ -428,7 +435,7 @@ public class FileManager implements Closeable {
      * closed
      *
      */
-    private synchronized LocalFile addLocalFileSingle(String localAbsPath, AbstractFile parentFile ) throws TskCoreException {
+    private synchronized LocalFile addLocalFileSingle(String localAbsPath, AbstractFile parentFile) throws TskCoreException {
 
         if (tskCase == null) {
             throw new TskCoreException("Attempted to use FileManager after it was closed.");

Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java

@@ -348,6 +348,11 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat
         outputViewPane.setContentType("text/html");
     }
 
+    /**
+     * Display a single artifact from a list. 
+     * @param artifacts List of artifacts that could be displayed
+     * @param offset Index into the list for the artifact to display
+     */
     private void setDataView(List<BlackboardArtifact> artifacts, int offset) {
         // change the cursor to "waiting cursor" for this operation
         this.setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
@@ -377,6 +382,10 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat
         this.setCursor(null);
     }
     
+    /**
+     * Set the displayed artifact to the specified one.
+     * @param artifact Artifact to display
+     */
     private void setSelectedArtifact(BlackboardArtifact artifact) {
         if(artifacts.contains(artifact)) {
             int index = artifacts.indexOf(artifact);

Core/src/org/sleuthkit/autopsy/coreutils/PlatformUtil.java

@@ -141,6 +141,27 @@ public class PlatformUtil {
     public static File getUserDirectory() {
         return Places.getUserDirectory();
     }
+    
+    /**
+     * Get RCP project dirs 
+     * @return 
+     */
+    public static List<String> getProjectsDirs() {
+        List<String> ret = new ArrayList<String>();
+        String projectDir = System.getProperty("netbeans.dirs");
+        if (projectDir == null) {
+            return ret;
+        }
+        String [] split = projectDir.split(";");
+        if (split == null || split.length == 0) {
+            return ret;
+        }
+        for (String path : split) {
+            ret.add(path);
+        }
+         
+         return ret;
+    }
 
     /**
      * Get user config directory path

Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2011 Basis Technology Corp.
+ * Copyright 2011-2013 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -33,8 +33,7 @@ import org.sleuthkit.datamodel.TskException;
 
 /**
  * StringContent object for a blackboard artifact, that can be looked up and used
- * to display text for the DataContent viewers
- * @author alawrence
+ * to display text for the DataContent viewers.  Displays values in artifact in HTML.
  */
 public class ArtifactStringContent implements StringContent {
 
@@ -54,21 +53,32 @@ public class ArtifactStringContent implements StringContent {
             buffer.append("<head>");
             buffer.append("<style type='text/css'>");
             buffer.append("table {table-layout:fixed;}");
-            buffer.append("td {font-family:Arial;font-size:10pt;overflow:hidden;padding-right:5px;padding-left:5px;}");
-            buffer.append("th {font-family:Arial;font-size:10pt;overflow:hidden;padding-right:5px;padding-left:5px;font-weight:bold;}");
-            buffer.append("p {font-family:Arial;font-size:10pt;}");
+            buffer.append("td {font-family:Arial;font-size:12pt;overflow:hidden;padding-right:5px;padding-left:5px;}");
+            buffer.append("th {font-family:Arial;font-size:12pt;overflow:hidden;padding-right:5px;padding-left:5px;font-weight:bold;}");
+            buffer.append("p {font-family:Arial;font-size:12pt;}");
             buffer.append("</style>");
+            buffer.append("<meta http-equiv=\"Content-Type\" content=\"text/html); charset=utf-8\">");
             buffer.append("</head>");
+            
+            // artifact name header
             buffer.append("<h4>");
             buffer.append(wrapped.getDisplayName());
             buffer.append("</h4>");
+            
+            // start table for attributes
             buffer.append("<table border='0'>");
             buffer.append("<tr>");
             buffer.append("</tr>");
+            
+            // cycle through each attribute and display in a row in the table. 
             for (BlackboardAttribute attr : wrapped.getAttributes()) {
+                
+                // name column
                 buffer.append("<tr><td>");
                 buffer.append(attr.getAttributeTypeDisplayName());
                 buffer.append("</td>");
+                
+                // value column
                 buffer.append("<td>");
                 if (attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()
                         || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) {
@@ -82,7 +92,12 @@ public class ArtifactStringContent implements StringContent {
                 } else {
                     switch (attr.getValueType()) {
                         case STRING:
-                            buffer.append(attr.getValueString());
+                            String str = attr.getValueString();
+                            str = str.replaceAll(" ", "&nbsp;");
+                            str = str.replaceAll("<", "&lt;");
+                            str = str.replaceAll(">", "&gt;");
+                            str = str.replaceAll("(\r\n|\n)", "<br />");
+                            buffer.append(str);
                             break;
                         case INTEGER:
                             buffer.append(attr.getValueInt());
@@ -113,16 +128,11 @@ public class ArtifactStringContent implements StringContent {
             try {
                 path = content.getUniquePath();
             } catch (TskCoreException ex) {
-                logger.log(Level.SEVERE, "Except while calling Content.getUniquePath() on " + content);
+                logger.log(Level.SEVERE, "Exception while calling Content.getUniquePath() on {0} : {1}", new Object[]{content, ex.getLocalizedMessage()});
             }
             
             //add file path
-            buffer.append("<tr>");
-            buffer.append("<td>Source File</td>");
-            buffer.append("<td>");
-            buffer.append(content.getName());
-            buffer.append("</td>");
-            buffer.append("</tr>");
+
             buffer.append("<tr>");
             buffer.append("<td>Source File Path</td>");
             buffer.append("<td>");

Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java

@@ -30,7 +30,8 @@ import org.sleuthkit.datamodel.SleuthkitCase;
 import org.sleuthkit.datamodel.TskException;
 
 /**
- * Node encapsulating blackboard artifact type
+ * Node encapsulating blackboard artifact type.  This is used on the left-hand navigation side of the Autopsy UI as the
+ * parent node for all of the artifacts of a given type. Its children will be BlackboardArtifactNode objects. 
  */
 public class ArtifactTypeNode extends DisplayableItemNode {
 
@@ -82,6 +83,7 @@ public class ArtifactTypeNode extends DisplayableItemNode {
         return v.visit(this);
     }
 
+    // @@@ TODO: Merge with BlackboartArtifactNode.getIcon()
     private String getIcon(BlackboardArtifact.ARTIFACT_TYPE type) {
         switch (type) {
             case TSK_WEB_BOOKMARK:

Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java

@@ -36,7 +36,8 @@ import org.sleuthkit.datamodel.TskCoreException;
 import org.sleuthkit.datamodel.TskException;
 
 /**
- * Node wrapping a blackboard artifact object
+ * Node wrapping a blackboard artifact object.  This represents a single artifact. 
+ * Its parent is typically an ArtifactTypeNode.
  */
 public class BlackboardArtifactNode extends DisplayableItemNode {
 
@@ -259,6 +260,7 @@ public class BlackboardArtifactNode extends DisplayableItemNode {
         return null;
     }
 
+    // @@@ TODO: Merge with ArtifactTypeNode.getIcon()
     private String getIcon(BlackboardArtifact.ARTIFACT_TYPE type) {
         switch (type) {
             case TSK_WEB_BOOKMARK:

Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java

@@ -21,7 +21,8 @@ package org.sleuthkit.autopsy.datamodel;
 import org.sleuthkit.datamodel.SleuthkitCase;
 
 /**
- * Parent of all Blackboard Artifacts to be displayed
+ * Parent of the "extracted content" artifacts to be displayed in the tree.  Other
+ * artifacts are displayed under other more specific parents. 
  */
 public class ExtractedContent implements AutopsyVisitableItem{
 

Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContentChildren.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  * 
- * Copyright 2011 Basis Technology Corp.
+ * Copyright 2011-2013 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,41 +18,63 @@
  */
 package org.sleuthkit.autopsy.datamodel;
 
+import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
 import java.util.List;
+import java.util.logging.Level;
 import org.openide.nodes.ChildFactory;
 import org.openide.nodes.Node;
+import org.openide.util.Exceptions;
+import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.SleuthkitCase;
+import org.sleuthkit.datamodel.TskCoreException;
 
 /**
- *
+ * Creates the children for the ExtractedContent area of the results tree.  This area
+ * has all of the blackboard artifacts that are not displayed in a more specific form elsewhere
+ * in the tree.
  */
 public class ExtractedContentChildren extends ChildFactory<BlackboardArtifact.ARTIFACT_TYPE> {
-    
     private SleuthkitCase skCase;
-
+    private final ArrayList<BlackboardArtifact.ARTIFACT_TYPE> doNotShow;
+    
     public ExtractedContentChildren(SleuthkitCase skCase) {
         super();
         this.skCase = skCase;
+        
+        // these are shown in other parts of the UI tree
+        doNotShow = new ArrayList();
+        //doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO);
+        doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
+        doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
+        doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT);
+        doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT);
+        doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE);
     }
 
     @Override
     protected boolean createKeys(List<BlackboardArtifact.ARTIFACT_TYPE> list) {
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY);
-        list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF);
+        try {
+            List<BlackboardArtifact.ARTIFACT_TYPE> inUse = skCase.getBlackboardArtifactTypesInUse();
+            inUse.removeAll(doNotShow);
+            Collections.sort(inUse,
+                    new Comparator<BlackboardArtifact.ARTIFACT_TYPE>() {
+                        @Override
+                        public int compare(BlackboardArtifact.ARTIFACT_TYPE a, BlackboardArtifact.ARTIFACT_TYPE b) {
+                            return a.getDisplayName().compareTo(b.getDisplayName());
+                        }
+                    });
+            list.addAll(inUse);
+        } catch (TskCoreException ex) {
+            Logger.getLogger(ExtractedContentChildren.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage());
+            return false;
+        }
         return true;
     }
 
-  
-    
     
     @Override
     protected Node createNodeForKey(BlackboardArtifact.ARTIFACT_TYPE key){

Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContentNode.java

@@ -25,7 +25,7 @@ import org.openide.util.lookup.Lookups;
 import org.sleuthkit.datamodel.SleuthkitCase;
 
 /**
- * Node for the extracted content
+ * Node for the extracted content artifacts (artifacts that are not shown in more specific areas of the tree)
  */
 public class ExtractedContentNode extends DisplayableItemNode {
 

Core/src/org/sleuthkit/autopsy/ingest/IngestModuleLoader.java

@@ -442,6 +442,16 @@ public final class IngestModuleLoader {
 
         //user modules
         urls.addAll(getJarPaths(PlatformUtil.getUserModulesPath()));
+        
+        // add other project dirs, such as from external modules
+        for (String projectDir : PlatformUtil.getProjectsDirs()) {
+            File modules = new File(projectDir + File.separator + "modules");
+            if (modules.exists()) {
+                urls.addAll(getJarPaths(modules.getAbsolutePath()));
+            }
+        }
+        
+        
 
         return urls;
     }

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQueryManager.java

@@ -34,8 +34,8 @@ import org.sleuthkit.autopsy.datamodel.KeyValue;
 import org.sleuthkit.autopsy.keywordsearch.KeywordSearch.QueryType;
 
 /**
- * Query manager responsible for running appropriate queries and displaying results
- * for single, multi keyword queries, with detailed or collapsed results
+ * Query manager responsible for running appropriate queries and displaying
+ * results for single, multi keyword queries, with detailed or collapsed results
  */
 public class KeywordSearchQueryManager {
 
@@ -59,7 +59,7 @@ public class KeywordSearchQueryManager {
 
     public KeywordSearchQueryManager(String query, QueryType qt, Presentation presentation) {
         queries = new ArrayList<Keyword>();
-        queries.add(new Keyword(query, qt==QueryType.REGEX?false:true));
+        queries.add(new Keyword(query, qt == QueryType.REGEX ? false : true));
         this.presentation = presentation;
         queryType = qt;
         init();
@@ -69,7 +69,7 @@ public class KeywordSearchQueryManager {
         queries = new ArrayList<Keyword>();
         queries.add(new Keyword(query, isLiteral));
         this.presentation = presentation;
-        queryType = isLiteral?QueryType.WORD:QueryType.REGEX;
+        queryType = isLiteral ? QueryType.WORD : QueryType.REGEX;
         init();
     }
 
@@ -112,15 +112,21 @@ public class KeywordSearchQueryManager {
         //Collapsed view
         Collection<KeyValueQuery> things = new ArrayList<KeyValueQuery>();
         int queryID = 0;
+        StringBuilder queryConcat = new StringBuilder();
         for (KeywordSearchQuery q : queryDelegates) {
             Map<String, Object> kvs = new LinkedHashMap<String, Object>();
             final String queryStr = q.getQueryString();
+            queryConcat.append(queryStr).append(" ");
             things.add(new KeyValueQuery(queryStr, kvs, ++queryID, q));
         }
 
         Node rootNode = null;
 
-        DataResultTopComponent searchResultWin = DataResultTopComponent.createInstance("Keyword search " + (++resultWindowCount));
+        String queryConcatStr = queryConcat.toString();
+        final int queryConcatStrLen = queryConcatStr.length();
+        final String queryStrShort = queryConcatStrLen > 15 ? queryConcatStr.substring(0, 14) + "..." : queryConcatStr;
+        final String windowTitle = "Keyword search " + (++resultWindowCount) + " - " + queryStrShort;
+        DataResultTopComponent searchResultWin = DataResultTopComponent.createInstance(windowTitle);
         if (things.size() > 0) {
             Children childThingNodes =
                     Children.create(new KeywordSearchResultFactory(queries, things, Presentation.COLLAPSE, searchResultWin), true);
@@ -131,9 +137,9 @@ public class KeywordSearchQueryManager {
         }
 
         final String pathText = "Keyword search";
-        
+
         DataResultTopComponent.initInstance(pathText, rootNode, things.size(), searchResultWin);
-        
+
         searchResultWin.requestActive();
         // }
     }
@@ -152,7 +158,7 @@ public class KeywordSearchQueryManager {
 }
 
 /**
- * custom KeyValue that also stores query object  to execute
+ * custom KeyValue that also stores query object to execute
  */
 class KeyValueQuery extends KeyValue {
 

NEWS.txt

@@ -1,3 +1,15 @@
+---------------- VERSION Current (development)  --------------
+
+New features:
+
+
+Improvements:
+
+
+Bugfixes:
+
+
+
 ---------------- VERSION 3.0.6  --------------
 
 New features:

RecentActivity/release/rr-full/faq

@@ -0,0 +1,60 @@
+RegRipper FAQ
+
+This is the FAQ for the RegRipper. 
+
+1.  What is the RegRipper?
+I should start by saying what the RegRipper is *not*...it's not
+a Registry Viewer.  An examiner would not open a Registry hive file
+in RegRipper to "look around".  
+
+Further, RegRipper is NOT intended for use with live hive files.  Hive
+files need to be extracted from a case (or from a live system using FTK
+Imager...), or accessible via a tool such as Mount Image Pro.
+
+RegRipper is a Windows Registry data extractor.  RegRipper uses plugins
+(similar to Nessus) to access specific Registry hive files in order to 
+access and extract specific keys, values, and data, and does so by 
+bypassing the Win32API.  
+
+2.  How does RegRipper work?
+RegRipper uses James McFarlane's Parse::Win32Registry module to access 
+a Windows Registry hive file in an object-oriented manner, bypassing the
+Win32API.  This module is used to locate and access Registry key nodes
+within the hive file, as well as value nodes and their data.  When 
+accessing a key node, the LastWrite time is retrieved, parsed and 
+translated into something the examiner can understand.  Data is retrieved
+in much the same manner...if necessary, the plugin that retrieves the
+data will also perform translation of that data into something readable.
+
+3.  Who wrote and maintains RegRipper?
+I did/do.  If you have any questions, concerns, comments, or suggestions 
+regarding how RegRipper works, please feel free to contact me.
+
+4.  Who should/can use RegRipper?
+Anyone who wants to perform Windows Registry hive file analysis.  This tool
+is specifically intended for Windows 2000, XP, and 2003 hive files (there
+has been limited testing on Vista/Win2K8 hive files...everything has worked
+fine so far...).
+
+5.  How do I use RegRipper?
+Simply launch rr.exe.  Also, please be sure to read the RegRipper documentation.
+
+6.  Do I have to install anything to use the RegRipper?
+Nope, not a thing.  RegRipper ships as an EXE file, able to run on Windows
+systems.  All you need to do is extract the EXE and DLL in the same directory.
+The source file (rr.pl) is also included, as are the plugins.
+
+Further, RegRipper doesn't make any changes to your analysis system...no 
+Registry entries are made, nor are any files installed in odd, out-of-the-way
+locations.
+
+Links
+Module - http://search.cpan.org/~jmacfarla/Parse-Win32Registry/lib/
+                Parse/Win32Registry.pm
+                
+Email - H. Carvey - keydet89@yahoo.com
+
+RegRipper and rip.exe are released under the GPL license.  Please see license.txt
+for details.
+
+RegRipper and rip.exe are copyrighted to H. Carvey.

RecentActivity/release/rr-full/license.txt

@@ -0,0 +1,12 @@
+This software is released AS-IS, with no statements or guarantees as to 
+its effectiveness or stability.  While it shouldn't cause any problems 
+whatsoever with your system, there's always the chance that someone may find
+a way to blame a system crash or loss of data on software like this...you've
+been warned!
+
+This software is released under the GNU Public License - 
+http://www.gnu.org/copyleft/gpl.html
+
+Specifically, GPL v3.0: http://www.gnu.org/licenses/quick-guide-gplv3.html
+
+Questions, comments, etc., can be sent to keydet89 at yahoo dot com.

RecentActivity/release/rr-full/pb.pl

@@ -0,0 +1,314 @@
+#! c:\perl\bin\perl.exe
+#-----------------------------------------------------------
+# Plugins Browser - browse plugins, create plugins files, edit
+#                   current files
+#
+#
+# Change History
+#   20100122 - Updated to include opening a plugins file
+#   20091207 - Created
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+use strict;
+use Win32::GUI();
+use Win32::GUI::Constants qw(CW_USEDEFAULT);
+use Encode;
+
+my $plugindir;
+
+my $mw = Win32::GUI::Window->new(
+    -title => "Plugin Browser",
+    -left  => CW_USEDEFAULT,
+    -size  => [560,440],
+    -maxsize => [560,440],
+    -dialogui => 1,
+);
+
+my $icon = new Win32::GUI::Icon('QAR.ICO');
+$mw->SetIcon($icon);
+
+$mw->AddLabel(
+	-text => "",
+	-name => "biglabel1",
+	-pos => [10,10],
+	-size => [530,40],
+	-sunken => 1
+);
+
+$mw->AddLabel(
+	-text => "Plugin Dir: ",
+	-pos  => [20,23],
+
+);
+
+my $plugindirtext = $mw->AddTextfield(
+	-name     => "plugindir",
+  -tabstop  => 1,
+  -left     => 100,
+  -top      => 18,
+  -width    => 300,
+  -height   => 25,
+  -tabstop  => 1,
+  -foreground => "#000000",
+  -background => "#FFFFFF"
+);
+
+my $browse = $mw->AddButton(
+	-name    => 'browse',
+  -text    => 'Browse',
+  -size    => [50,25],
+  -pos     => [450,18],
+);
+
+my $datatab = $mw->AddTabStrip(
+	-pos => [10,60],
+	-size => [530,280],
+	-name => "datatab"
+);
+
+$datatab->InsertItem(-text => "Browse");
+$datatab->InsertItem(-text => "Plugin File");
+
+my $lb1 = $mw->AddListbox(
+    -name    => 'LB1',
+    -pos     => [20,100],
+    -size    => [180,240],
+    -multisel => 2,
+    -vscroll => 1
+);
+
+my $gb1 = $mw->AddGroupbox(
+    -name  => 'GB',
+    -title => 'Plugin Info',
+    -pos   => [260,100],
+    -size  => [260,220],
+);
+
+my $gblbl = $mw->AddLabel(
+    -name   => 'LBL',
+    -left   => $mw->GB->Left()+10,
+    -top    => $mw->GB->Top()+20,
+    -width  => $mw->GB->ScaleWidth()-20,
+    -height => $mw->GB->ScaleHeight()-40,
+);
+
+# The following elements go on the "Plugin File" tab and
+# are initially hidden
+my $lb2 = $mw->AddListbox(
+    -name    => 'LB2',
+    -pos     => [320,100],
+    -size    => [200,240],
+    -vscroll => 1,
+    -multisel => 2
+#    -onSelChange => \&newSelection,
+);
+$lb2->Hide();
+
+my $add = $mw->AddButton(
+    -name    => 'Add',
+    -text    => '>>',
+    -tip     => "Add Plugin",
+    -size    => [50,25],
+    -pos     => [230,130],
+);
+$add->Hide();
+
+my $remove = $mw->AddButton(
+    -name    => 'Remove',
+    -text    => '<<',
+    -tip     => "Remove Plugin",
+    -size    => [50,25],
+    -pos     => [230,180],
+);
+$remove->Hide();
+
+my $open = $mw->AddButton(
+    -name    => 'Open',
+    -tip     => "Open Plugin File",
+    -text    => 'Open',
+    -size    => [50,25],
+    -pos     => [230,230],
+);
+$open->Hide();
+
+my $save = $mw->AddButton(
+    -name    => 'Save',
+    -tip     => "Save Plugin File",
+    -text    => 'Save',
+    -size    => [50,25],
+    -pos     => [230,280],
+);
+$save->Hide();
+
+$mw->AddButton(
+    -name    => 'BT',
+    -text    => 'Exit',
+    -size    => [50,25],
+    -pos     => [450,350],
+    -onClick => sub{-1;},
+);
+
+my $status = new Win32::GUI::StatusBar($mw,
+		-text  => "copyright 2010 Quantum Analytics Research, LLC",
+);
+
+$mw->Show();
+Win32::GUI::Dialog();
+$mw->Hide();
+exit(0);
+
+sub datatab_Click {
+	if ($datatab->SelectedItem == 0) {
+		$lb2->Hide();
+		$add->Hide();
+		$remove->Hide();
+		$open->Hide();
+		$save->Hide();
+		$gb1->Show();
+		$gblbl->Show();
+	}
+	
+	if ($datatab->SelectedItem == 1) {
+		$lb2->Show();
+		$add->Show();
+		$remove->Show();
+		$open->Show();
+		$save->Show();
+		$gb1->Hide();
+		$gblbl->Hide();
+	}
+}
+
+sub browse_Click {
+	$plugindir = Win32::GUI::BrowseForFolder(
+  							-title => "Report Dir",
+                -root => 0x0011,
+                -folderonly => 1,
+                -includefiles => 0,
+        );
+	$plugindir = $plugindir."\\" unless $plugindir =~ m/\\$/;
+	$plugindirtext->Text("");
+  $plugindirtext->Text($plugindir);
+  
+  $mw->LB1->ResetContent();
+	my @plugins;
+	opendir(DIR,$plugindir);
+	push(@plugins, grep(/\.pl$/,readdir(DIR)));
+	closedir(DIR);
+	$mw->LB1->Add(sort @plugins);
+  0;
+}
+
+sub LB1_SelChange {
+	if ($datatab->SelectedItem == 0) {
+		\&newSelection();
+	}	
+}
+
+sub newSelection {
+	my $lb = shift;
+# Set the label text to reflect the change
+	my $item = $lb1->GetCurSel();
+	my $text = $lb1->GetText($item);
+	$lb1->GetParent()->LBL->Text(get_plugin_info($text));
+	return 1;
+}
+	
+sub get_plugin_info {
+	my $name = shift;
+	require $plugindir."\\".$name;
+	$name =~ s/\.pl$//;
+	my $text = "Plugin Name:  ".$name."\r\n";
+	eval {
+		$text .= "Version: ".$name->getVersion."\r\n";
+	};
+	
+	eval {
+		$text .= "Hive   : ".$name->getHive."\r\n\r\n";
+	};
+	
+	eval {
+		$text .= "Descr  : \r\n";
+		$text .= $name->getShortDescr."\r\n";
+	};
+	return $text;
+}
+
+sub Add_Click {
+	my @list = $lb1->SelectedItems();
+	foreach my $i (sort {$a <=> $b} @list) {
+		my $str = $lb1->GetString($i);
+		$str =~ s/\.pl$//;
+		$lb2->InsertString($str);
+	}
+}
+
+#-----------------------------------------------------------
+# Note regarding use of DeleteString(); if starting from index
+# 0 and increasing, the index changes so that after the first 
+# index item is deleted, the second index item is reset.  To
+# avoid this issue, reverse the order of the indexes.
+#-----------------------------------------------------------
+sub Remove_Click {
+	my @list = $lb2->SelectedItems();
+	foreach my $i (reverse @list) {
+		$lb2->DeleteString($i);
+	}
+}
+
+sub Save_Click {
+	my $file = Win32::GUI::GetSaveFileName(
+		-owner => $mw,
+		-title => "Save Plugin File",
+		-explorer => 1,
+		-directory => $plugindir,
+		-filter => ['All files' => '*.*']
+	);
+	
+	if ($file) {
+  	$file =~ s/\.\w+$//;
+  }
+  elsif (Win32::GUI::CommDlgExtendedError()) {
+     $mw->MessageBox ("ERROR : ".Win32::GUI::CommDlgExtendedError(),
+                        "GetSaveFileName Error");
+  }
+  
+  open(FH,">",$file);
+  print FH "# Plugin file created via Plugin Browser\n";
+  print FH "# Date: ".localtime(time)."\n";
+  print FH "# User: ".$ENV{USERNAME}."\n";
+  print FH "#\n";
+  print FH "\n";  
+  my $count = $lb2->GetCount();
+  foreach my $i (0..$count - 1) {
+  	my $str = $lb2->GetString($i);
+  	print FH $str."\n";
+  }
+  close(FH); 
+  $lb2->ResetContent(); 
+  0;
+}
+
+sub Open_Click {
+	my $file = Win32::GUI::GetOpenFileName(
+		-owner => $mw,
+		-title => "Open Plugin File",
+		-explorer => 1,
+		-directory => $plugindir,
+		-filter => ['All files' => '*.*']
+	);
+	
+	if ($file) {
+  	open(FH,"<",$file);
+  	while(<FH>) {
+  		chomp;
+  		$lb2->InsertString($_);
+  	}
+  	close(FH);
+  }
+  elsif (Win32::GUI::CommDlgExtendedError()) {
+     $mw->MessageBox ("ERROR : ".Win32::GUI::CommDlgExtendedError(),
+                        "GetSaveFileName Error");
+  }
+}

RecentActivity/release/rr-full/plugins/acmru.pl

@@ -1,72 +1,74 @@
-#-----------------------------------------------------------
-# acmru.pl
-# Plugin for Registry Ripper, NTUSER.DAT edition - gets the 
-# ACMru values 
-#
-# Change history
-#
-#
-# References
-#
-# 
-# copyright 2008 H. Carvey
-#-----------------------------------------------------------
-package acmru;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20080324);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets contents of user's ACMru key";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching acmru v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Software\\Microsoft\\Search Assistant\\ACMru';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("ACMru - Search Assistant");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) { 
-				::rptMsg($s->get_name()." [".gmtime($s->get_timestamp())." (UTC)]");
-				my @vals = $s->get_list_of_values();
-				my %ac_vals;
-				foreach my $v (@vals) {
-					$ac_vals{$v->get_name()} = $v->get_data();
-				}
-				foreach my $a (sort {$a <=> $b} keys %ac_vals) {
-					::rptMsg("\t".$a." -> ".$ac_vals{$a});
-				}
-				::rptMsg("");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# acmru.pl
+# Plugin for Registry Ripper, NTUSER.DAT edition - gets the 
+# ACMru values 
+#
+# Change history
+#
+#
+# References
+#
+# 
+# copyright 2008 H. Carvey
+#-----------------------------------------------------------
+package acmru;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20080324);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's ACMru key";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching acmru v.".$VERSION);
+	::rptMsg("acmru v.".$VERSION); # banner
+    ::rptMsg("- ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\Search Assistant\\ACMru';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("ACMru - Search Assistant");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) { 
+				::rptMsg($s->get_name()." [".gmtime($s->get_timestamp())." (UTC)]");
+				my @vals = $s->get_list_of_values();
+				my %ac_vals;
+				foreach my $v (@vals) {
+					$ac_vals{$v->get_name()} = $v->get_data();
+				}
+				foreach my $a (sort {$a <=> $b} keys %ac_vals) {
+					::rptMsg("\t".$a." -> ".$ac_vals{$a});
+				}
+				::rptMsg("");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/adoberdr.pl

@@ -1,93 +1,96 @@
-#-----------------------------------------------------------
-# adoberdr.pl
-# Plugin for Registry Ripper 
-# Parse Adobe Reader MRU keys
-#
-# Change history
-#   20100218 - added checks for versions 4.0, 5.0, 9.0
-#   20091125 - modified output to make a bit more clear
-#
-# References
-#
-# Note: LastWrite times on c subkeys will all be the same,
-#       as each subkey is modified as when a new entry is added
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package adoberdr;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20100218);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets user's Adobe Reader cRecentFiles values";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching adoberdr v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-	::rptMsg("Adoberdr v.".$VERSION);
-# First, let's find out which version of Adobe Acrobat Reader is installed
-	my $version;
-	my $tag = 0;
-	my @versions = ("4\.0","5\.0","6\.0","7\.0","8\.0","9\.0");
-	foreach my $ver (@versions) {		
-		my $key_path = "Software\\Adobe\\Acrobat Reader\\".$ver."\\AVGeneral\\cRecentFiles";
-		if (defined($root_key->get_subkey($key_path))) {
-			$version = $ver;
-			$tag = 1;
-		}
-	}
-	
-	if ($tag) {
-		::rptMsg("Adobe Acrobat Reader version ".$version." located."); 
-		my $key_path = "Software\\Adobe\\Acrobat Reader\\".$version."\\AVGeneral\\cRecentFiles";   
-		my $key = $root_key->get_subkey($key_path);
-		if ($key) {
-			::rptMsg($key_path);
-			::rptMsg("");
-#			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-			my %arkeys;
-			my @subkeys = $key->get_list_of_subkeys();
-			if (scalar @subkeys > 0) {
-				foreach my $s (@subkeys) {
-					my $num = $s->get_name();
-					my $data = $s->get_value('sDI')->get_data();
-					$num =~ s/^c//;
-					$arkeys{$num}{lastwrite} = $s->get_timestamp();
-					$arkeys{$num}{data} = $data;
-				}
-				::rptMsg("Most recent PDF opened: ".gmtime($arkeys{1}{lastwrite})." (UTC)");
-				foreach my $k (sort keys %arkeys) {
-					::rptMsg("  c".$k."   ".$arkeys{$k}{data});
-				}
-			}
-			else {
-				::rptMsg($key_path." has no subkeys.");
-			}
-		}
-		else {
-			::rptMsg("Could not access ".$key_path);
-		}
-	}
-	else {
-		::rptMsg("Adobe Acrobat Reader version not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# adoberdr.pl
+# Plugin for Registry Ripper 
+# Parse Adobe Reader MRU keys
+#
+# Change history
+#   20120716 - added version 10.0 to @versions
+#   20100218 - added checks for versions 4.0, 5.0, 9.0
+#   20091125 - modified output to make a bit more clear
+#
+# References
+#
+# Note: LastWrite times on c subkeys will all be the same,
+#       as each subkey is modified as when a new entry is added
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package adoberdr;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120716);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets user's Adobe Reader cRecentFiles values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching adoberdr v.".$VERSION);
+	::rptMsg("adoberdr v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+	::rptMsg("Adoberdr v.".$VERSION);
+# First, let's find out which version of Adobe Acrobat Reader is installed
+	my $version;
+	my $tag = 0;
+	my @versions = ("4\.0","5\.0","6\.0","7\.0","8\.0","9\.0","10\.0");
+	foreach my $ver (@versions) {		
+		my $key_path = "Software\\Adobe\\Acrobat Reader\\".$ver."\\AVGeneral\\cRecentFiles";
+		if (defined($root_key->get_subkey($key_path))) {
+			$version = $ver;
+			$tag = 1;
+		}
+	}
+	
+	if ($tag) {
+		::rptMsg("Adobe Acrobat Reader version ".$version." located."); 
+		my $key_path = "Software\\Adobe\\Acrobat Reader\\".$version."\\AVGeneral\\cRecentFiles";   
+		my $key = $root_key->get_subkey($key_path);
+		if ($key) {
+			::rptMsg($key_path);
+			::rptMsg("");
+#			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+			my %arkeys;
+			my @subkeys = $key->get_list_of_subkeys();
+			if (scalar @subkeys > 0) {
+				foreach my $s (@subkeys) {
+					my $num = $s->get_name();
+					my $data = $s->get_value('sDI')->get_data();
+					$num =~ s/^c//;
+					$arkeys{$num}{lastwrite} = $s->get_timestamp();
+					$arkeys{$num}{data} = $data;
+				}
+				::rptMsg("Most recent PDF opened: ".gmtime($arkeys{1}{lastwrite})." (UTC)");
+				foreach my $k (sort keys %arkeys) {
+					::rptMsg("  c".$k."   ".$arkeys{$k}{data});
+				}
+			}
+			else {
+				::rptMsg($key_path." has no subkeys.");
+			}
+		}
+		else {
+			::rptMsg("Could not access ".$key_path);
+		}
+	}
+	else {
+		::rptMsg("Adobe Acrobat Reader version not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/aim.pl

@@ -1,95 +1,97 @@
-#-----------------------------------------------------------
-# aim
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package aim;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20080325);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets info from the AOL Instant Messenger (not AIM) install";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching aim plugin v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-	my $key_path = 'Software\\America Online\\AOL Instant Messenger (TM)\\CurrentVersion\\Users';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("AIM");
-		::rptMsg($key_path);
-		::rptMsg("");
-		
-		my @subkeys = $key->get_list_of_subkeys();
-		
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) { 
-				my $user = $s->get_name();
-				::rptMsg("User: $user  [".gmtime($s->get_timestamp())."]");
-				
-				my $login = "Login";
-				my $recent  = "recent IM ScreenNames";
-				my $recent2 = "recent ScreenNames";
-				
-				my @userkeys = $s->get_list_of_subkeys();
-				foreach my $u (@userkeys) {
-					my $us = $u->get_name();
-# See if we can get the encrypted password
-					if ($us =~ m/^$login/) {
-						my $pwd = "";
-						eval {
-							$pwd = $u->get_value("Password1")->get_data();
-						};
-						::rptMsg("Pwd: ".$pwd) if ($pwd ne "");
-					}
-# See if we can get recent folks they've chatted with...					
-					if ($us eq $recent || $us eq $recent2) {
-						
-						my @vals = $u->get_list_of_values();
-						if (scalar(@vals) > 0) {
-							::rptMsg($user."\\".$us);
-							my %sns;
-							foreach my $v (@vals) {
-								$sns{$v->get_name()} = $v->get_data();
-							}
-							
-							foreach my $i (sort {$a <=> $b} keys %sns) {
-								::rptMsg("\t\t".$i." -> ".$sns{$i});
-							}
-						}
-						else {
-# No values							
-						}
-					}
-				}
-				::rptMsg("");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-			::logMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# aim
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package aim;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20080325);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets info from the AOL Instant Messenger (not AIM) install";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching aim plugin v.".$VERSION);
+	::rptMsg("aim v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key_path = 'Software\\America Online\\AOL Instant Messenger (TM)\\CurrentVersion\\Users';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("AIM");
+		::rptMsg($key_path);
+		::rptMsg("");
+		
+		my @subkeys = $key->get_list_of_subkeys();
+		
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) { 
+				my $user = $s->get_name();
+				::rptMsg("User: $user  [".gmtime($s->get_timestamp())."]");
+				
+				my $login = "Login";
+				my $recent  = "recent IM ScreenNames";
+				my $recent2 = "recent ScreenNames";
+				
+				my @userkeys = $s->get_list_of_subkeys();
+				foreach my $u (@userkeys) {
+					my $us = $u->get_name();
+# See if we can get the encrypted password
+					if ($us =~ m/^$login/) {
+						my $pwd = "";
+						eval {
+							$pwd = $u->get_value("Password1")->get_data();
+						};
+						::rptMsg("Pwd: ".$pwd) if ($pwd ne "");
+					}
+# See if we can get recent folks they've chatted with...					
+					if ($us eq $recent || $us eq $recent2) {
+						
+						my @vals = $u->get_list_of_values();
+						if (scalar(@vals) > 0) {
+							::rptMsg($user."\\".$us);
+							my %sns;
+							foreach my $v (@vals) {
+								$sns{$v->get_name()} = $v->get_data();
+							}
+							
+							foreach my $i (sort {$a <=> $b} keys %sns) {
+								::rptMsg("\t\t".$i." -> ".$sns{$i});
+							}
+						}
+						else {
+# No values							
+						}
+					}
+				}
+				::rptMsg("");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+			::logMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/all

@@ -0,0 +1,4 @@
+# 20120528 *ALL* Plugins that apply on any HIVES, alphabetical order
+baseline
+findexes
+regtime

RecentActivity/release/rr-full/plugins/aports.pl

@@ -0,0 +1,104 @@
+#-----------------------------------------------------------
+# aports.pl
+#   Extracts the install path for SmartLine Inc. Active Ports.
+#
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+#
+# Copyright (c) 2011-02-04 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package aports;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20110204);
+my $VERSION = getVersion();
+
+# Functions #
+sub getDescr {}
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getShortDescr {
+	return "Extracts the install path for SmartLine Inc. Active Ports.";
+}
+sub getRefs {
+	my %refs = ("SmartLine Inc. Active Ports Homepage:" =>
+	            "http://www.ntutility.com");
+	return %refs;	
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+	my @interesting_keys = (
+		"InstallPath"
+	);
+
+	# Initialize #
+	::logMsg("Launching aports v.".$VERSION);
+    ::rptMsg("aports v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # 20110830 [fpi] + banner     
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\SmartLine Vision\\aports";
+
+	# If # Active Ports path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("Active Ports");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from Active Ports registry path #
+		my %keys;
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for Active Ports registry path #
+			foreach my $v (@vals) {
+				$keys{$v->get_name()} = $v->get_data();
+			}
+
+			# Return # all key names+values for interesting keys #
+			foreach my $var (@interesting_keys) {
+				if (exists $keys{$var}) {
+					::rptMsg($var." -> ".$keys{$var});
+				}
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # Active Ports isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;

RecentActivity/release/rr-full/plugins/appcertdlls.pl

@@ -0,0 +1,83 @@
+#-----------------------------------------------------------
+# appcertdlls.pl
+#
+# History:
+#  20120912 - created
+#
+# References:
+#  Blog post: https://blog.mandiant.com/archives/2459
+#  Whitepaper: http://fred.mandiant.com/Whitepaper_ShimCacheParser.pdf
+#  Tool: https://github.com/mandiant/ShimCacheParser
+#
+# This plugin is based solely on the work and examples provided by Mandiant;
+# thanks to them for sharing this information, and making the plugin possible.
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package appcertdlls;
+use strict;
+
+my %config = (hive          => "System",
+							hivemask      => 4,
+							output        => "report",
+							category      => "malware",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 31,  #XP - Win7
+              version       => 20120817);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Get entries from AppCertDlls key";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+my %files;
+my @temps;
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching appcertdlls v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		my $appcert_path = $ccs."\\Control\\Session Manager\\AppCertDlls";
+		my $appcert;
+		if ($appcert = $root_key->get_subkey($appcert_path)) {
+			my @vals = $appcert->get_list_of_values();
+			if (scalar(@vals) > 0) {
+				foreach my $v (@vals) {
+					my $name = $v->get_name();
+					my $data = $v->get_data();
+					::rptMsg($name." - ".$data);
+				}
+			}
+			else {
+				::rptMsg($appcert_path."has no values.");
+			}
+		}
+		else {
+			::rptMsg($appcert_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+1;

RecentActivity/release/rr-full/plugins/appcompatcache.pl

@@ -0,0 +1,315 @@
+#-----------------------------------------------------------
+# appcompatcache.pl
+#
+# History:
+#  20130425 - added alertMsg() functionality
+#  20120817 - updated to address issue with residual data in XP data blocks
+#  20120722 - updated the %config hash
+#  20120523 - updated to send all files to a single hash, and check for temp paths
+#  20120515 - Updated to support 64-bit Win2003 and Vista/Win2008
+#  20120424 - Modified/updated 
+#  20120418 - created
+#
+# References:
+#  Blog post: https://blog.mandiant.com/archives/2459
+#  Whitepaper: http://fred.mandiant.com/Whitepaper_ShimCacheParser.pdf
+#  Tool: https://github.com/mandiant/ShimCacheParser
+#
+# This plugin is based solely on the work and examples provided by Mandiant;
+# thanks to them for sharing this information, and making the plugin possible.
+# 
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package appcompatcache;
+use strict;
+
+my %config = (hive          => "System",
+							hivemask      => 4,
+							output        => "report",
+							category      => "Program Execution",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 31,  #XP - Win7
+              version       => 20130425);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Parse files from System hive Shim Cache";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+my %files;
+my @temps;
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching appcompatcache v.".$VERSION);
+	::rptMsg("appcompatcache v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		my $appcompat_path = $ccs."\\Control\\Session Manager";
+		my $appcompat;
+		if ($appcompat = $root_key->get_subkey($appcompat_path)) {
+			
+			my $app_data;
+			
+			eval {
+				$app_data = $appcompat->get_subkey("AppCompatibility")->get_value("AppCompatCache")->get_data();
+			};
+			
+			eval {
+				$app_data = $appcompat->get_subkey("AppCompatCache")->get_value("AppCompatCache")->get_data();
+			};
+				
+#			::rptMsg("Length of data: ".length($app_data));
+			my $sig = unpack("V",substr($app_data,0,4));
+			::rptMsg(sprintf "Signature: 0x%x",$sig);
+			
+			if ($sig == 0xdeadbeef) {
+				eval {
+					appXP32Bit($app_data);
+				};
+			}
+			elsif ($sig == 0xbadc0ffe) {
+				eval {
+					appWin2k3($app_data);
+				};
+			}
+			elsif ($sig == 0xbadc0fee) {
+				eval {
+					appWin7($app_data);
+				};
+			
+			}
+			else {
+				::rptMsg("Unknown signature");
+			}
+# this is where we print out the files
+			foreach my $f (keys %files) {
+				::rptMsg($f);
+				push(@temps,$f) if (grep(/[Tt]emp/,$f));
+				::rptMsg("ModTime: ".gmtime($files{$f}{modtime})." Z");
+				::rptMsg("UpdTime: ".gmtime($files{$f}{updtime})." Z") if (exists $files{$f}{updtime});
+				::rptMsg("Size   : ".$files{$f}{size}." bytes") if (exists $files{$f}{size});
+				::rptMsg("Executed") if (exists $files{$f}{executed});
+				::rptMsg("");
+			}
+			
+			if (scalar(@temps) > 0) {
+				foreach (@temps) {
+					::alertMsg("ALERT: appcompatcache: Temp path found: ".$_);
+				}
+			}
+		}
+		else {
+			::rptMsg($appcompat_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+#-----------------------------------------------------------
+# appXP32Bit()
+# parse 32-bit XP data
+#-----------------------------------------------------------
+sub appXP32Bit {
+	my $data = shift;
+	::rptMsg("WinXP, 32-bit");
+# header is 400 bytes; each structure is 552 bytes in size
+	my $num_entries = unpack("V",substr($data,4,4));
+	
+	foreach my $i (0..($num_entries - 1)) {
+		my $x = substr($data,(400 + ($i * 552)),552);
+		my $file = (split(/\00\00/,substr($x,0,488)))[0];
+		$file =~ s/\00//g;
+		$file =~ s/^\\\?\?\\//;
+		my ($mod1,$mod2) = unpack("VV",substr($x,528,8));
+		my $modtime      = ::getTime($mod1,$mod2);
+		my ($sz1,$sz2)   = unpack("VV",substr($x,536,8));
+		my $sz;
+		($sz2 == 0)?($sz = $sz1):($sz = "Too big");
+		my ($up1,$up2)   = unpack("VV",substr($x,544,8));
+		my $updtime      = ::getTime($up1,$up2);
+		
+		$files{$file}{size} = $sz;
+		$files{$file}{modtime} = $modtime;
+		$files{$file}{updtime} = $updtime;
+	}
+}
+#-----------------------------------------------------------
+# appWin2k3()
+# parse Win2k3, Vista, Win2k8 data
+#-----------------------------------------------------------
+sub appWin2k3 {
+	my $data = shift;
+	my $num_entries = unpack("V",substr($data,4,4));
+#	::rptMsg("Num_entries: ".$num_entries);
+	my $struct_sz = 0;
+	my ($len,$max_len,$padding) = unpack("vvV",substr($data,8,8));
+	if (($max_len - $len) == 2) {
+# if $padding == 0, 64-bit; otherwise, 32-bit
+		if ($padding == 0) {
+			$struct_sz = 32;
+			::rptMsg("Win2K3/Vista/Win2K8, 64-bit");
+		}
+		else {
+			$struct_sz = 24;
+			::rptMsg("Win2K3/Vista/Win2K8, 32-bit");
+		}
+	}
+	
+	foreach my $i (0..($num_entries - 1)) {
+		my $struct = substr($data,(8 + ($struct_sz * $i)),$struct_sz);
+		if ($struct_sz == 24) {
+			my ($len,$max_len,$ofs,$t0,$t1,$f0,$f1) = unpack("vvVVVVV",$struct);
+			
+			my $file = substr($data,$ofs,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastMod: ".gmtime($t)." Z");
+#			::rptMsg("  [Executed]") if (($f0 < 4) && ($f0 & 0x2));
+#			::rptMsg("");
+			$files{$file}{modtime} = $t;
+#			$files{$file}{size} = $f0 if (($f1 == 0) && ($f0 > 3));
+			$files{$file}{executed} = 1 if (($f0 < 4) && ($f0 & 0x2));
+		}
+		elsif ($struct_sz == 32) {
+			my ($len,$max_len,$padding,$ofs0,$ofs1,$t0,$t1,$f0,$f1) = unpack("vvVVVVVVV",$struct);
+			my $file = substr($data,$ofs0,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastMod: ".gmtime($t)." Z");
+#			::rptMsg("  Size   : ".$f0) if (($f1 == 0) && ($f0 > 3));
+#			::rptMsg("  [Executed]") if (($f0 < 4) && ($f0 & 0x2));
+#			::rptMsg("");
+			$files{$file}{modtime} = $t;
+			$files{$file}{size} = $f0 if (($f1 == 0) && ($f0 > 3));
+			$files{$file}{executed} = 1 if (($f0 < 4) && ($f0 & 0x2));
+		}
+		else {
+ 			
+			
+		}
+	}
+}
+
+#-----------------------------------------------------------
+# appWin7()
+# parse Win2k8R2, Win7 data
+#-----------------------------------------------------------
+sub appWin7 {
+	my $data = shift;
+	my $struct_sz = 0;
+	my $num_entries = unpack("V",substr($data,4,4));
+#	::rptMsg("Num_entries: ".$num_entries);
+# 128-byte header	
+	my ($len,$max_len,$padding) = unpack("vvV",substr($data,128,8));
+	if (($max_len - $len) == 2) {
+		if ($padding == 0) {
+			$struct_sz = 48;
+			::rptMsg("Win2K8R2/Win7, 64-bit");
+		}
+		else {
+			$struct_sz = 32;
+			::rptMsg("Win2K8R2/Win7, 32-bit");
+		}
+	}
+
+	foreach my $i (0..($num_entries - 1)) {
+		my $struct = substr($data,(128 + ($struct_sz * $i)),$struct_sz);
+		if ($struct_sz == 32) {
+			my ($len,$max_len,$ofs,$t0,$t1,$f0,$f1) = unpack("vvV5x8",$struct);
+			my $file = substr($data,$ofs,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastModTime: ".gmtime($t)." Z");
+#			::rptMsg("  [Executed]") if ($f0 & 0x2);
+#			::rptMsg("");		
+			$files{$file}{modtime} = $t;
+			$files{$file}{executed} = 1 if ($f0 & 0x2);
+		}
+		else {
+			my ($len,$max_len,$padding,$ofs0,$ofs1,$t0,$t1,$f0,$f1) = unpack("vvV7x16",$struct);
+			my $file = substr($data,$ofs0,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastModTime: ".gmtime($t)." Z");
+#			::rptMsg("  [Executed]") if ($f0 & 0x2);
+#			::rptMsg("");		
+			$files{$file}{modtime} = $t;
+			$files{$file}{executed} = 1 if ($f0 & 0x2);
+		}
+	}
+}
+
+
+#-----------------------------------------------------------
+# printData()
+# subroutine used primarily for debugging; takes an arbitrary
+# length of binary data, prints it out in hex editor-style
+# format for easy debugging
+#-----------------------------------------------------------
+sub printData {
+	my $data = shift;
+	my $len = length($data);
+	my $tag = 1;
+	my $cnt = 0;
+	
+	my $loop = $len/16;
+	$loop++ if ($len%16);
+	
+	foreach my $cnt (0..($loop - 1)) {
+#	while ($tag) {
+		my $left = $len - ($cnt * 16);
+		
+		my $n;
+		($left < 16) ? ($n = $left) : ($n = 16);
+
+		my $seg = substr($data,$cnt * 16,$n);
+		my @str1 = split(//,unpack("H*",$seg));
+
+		my @s3;
+		my $str = "";
+
+		foreach my $i (0..($n - 1)) {
+			$s3[$i] = $str1[$i * 2].$str1[($i * 2) + 1];
+			
+			if (hex($s3[$i]) > 0x1f && hex($s3[$i]) < 0x7f) {
+				$str .= chr(hex($s3[$i]));
+			}
+			else {
+				$str .= "\.";
+			}
+		}
+		my $h = join(' ',@s3);
+		::rptMsg(sprintf "0x%08x: %-47s  ".$str,($cnt * 16),$h);
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/appcompatcache_tln.pl

@@ -0,0 +1,275 @@
+#-----------------------------------------------------------
+# appcompatcache_tln.pl
+#
+# History:
+#  20130425 - added alertMsg() functionality
+#  20120817 - updated to address extra data in XP data blocks
+#  20120722 - updated %config hash
+#  20120523 - created; updated from appcompatcache.pl
+#  20120523 - updated to send all files to a single hash, and check for temp paths
+#  20120515 - Updated to support 64-bit Win2003 and Vista/Win2008
+#  20120424 - Modified/updated 
+#  20120418 - created
+#
+# References:
+#  Blog post: https://blog.mandiant.com/archives/2459
+#  Whitepaper: http://fred.mandiant.com/Whitepaper_ShimCacheParser.pdf
+#  Tool: https://github.com/mandiant/ShimCacheParser
+#
+# This plugin is based solely on the work and examples provided by Mandiant;
+# thanks to them for sharing this information, and making the plugin possible.
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package appcompatcache_tln;
+use strict;
+
+my %config = (hive          => "System",
+							hivemask      => 4,
+							output        => "tln",
+							category      => "Program Execution",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 31,  #XP - Win7
+              version       => 20130425);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Parse files from System hive Shim Cache";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+my %files;
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching appcompatcache_tln v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		my $appcompat_path = $ccs."\\Control\\Session Manager";
+		my $appcompat;
+		if ($appcompat = $root_key->get_subkey($appcompat_path)) {
+			
+			my $app_data;
+			
+			eval {
+				$app_data = $appcompat->get_subkey("AppCompatibility")->get_value("AppCompatCache")->get_data();
+			};
+			
+			eval {
+				$app_data = $appcompat->get_subkey("AppCompatCache")->get_value("AppCompatCache")->get_data();
+			};
+				
+#			::rptMsg("Length of data: ".length($app_data));
+			my $sig = unpack("V",substr($app_data,0,4));
+#			::rptMsg(sprintf "Signature: 0x%x",$sig);
+			
+			if ($sig == 0xdeadbeef) {
+				eval {
+					appXP32Bit($app_data);
+				};
+			}
+			elsif ($sig == 0xbadc0ffe) {
+				eval {
+					appWin2k3($app_data);
+				};
+			}
+			elsif ($sig == 0xbadc0fee) {
+				eval {
+					appWin7($app_data);
+				};
+			
+			}
+			else {
+				::rptMsg("Unknown signature");
+			}
+# this is where we print out the files
+			foreach my $f (keys %files) {
+				my $str;
+				if (exists $files{$f}{executed}) {
+					$str = "M... [Program Execution] AppCompatCache - ".$f;
+				}
+				else {
+					$str = "M... AppCompatCache - ".$f;
+				}
+				$str .= " [Size = ".$files{$f}{size}."] bytes" if (exists $files{$f}{size});
+#				$str .= " [Executed]" if (exists $files{$f}{executed}); 
+				::rptMsg($files{$f}{modtime}."|REG|||".$str);
+# alert added 20130425				
+				if (grep(/[Tt]emp/,$f) {
+					::alertMsg($files{$f}{modtime}."|ALERT|||\"Temp\" found in path - ".$str);
+				}
+			
+			}
+		}
+		else {
+			::rptMsg($appcompat_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+#-----------------------------------------------------------
+# appXP32Bit()
+# parse 32-bit XP data
+#-----------------------------------------------------------
+sub appXP32Bit {
+	my $data = shift;
+	::rptMsg("WinXP, 32-bit");
+# header is 400 bytes; each structure is 552 bytes in size
+	my $num_entries = unpack("V",substr($data,4,4));
+	
+	foreach my $i (0..($num_entries - 1)) {
+		my $x = substr($data,(400 + ($i * 552)),552);
+		my $file = (split(/\00\00/,substr($x,0,488)))[0];
+		$file =~ s/\00//g;
+		$file =~ s/^\\\?\?\\//;
+		my ($mod1,$mod2) = unpack("VV",substr($x,528,8));
+		my $modtime      = ::getTime($mod1,$mod2);
+		my ($sz1,$sz2)   = unpack("VV",substr($x,536,8));
+		my $sz;
+		($sz2 == 0)?($sz = $sz1):($sz = "Too big");
+		my ($up1,$up2)   = unpack("VV",substr($x,544,8));
+		my $updtime      = ::getTime($up1,$up2);
+		
+#		::rptMsg($file);
+#		::rptMsg("Size   : ".$sz." bytes");
+#		::rptMsg("ModTime: ".gmtime($modtime)." Z");
+#		::rptMsg("UpdTime: ".gmtime($updtime)." Z");
+#		::rptMsg("");
+		$files{$file}{size} = $sz;
+		$files{$file}{modtime} = $modtime;
+		$files{$file}{updtime} = $updtime;
+	}
+}
+#-----------------------------------------------------------
+# appWin2k3()
+# parse Win2k3, Vista, Win2k8 data
+#-----------------------------------------------------------
+sub appWin2k3 {
+	my $data = shift;
+	my $num_entries = unpack("V",substr($data,4,4));
+#	::rptMsg("Num_entries: ".$num_entries);
+	my $struct_sz = 0;
+	my ($len,$max_len,$padding) = unpack("vvV",substr($data,8,8));
+	if (($max_len - $len) == 2) {
+# if $padding == 0, 64-bit; otherwise, 32-bit
+		if ($padding == 0) {
+			$struct_sz = 32;
+			::rptMsg("Win2K3/Vista/Win2K8, 64-bit");
+		}
+		else {
+			$struct_sz = 24;
+			::rptMsg("Win2K3/Vista/Win2K8, 32-bit");
+		}
+	}
+	
+	foreach my $i (0..($num_entries - 1)) {
+		my $struct = substr($data,(8 + ($struct_sz * $i)),$struct_sz);
+		if ($struct_sz == 24) {
+			my ($len,$max_len,$ofs,$t0,$t1,$f0,$f1) = unpack("vvVVVVV",$struct);
+			
+			my $file = substr($data,$ofs,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastMod: ".gmtime($t)." Z");
+#			::rptMsg("  [Executed]") if (($f0 < 4) && ($f0 & 0x2));
+#			::rptMsg("");
+			$files{$file}{modtime} = $t;
+			$files{$file}{executed} = 1 if (($f0 < 4) && ($f0 & 0x2));
+		}
+		elsif ($struct_sz == 32) {
+			my ($len,$max_len,$padding,$ofs0,$ofs1,$t0,$t1,$f0,$f1) = unpack("vvVVVVVVV",$struct);
+			my $file = substr($data,$ofs0,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastMod: ".gmtime($t)." Z");
+#			::rptMsg("  Size   : ".$f0) if (($f1 == 0) && ($f0 > 3));
+#			::rptMsg("  [Executed]") if (($f0 < 4) && ($f0 & 0x2));
+#			::rptMsg("");
+			$files{$file}{modtime} = $t;
+			$files{$file}{size} = $f0 if (($f1 == 0) && ($f0 > 3));
+			$files{$file}{executed} = 1 if (($f0 < 4) && ($f0 & 0x2));
+		}
+		else {
+ 			
+			
+		}
+	}
+}
+
+#-----------------------------------------------------------
+# appWin7()
+# parse Win2k8R2, Win7 data
+#-----------------------------------------------------------
+sub appWin7 {
+	my $data = shift;
+	my $struct_sz = 0;
+	my $num_entries = unpack("V",substr($data,4,4));
+#	::rptMsg("Num_entries: ".$num_entries);
+# 128-byte header	
+	my ($len,$max_len,$padding) = unpack("vvV",substr($data,128,8));
+	if (($max_len - $len) == 2) {
+		if ($padding == 0) {
+			$struct_sz = 48;
+			::rptMsg("Win2K8R2/Win7, 64-bit");
+		}
+		else {
+			$struct_sz = 32;
+			::rptMsg("Win2K8R2/Win7, 32-bit");
+		}
+	}
+
+	foreach my $i (0..($num_entries - 1)) {
+		my $struct = substr($data,(128 + ($struct_sz * $i)),$struct_sz);
+		if ($struct_sz == 32) {
+			my ($len,$max_len,$ofs,$t0,$t1,$f0,$f1) = unpack("vvV5x8",$struct);
+			my $file = substr($data,$ofs,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastModTime: ".gmtime($t)." Z");
+#			::rptMsg("  [Executed]") if ($f0 & 0x2);
+#			::rptMsg("");		
+			$files{$file}{modtime} = $t;
+			$files{$file}{executed} = 1 if ($f0 & 0x2);
+		}
+		else {
+			my ($len,$max_len,$padding,$ofs0,$ofs1,$t0,$t1,$f0,$f1) = unpack("vvV7x16",$struct);
+			my $file = substr($data,$ofs0,$len);
+			$file =~ s/\00//g;
+			$file =~ s/^\\\?\?\\//;
+			my $t = ::getTime($t0,$t1);
+#			::rptMsg($file);
+#			::rptMsg("  LastModTime: ".gmtime($t)." Z");
+#			::rptMsg("  [Executed]") if ($f0 & 0x2);
+#			::rptMsg("");		
+			$files{$file}{modtime} = $t;
+			$files{$file}{executed} = 1 if ($f0 & 0x2);
+		}
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/appcompatflags.pl

@@ -0,0 +1,104 @@
+#-----------------------------------------------------------
+# appcompatflags.pl
+#   Extracts AppCompatFlags for Windows.
+#   This is a list of applications configured to run in
+#   compatibility mode. Some applications may be configured 
+#   to run with elevated privilages (Tested in Vista only) :
+#   "ELEVATECREATEPROCESS" "RUNASADMIN" "WINXPSP2 RUNASADMIN"
+#
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+#   http://msdn.microsoft.com/en-us/library/bb756937.aspx
+#
+# Copyright (c) 2011-02-04 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package appcompatflags;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 1,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20110204);
+my $VERSION = getVersion();
+
+# Functions #
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getDescr {
+	return "Extracts AppCompatFlags for Windows. This is a list".
+	       " of applications configured to run in compatibility".
+	       " mode. Some applications may be configured to run".
+	       " with elevated privilages (Tested in Vista only) :".
+	       '"ELEVATECREATEPROCESS" "RUNASADMIN" "WINXPSP2 RUNASADMIN"';
+}
+sub getShortDescr {
+	return "Extracts AppCompatFlags for Windows.";
+}
+sub getRefs {
+	my %refs = ("Application Compatibility: Program Compatibility Assistant" =>
+	            "http://msdn.microsoft.com/en-us/library/bb756937.aspx");
+	return %refs;	
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+
+	# Initialize #
+	::logMsg("Launching appcompatflags v.".$VERSION);
+    ::rptMsg("appcompatflags v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # 20110830 [fpi] + banner     
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers";
+
+	# If # AppCompatFlags path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("AppCompatFlags");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from AppCompatFlags registry path #
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for AppCompatFlags registry path #
+			foreach my $v (@vals) {
+				::rptMsg($v->get_name()." -> ".$v->get_data());
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # AppCompatFlags isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;

RecentActivity/release/rr-full/plugins/appinitdlls.pl

@@ -0,0 +1,93 @@
+#-----------------------------------------------------------
+# appinitdlls
+#
+# Change history:
+#  20130425 - added alertMsg() functionality
+#  20130305 - updated to address 64-bit systems
+#  20080324 - created
+# 
+# Ref:
+#  http://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx
+#  http://support.microsoft.com/kb/q197571
+#
+# copyright 2013 QAR,LLC 
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package appinitdlls;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20130425);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of AppInit_DLLs value";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("Working with the AppInit_DLLs Reg Value" => 
+	            "http://support.microsoft.com/kb/q197571");
+	return %refs;
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::rptMsg("Launching appinitdlls v.".$VERSION);
+	::rptMsg("appinitdlls v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my @paths = ('Microsoft\\Windows NT\\CurrentVersion\\Windows',
+	         'Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows');
+	
+	::rptMsg("AppInit_DLLs");
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	foreach my $key_path (@paths) {
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+			
+			eval {
+				my $app = $key->get_value("AppInit_DLLs")->get_data();
+				
+				if ($app eq "") {
+					$app = "{blank}";
+				}
+				else {
+					::alertMsg("ALERT: appinitdlls: Entry not blank: ".$app);
+				}
+				::rptMsg("  AppInit_DLLs : ".$app);
+			};
+			
+			eval {
+				my $load = $key->get_value("LoadAppInit_DLLs")->get_data();
+				::rptMsg("  LoadAppInit_DLLs : ".$load);
+				::rptMsg("*LoadAppInit_DLLs value globally enables/disables AppInit_DLLS\.");
+				::rptMsg("0 = disabled (default)");
+			};
+			
+			eval {
+				my $req = $key->get_value("RequireSignedAppInit_DLLs")->get_data();
+				::rptMsg("  RequireSignedAppInit_DLLs : ".$req);
+			};
+			
+			::rptMsg("");
+		}
+		else {
+			::rptMsg($key_path." not found.");
+		}
+	}
+	::rptMsg("Analysis Tip: The AppInit_DLLs value should be blank; any DLL listed");
+	::rptMsg("is launched with each user-mode process\.  ");
+}
+1;

RecentActivity/release/rr-full/plugins/applets.pl

@@ -1,96 +1,98 @@
-#-----------------------------------------------------------
-# applets.pl
-# Plugin for Registry Ripper 
-# Windows\CurrentVersion\Applets Recent File List values 
-#
-# Change history
-#
-#
-# References
-#
-# 
-# copyright 2008 H. Carvey
-#-----------------------------------------------------------
-package applets;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20080324);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets contents of user's Applets key";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching applets v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Applets';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("Applets");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-# Locate files opened in MS Paint		
-		my $paint_key = 'Paint\\Recent File List';
-		my $paint = $key->get_subkey($paint_key);
-		if (defined $paint) {
-			::rptMsg($key_path."\\".$paint_key);
-			::rptMsg("LastWrite Time ".gmtime($paint->get_timestamp())." (UTC)");
-			
-			my @vals = $paint->get_list_of_values();
-			if (scalar(@vals) > 0) {
-				my %files;
-# Retrieve values and load into a hash for sorting			
-				foreach my $v (@vals) {
-					my $val = $v->get_name();
-					my $data = $v->get_data();
-					my $tag = (split(/File/,$val))[1];
-					$files{$tag} = $val.":".$data;
-				}
-# Print sorted content to report file			
-				foreach my $u (sort {$a <=> $b} keys %files) {
-					my ($val,$data) = split(/:/,$files{$u},2);
-					::rptMsg("  ".$val." -> ".$data);
-				}
-			}
-			else {
-				::rptMsg($key_path."\\".$paint_key." has no values.");
-			}			
-		}
-		else {
-			::rptMsg($key_path."\\".$paint_key." not found.");
-		}
-# Get Last Registry key opened in RegEdit
-		my $reg_key = "Regedit";
-		my $reg = $key->get_subkey($reg_key);
-		if (defined $reg) {
-			::rptMsg("");
-			::rptMsg($key_path."\\".$reg_key);
-			::rptMsg("LastWrite Time ".gmtime($reg->get_timestamp())." (UTC)"); 
-			my $lastkey = $reg->get_value("LastKey")->get_data();
-			::rptMsg("RegEdit LastKey value -> ".$lastkey);
-		}		
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# applets.pl
+# Plugin for Registry Ripper 
+# Windows\CurrentVersion\Applets Recent File List values 
+#
+# Change history
+#
+#
+# References
+#
+# 
+# copyright 2008 H. Carvey
+#-----------------------------------------------------------
+package applets;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20080324);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's Applets key";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching applets v.".$VERSION);
+	::rptMsg("applets v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Applets';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("Applets");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+# Locate files opened in MS Paint		
+		my $paint_key = 'Paint\\Recent File List';
+		my $paint = $key->get_subkey($paint_key);
+		if (defined $paint) {
+			::rptMsg($key_path."\\".$paint_key);
+			::rptMsg("LastWrite Time ".gmtime($paint->get_timestamp())." (UTC)");
+			
+			my @vals = $paint->get_list_of_values();
+			if (scalar(@vals) > 0) {
+				my %files;
+# Retrieve values and load into a hash for sorting			
+				foreach my $v (@vals) {
+					my $val = $v->get_name();
+					my $data = $v->get_data();
+					my $tag = (split(/File/,$val))[1];
+					$files{$tag} = $val.":".$data;
+				}
+# Print sorted content to report file			
+				foreach my $u (sort {$a <=> $b} keys %files) {
+					my ($val,$data) = split(/:/,$files{$u},2);
+					::rptMsg("  ".$val." -> ".$data);
+				}
+			}
+			else {
+				::rptMsg($key_path."\\".$paint_key." has no values.");
+			}			
+		}
+		else {
+			::rptMsg($key_path."\\".$paint_key." not found.");
+		}
+# Get Last Registry key opened in RegEdit
+		my $reg_key = "Regedit";
+		my $reg = $key->get_subkey($reg_key);
+		if (defined $reg) {
+			::rptMsg("");
+			::rptMsg($key_path."\\".$reg_key);
+			::rptMsg("LastWrite Time ".gmtime($reg->get_timestamp())." (UTC)"); 
+			my $lastkey = $reg->get_value("LastKey")->get_data();
+			::rptMsg("RegEdit LastKey value -> ".$lastkey);
+		}		
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/applets_tln.pl

@@ -0,0 +1,84 @@
+#-----------------------------------------------------------
+# applets_tln.pl
+# Plugin for Registry Ripper 
+# Windows\CurrentVersion\Applets Recent File List values 
+#
+# Change history
+#  20120613 - created
+#
+# References
+#
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package applets_tln;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120613);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's Applets key (TLN)";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching applets_tln v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Applets';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+#		::rptMsg("Applets");
+#		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#		::rptMsg("");
+# Locate files opened in MS Paint		
+		my $paint_key = 'Paint\\Recent File List';
+		my $paint = $key->get_subkey($paint_key);
+		if (defined $paint) {
+#			::rptMsg($key_path."\\".$paint_key);
+#			::rptMsg("LastWrite Time ".gmtime($paint->get_timestamp())." (UTC)");
+			
+			my @vals = $paint->get_list_of_values();
+			if (scalar(@vals) > 0) {
+				::rptMsg($paint->get_timestamp()."|REG|||MS Paint Most Recent File = ".$paint->get_value("File1")->get_data());
+			}
+			else {
+#				::rptMsg($key_path."\\".$paint_key." has no values.");
+			}			
+		}
+		else {
+#			::rptMsg($key_path."\\".$paint_key." not found.");
+		}
+# Get Last Registry key opened in RegEdit
+		my $reg_key = "Regedit";
+		my $reg = $key->get_subkey($reg_key);
+		if (defined $reg) {
+#			::rptMsg("");
+#			::rptMsg($key_path."\\".$reg_key);
+#			::rptMsg("LastWrite Time ".gmtime($reg->get_timestamp())." (UTC)"); 
+			my $lastkey = $reg->get_value("LastKey")->get_data();
+			::rptMsg($reg->get_timestamp()."|REG|||RegEdit LastKey value -> ".$lastkey);
+		}		
+	}
+	else {
+#		::rptMsg($key_path." not found.");
+	}
+}
+
+1;

RecentActivity/release/rr-full/plugins/apppaths.pl

@@ -0,0 +1,94 @@
+#-----------------------------------------------------------
+# apppaths
+# Gets contents of App Paths subkeys from the Software hive,
+# diplaying the EXE name and path; all entries are sorted by
+# LastWrite time
+# 
+# References
+#
+#
+# History:
+#  20120524 - updated to include 64-bit OSs
+#  20080404 - created
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package apppaths;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              version       => 20120524);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets content of App Paths subkeys";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("You cannot open Help and Support Center in Windows XP" => 
+	            "http://support.microsoft.com/kb/888018",
+	            "Another installation program starts..." => 
+	            "http://support.microsoft.com/kb/888470");	
+	return %refs;
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching apppaths v.".$VERSION);
+	::rptMsg("apppaths v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# used a list of values to address the need for parsing the App Paths key
+# in the Wow6432Node key, if it exists.
+	my @paths = ("Microsoft\\Windows\\CurrentVersion\\App Paths");
+	
+	foreach my $key_path (@paths) {
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg("App Paths");
+			::rptMsg($key_path);
+			::rptMsg("");
+			my %apps;
+			my @subkeys = $key->get_list_of_subkeys();
+			if (scalar(@subkeys) > 0) {
+				foreach my $s (@subkeys) {
+				
+					my $name = $s->get_name();
+					my $lastwrite = $s->get_timestamp();
+					my $path;
+					eval {
+						$path = $s->get_value("")->get_data();
+					};
+					push(@{$apps{$lastwrite}},$name." - ".$path);
+				}
+			
+				foreach my $t (reverse sort {$a <=> $b} keys %apps) {
+					::rptMsg(gmtime($t)." (UTC)");
+					foreach my $item (@{$apps{$t}}) {
+						::rptMsg("  $item");
+					}
+				}
+			}
+			else {
+				::rptMsg($key_path." has no subkeys.");
+			}
+		}
+		else {
+			::rptMsg($key_path." not found.");
+		}
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/apppaths_tln.pl

@@ -0,0 +1,90 @@
+#-----------------------------------------------------------
+# apppaths_tln
+# Gets contents of App Paths subkeys from the Software hive,
+# Output in TLN format
+# 
+# References
+#
+# History:
+#  20130429 - created from apppaths.pl
+#
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package apppaths_tln;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              version       => 20130429);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets content of App Paths subkeys (TLN)";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("You cannot open Help and Support Center in Windows XP" => 
+	            "http://support.microsoft.com/kb/888018",
+	            "Another installation program starts..." => 
+	            "http://support.microsoft.com/kb/888470");	
+	return %refs;
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching apppaths_tln v.".$VERSION);
+#	::rptMsg("apppaths v.".$VERSION); # banner
+#    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# used a list of values to address the need for parsing the App Paths key
+# in the Wow6432Node key, if it exists.
+	my @paths = ("Microsoft\\Windows\\CurrentVersion\\App Paths");
+	
+	foreach my $key_path (@paths) {
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg("App Paths");
+			::rptMsg($key_path);
+			::rptMsg("");
+			my %apps;
+			my @subkeys = $key->get_list_of_subkeys();
+			if (scalar(@subkeys) > 0) {
+				foreach my $s (@subkeys) {
+				
+					my $name = $s->get_name();
+					my $lastwrite = $s->get_timestamp();
+					my $path;
+					eval {
+						$path = $s->get_value("")->get_data();
+					};
+					push(@{$apps{$lastwrite}},$name." - ".$path);
+				}
+			
+				foreach my $t (reverse sort {$a <=> $b} keys %apps) {
+					foreach my $item (@{$apps{$t}}) {
+						::rptMsg($t."|REG|||App Paths - ".$item);
+					}
+				}
+			}
+			else {
+#				::rptMsg($key_path." has no subkeys.");
+			}
+		}
+		else {
+#			::rptMsg($key_path." not found.");
+		}
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/appspecific.pl

@@ -0,0 +1,74 @@
+#-----------------------------------------------------------
+# appspecific.pl
+# 
+#
+# Change history
+#   20120820 - created
+#
+# References
+#
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package appspecific;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120820);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's Intellipoint\\AppSpecific subkeys";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching appspecific v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\IntelliPoint\\AppSpecific';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("AppSpecific");
+		::rptMsg($key_path);
+		
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) { 
+				::rptMsg($s->get_name()." [".gmtime($s->get_timestamp())." (UTC)]");
+				
+				my $ts;
+				eval {
+					$ts = $s->get_value("Timestamp")->get_data();
+					my $t = ::getTime(0,$ts);
+					::rptMsg("Timestamp: ".gmtime($t));
+					
+				};
+				
+				
+				::rptMsg("");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+1;

RecentActivity/release/rr-full/plugins/ares.pl

@@ -0,0 +1,109 @@
+#-----------------------------------------------------------
+# ares.pl
+# 
+#
+# Change History
+#   20130312 - updated based on data provided by J. Weg
+#   20120507 - modified to remove the traversing function, to only get
+#              a limited amount of data.
+#   20110603 - modified F. Kolenbrander
+#	       parsing some values according ares source code, like searches and 
+#        timestamps.
+#   20110530 - created
+#   
+# References
+#
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+# author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package ares;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20130312);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's Software/Ares key";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching ares v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Ares';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#		::rptMsg("");
+		my %ares = ();
+		my @vals = $key->get_list_of_values();
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) {
+				$ares{$v->get_name()} = $v->get_data();
+			}
+			::rptMsg("");
+			::rptMsg("RegisterEmail: ".$ares{"RegisterEmail"}) if (exists $ares{"RegisterEmail"});
+			::rptMsg("Stats\.LstConnect: ".gmtime($ares{"Stats\.LstConnect"})." UTC") if (exists $ares{"Stats\.LstConnect"});
+			::rptMsg("Personal\.Nickname: ".hex2ascii($ares{"Personal\.Nickname"})) if (exists $ares{"Personal\.Nickname"});
+			::rptMsg("General\.Language: ".hex2ascii($ares{"General\.Language"})) if (exists $ares{"General\.Language"});
+			::rptMsg("PrivateMessage\.AwayMessage: ".hex2ascii($ares{"PrivateMessage\.AwayMessage"})) if (exists $ares{"PrivateMessage\.AwayMessage"});
+
+		}
+		else {
+			::rptMsg($key->get_name()." has no values.");
+		}
+		::rptMsg("");
+		getSearchTerms($key);
+		
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+sub getSearchTerms {
+	my $key = shift;
+	
+	my $count = 0;
+	::rptMsg("Search Terms:");
+	my @subkeys = ("audio\.gen","gen\.gen","image\.gen","video\.gen");
+	
+	foreach my $sk (@subkeys) {
+		my $gen = $key->get_subkey("Search\.History")->get_subkey($sk);
+		my @vals = $gen->get_list_of_values();
+		if (scalar(@vals) > 0) {
+			$count = 1;
+			::rptMsg($gen->get_name());
+			::rptMsg("LastWrite: ".gmtime($gen->get_timestamp()));
+			foreach my $v (@vals) {
+				next if ($v->get_name() eq "");
+				::rptMsg("  ".hex2ascii($v->get_name()));
+			}
+		}
+	}
+	::rptMsg("No search terms found\.") if ($count == 0);
+	
+}
+
+sub hex2ascii {
+  return pack('H*',shift); 
+}
+
+1;

RecentActivity/release/rr-full/plugins/arpcache.pl

@@ -1,133 +1,135 @@
-#-----------------------------------------------------------
-# arpcache.pl
-# Retrieves CurrentVersion\App Management\ARPCache entries; subkeys appear
-# to maintain information about paths to installed applications in the 
-# SlowInfoCache value(0x10 - FILETIME object, null term. string with path
-# starts at 0x1c)
-#
-# Change history
-#    20090413 - Created
-#
-# References
-#    No references, but the subkeys appear to hold information about
-#    installed applications; some SlowInfoCache values appear to contain
-#    timestamp data (FILETIME object) and/or path information.  Posts on
-#    the Internet indicate the existence of Kazaa beneath the APRCache key,
-#    as well as possibly an "Outerinfo" subkey indicating that spyware is 
-#    installed.
-# 
-# copyright 2009 H. Carvey
-#-----------------------------------------------------------
-package arpcache;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20090413);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Retrieves CurrentVersion\\App Management\\ARPCache entries";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-my %arpcache;
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching arpcache v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\App Management\\ARPCache';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) { 
-				my $lw = $s->get_timestamp();
-				my $name = $s->get_name();
-	
-				my $path;
-				eval {
-					my $i = $s->get_value("SlowInfoCache")->get_data();
-					$path = parsePath($i);
-				};
-				($@) ? ($name .= "|") : ($name .= "|".$path);
-				
-				my $date;
-				eval {
-					my $i = $s->get_value("SlowInfoCache")->get_data();
-					$date = parseDate($i);
-				};
-				($@) ? ($name .= "|") : ($name .= "|".$date);
-				push(@{$arpcache{$lw}},$name);
-			}
-			
-			
-			foreach my $t (reverse sort {$a <=> $b} keys %arpcache) {
-				::rptMsg(gmtime($t)." (UTC)");
-				foreach my $item (@{$arpcache{$t}}) {
-					my ($name,$path,$date) = split(/\|/,$item,3);
-					::rptMsg("  ".$name);
-					my $str = $path unless ($path eq "");
-					$str .= " [".gmtime($date)."]" unless ($date == 0);
-					::rptMsg("    -> ".$str) unless ($str eq ""); 
-				}
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-			::logMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-
-1;
-
-sub parseDate {
-	my $data = shift;
-	my ($t1,$t2) = unpack("VV",substr($data,0x10,8));
-	return ::getTime($t1,$t2);
-}
-
-sub parsePath {
-	my $data = shift;
-	my $ofs = 0x1c;
-	my $tag = 1;
-	
-	my $str = substr($data,$ofs,2);
-	if (unpack("v",$str) == 0) {
-		return "";
-	}
-	else {
-		while($tag) {
-			$ofs += 2;
-			my $i = substr($data,$ofs,2);
-			if (unpack("v",$i) == 0) {
-				$tag = 0;
-			}
-			else {
-				$str .= $i;
-			}
-		}
-	}	
-	$str =~ s/\00//g;
-	return $str;
+#-----------------------------------------------------------
+# arpcache.pl
+# Retrieves CurrentVersion\App Management\ARPCache entries; subkeys appear
+# to maintain information about paths to installed applications in the 
+# SlowInfoCache value(0x10 - FILETIME object, null term. string with path
+# starts at 0x1c)
+#
+# Change history
+#    20090413 - Created
+#
+# References
+#    No references, but the subkeys appear to hold information about
+#    installed applications; some SlowInfoCache values appear to contain
+#    timestamp data (FILETIME object) and/or path information.  Posts on
+#    the Internet indicate the existence of Kazaa beneath the APRCache key,
+#    as well as possibly an "Outerinfo" subkey indicating that spyware is 
+#    installed.
+# 
+# copyright 2009 H. Carvey
+#-----------------------------------------------------------
+package arpcache;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20090413);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Retrieves CurrentVersion\\App Management\\ARPCache entries";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+my %arpcache;
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching arpcache v.".$VERSION);
+	::rptMsg("arpcache v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\App Management\\ARPCache';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) { 
+				my $lw = $s->get_timestamp();
+				my $name = $s->get_name();
+	
+				my $path;
+				eval {
+					my $i = $s->get_value("SlowInfoCache")->get_data();
+					$path = parsePath($i);
+				};
+				($@) ? ($name .= "|") : ($name .= "|".$path);
+				
+				my $date;
+				eval {
+					my $i = $s->get_value("SlowInfoCache")->get_data();
+					$date = parseDate($i);
+				};
+				($@) ? ($name .= "|") : ($name .= "|".$date);
+				push(@{$arpcache{$lw}},$name);
+			}
+			
+			
+			foreach my $t (reverse sort {$a <=> $b} keys %arpcache) {
+				::rptMsg(gmtime($t)." (UTC)");
+				foreach my $item (@{$arpcache{$t}}) {
+					my ($name,$path,$date) = split(/\|/,$item,3);
+					::rptMsg("  ".$name);
+					my $str = $path unless ($path eq "");
+					$str .= " [".gmtime($date)."]" unless ($date == 0);
+					::rptMsg("    -> ".$str) unless ($str eq ""); 
+				}
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+			::logMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+
+1;
+
+sub parseDate {
+	my $data = shift;
+	my ($t1,$t2) = unpack("VV",substr($data,0x10,8));
+	return ::getTime($t1,$t2);
+}
+
+sub parsePath {
+	my $data = shift;
+	my $ofs = 0x1c;
+	my $tag = 1;
+	
+	my $str = substr($data,$ofs,2);
+	if (unpack("v",$str) == 0) {
+		return "";
+	}
+	else {
+		while($tag) {
+			$ofs += 2;
+			my $i = substr($data,$ofs,2);
+			if (unpack("v",$i) == 0) {
+				$tag = 0;
+			}
+			else {
+				$str .= $i;
+			}
+		}
+	}	
+	$str =~ s/\00//g;
+	return $str;
 }

RecentActivity/release/rr-full/plugins/assoc.pl

@@ -1,87 +1,89 @@
-#-----------------------------------------------------------
-# assoc.pl
-# Plugin to extract file association data from the Software hive file
-# Can take considerable time to run; recommend running it via rip.exe
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package assoc;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20080815);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get list of file ext associations";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching assoc v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Classes";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("assoc");
-		::rptMsg($key_path);
-#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-# First step will be to get a list of all of the file extensions
-		my %ext;
-		my @sk = $key->get_list_of_subkeys();
-		if (scalar(@sk) > 0) {
-			foreach my $s (@sk) {
-				my $name = $s->get_name();
-				next unless ($name =~ m/^\.\w+$/);
-				my $data;
-				eval {
-					$data = $s->get_value("")->get_data();
-				};
-				if ($@) {
-# Error generated, as "(Default)" value was not found					
-				}
-				else {
-					$ext{$name} = $data if ($data ne "");
-				}
-			}
-# Once a list of all file ext subkeys has been compiled, access the file type
-# to determine the command line used to launch files with that extension
-			foreach my $e (keys %ext) {
-				my $cmd;
-				eval {
-					$cmd = $key->get_subkey($ext{$e}."\\shell\\open\\command")->get_value("")->get_data();
-				};
-				if ($@) {
-# error generated attempting to locate <file type>.\shell\open\command\(Default) value					
-				}
-				else {
-					::rptMsg($e." : ".$cmd);
-				}
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-	
-}
+#-----------------------------------------------------------
+# assoc.pl
+# Plugin to extract file association data from the Software hive file
+# Can take considerable time to run; recommend running it via rip.exe
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package assoc;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20080815);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get list of file ext associations";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching assoc v.".$VERSION);
+	::rptMsg("assoc v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Classes";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("assoc");
+		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+# First step will be to get a list of all of the file extensions
+		my %ext;
+		my @sk = $key->get_list_of_subkeys();
+		if (scalar(@sk) > 0) {
+			foreach my $s (@sk) {
+				my $name = $s->get_name();
+				next unless ($name =~ m/^\.\w+$/);
+				my $data;
+				eval {
+					$data = $s->get_value("")->get_data();
+				};
+				if ($@) {
+# Error generated, as "(Default)" value was not found					
+				}
+				else {
+					$ext{$name} = $data if ($data ne "");
+				}
+			}
+# Once a list of all file ext subkeys has been compiled, access the file type
+# to determine the command line used to launch files with that extension
+			foreach my $e (keys %ext) {
+				my $cmd;
+				eval {
+					$cmd = $key->get_subkey($ext{$e}."\\shell\\open\\command")->get_value("")->get_data();
+				};
+				if ($@) {
+# error generated attempting to locate <file type>.\shell\open\command\(Default) value					
+				}
+				else {
+					::rptMsg($e." : ".$cmd);
+				}
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+	
+}
 1;

RecentActivity/release/rr-full/plugins/attachmgr.pl

@@ -0,0 +1,85 @@
+#-----------------------------------------------------------
+# attachmgr.pl
+# The Windows Attachment Manager manages how attachments are handled,
+# and settings are on a per-user basis.  Malware has been shown to access
+# these settings and make modifications.
+#
+# Category: Malware
+#
+# Change history
+#  20130425 - added alertMsg() functionality
+#  20130117 - created
+#
+# References
+#  http://journeyintoir.blogspot.com/2010/10/anatomy-of-drive-by-part-2.html
+#  http://support.microsoft.com/kb/883260
+# 
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package attachmgr;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20130425);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Checks user's keys that manage the Attachment Manager functionality";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	my @temps;
+	
+	::logMsg("Launching attachmgr v.".$VERSION);
+	::rptMsg("attachmgr v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+	
+	my @attach = ('Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Associations',
+	             'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments');
+	
+	foreach my $key_path (@attach) {
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+			my @vals = $key->get_list_of_values();
+			if (scalar(@vals) > 0) {
+				foreach my $v (@vals) { 
+					my $name = $v->get_name();
+					my $data = $v->get_data();
+# checks added 20130425					
+# settings information derived from MS KB 883260					
+					::alertMsg("ALERT: attachmgr: ".$key_path." SaveZoneInformation value found: ".$data) if ($name eq "SaveZoneInformation");
+					::alertMsg("ALERT: attachmgr: ".$key_path." ScanWithAntiVirus value found: ".$data) if ($name eq "ScanWithAntiVirus");
+					::alertMsg("ALERT: attachmgr: ".$key_path." LowRiskFileTypes value includes exe: ".$data (if $name eq "LowRiskFileTypes" && grep(/exe/,$data));
+					
+					::rptMsg(sprintf "%-15s  %-6s",$name,$data);
+				}
+			}
+			else {
+				::rptMsg($key_path." has no values.");
+			}
+		}
+		else {
+			::rptMsg($key_path." not found.");
+		}
+		::rptMsg("");
+	}
+}
+
+1;

RecentActivity/release/rr-full/plugins/attachmgr_tln.pl

@@ -0,0 +1,83 @@
+#-----------------------------------------------------------
+# attachmgr_tln.pl
+# The Windows Attachment Manager manages how attachments are handled,
+# and settings are on a per-user basis.  Malware has been shown to access
+# these settings and make modifications.
+#
+# Category: Malware
+#
+# Change history
+#  20130425 - created
+#
+# References
+#  http://journeyintoir.blogspot.com/2010/10/anatomy-of-drive-by-part-2.html
+#  http://support.microsoft.com/kb/883260
+# 
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package attachmgr_tln;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20130425);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Checks user's keys that manage the Attachment Manager functionality (TLN)";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	my @temps;
+	
+	::logMsg("Launching attachmgr_tln v.".$VERSION);
+#	::rptMsg("attachmgr_tln v.".$VERSION); # banner
+#	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+	
+	my @attach = ('Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Associations',
+	             'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments');
+	
+	foreach my $key_path (@attach) {
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+#			::rptMsg($key_path);
+#			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+      my $lw = $key->get_timestamp();
+			my @vals = $key->get_list_of_values();
+			if (scalar(@vals) > 0) {
+				foreach my $v (@vals) { 
+					my $name = $v->get_name();
+					my $data = $v->get_data();
+# checks added 20130425					
+# settings information derived from MS KB 883260					
+					::alertMsg($lw."|ALERT|||HKCU\\".$key_path." SaveZoneInformation value found: ".$data) if ($name eq "SaveZoneInformation");
+					::alertMsg($lw."|ALERT|||HKCU\\".$key_path." ScanWithAntiVirus value found: ".$data) if ($name eq "ScanWithAntiVirus");
+					::alertMsg($lw."|ALERT|||HKCU\\".$key_path." LowRiskFileTypes value includes exe: ".$data (if $name eq "LowRiskFileTypes" && grep(/exe/,$data));
+				}
+			}
+			else {
+#				::rptMsg($key_path." has no values.");
+			}
+		}
+		else {
+#			::rptMsg($key_path." not found.");
+		}
+#		::rptMsg("");
+	}
+}
+
+1;

RecentActivity/release/rr-full/plugins/auditfail.pl

@@ -1,66 +1,68 @@
-#-----------------------------------------------------------
-# auditfail.pl
-#
-# Ref: 
-#   http://support.microsoft.com/kb/140058
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package auditfail;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20081212);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get CrashOnAuditFail value";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-my %val = (0 => "Feature is off; the system will not halt",
-           1 => "Feature is on; the system will halt when events cannot be written to the ".
-                "Security Event Log",
-           2 => "Feature is on and has been triggered; only Administrators can log in");
-           
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching auditfail v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- my $current;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		
-		my $lsa_path = "ControlSet00".$current."\\Control\\Lsa";
-		my $lsa;
-		if ($lsa = $root_key->get_subkey($lsa_path)) {
-			
-			eval {
-				my $crash = $lsa->get_value("crashonauditfail")->get_data();
-				::rptMsg("CrashOnAuditFail = ".$crash);
-				::rptMsg($val{$crash});
-			};
-			::rptMsg($@) if ($@);
-		}	
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-1;
+#-----------------------------------------------------------
+# auditfail.pl
+#
+# Ref: 
+#   http://support.microsoft.com/kb/140058
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package auditfail;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20081212);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get CrashOnAuditFail value";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+my %val = (0 => "Feature is off; the system will not halt",
+           1 => "Feature is on; the system will halt when events cannot be written to the ".
+                "Security Event Log",
+           2 => "Feature is on and has been triggered; only Administrators can log in");
+           
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching auditfail v.".$VERSION);
+	::rptMsg("auditfail v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ my $current;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		
+		my $lsa_path = "ControlSet00".$current."\\Control\\Lsa";
+		my $lsa;
+		if ($lsa = $root_key->get_subkey($lsa_path)) {
+			
+			eval {
+				my $crash = $lsa->get_value("crashonauditfail")->get_data();
+				::rptMsg("CrashOnAuditFail = ".$crash);
+				::rptMsg($val{$crash});
+			};
+			::rptMsg($@) if ($@);
+		}	
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/auditpol.pl

@@ -1,88 +1,151 @@
-#-----------------------------------------------------------
-# auditpol
-# Get the audit policy from the Security hive file
-# 
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package auditpol;
-use strict;
-
-my %config = (hive          => "Security",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 1,
-              osmask        => 22,
-              version       => 20080327);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Get audit policy from the Security hive file";	
-}
-sub getDescr{}
-sub getRefs {
-	my %refs = ("How To Determine Audit Policies from the Registry" => 
-	            "http://support.microsoft.com/default.aspx?scid=kb;EN-US;q246120");
-	return %refs;	
-}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-my %audit = (0 => "N",
-             1 => "S",
-             2 => "F",
-             3 => "S/F");
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching auditpol v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Policy\\PolAdtEv";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("auditpol");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my $data;
-		eval {
-			$data = $key->get_value("")->get_data();
-		};
-		if ($@) {
-			::rptMsg("Error occurred getting data from ".$key_path);
-			::rptMsg(" - ".$@);
-		}
-		else {
-# Check to see if auditing is enabled
-			my $enabled = unpack("C",substr($data,0,1));
-			if ($enabled) {
-				::rptMsg("Auditing is enabled.");
-# Get audit configuration settings			
-				my @vals = unpack("V*",$data);
-				::rptMsg("\tAudit System Events        = ".$audit{$vals[1]});
-				::rptMsg("\tAudit Logon Events         = ".$audit{$vals[2]});
-				::rptMsg("\tAudit Object Access        = ".$audit{$vals[3]});
-				::rptMsg("\tAudit Privilege Use        = ".$audit{$vals[4]});
-				::rptMsg("\tAudit Process Tracking     = ".$audit{$vals[5]});
-				::rptMsg("\tAudit Policy Change        = ".$audit{$vals[6]});
-				::rptMsg("\tAudit Account Management   = ".$audit{$vals[7]});
-				::rptMsg("\tAudit Dir Service Access   = ".$audit{$vals[8]});
-				::rptMsg("\tAudit Account Logon Events = ".$audit{$vals[9]});
-			}
-			else {
-				::rptMsg("**Auditing is NOT enabled.");
-			}
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-	
-}
+#-----------------------------------------------------------
+# auditpol
+# Get the audit policy from the Security hive file
+# 
+#
+# History
+#   20121128 - updated for later versions of Windows
+#   20080327 - created
+#
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package auditpol;
+use strict;
+
+my %config = (hive          => "Security",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20121128);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Get audit policy from the Security hive file";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("How To Determine Audit Policies from the Registry" => 
+	            "http://support.microsoft.com/default.aspx?scid=kb;EN-US;q246120");
+	return %refs;	
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+my %audit = (0 => "N",
+             1 => "S",
+             2 => "F",
+             3 => "S/F");
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching auditpol v.".$VERSION);
+	::rptMsg("auditpol v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Policy\\PolAdtEv";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("auditpol");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my $data;
+		eval {
+			$data = $key->get_value("")->get_data();
+			::rptMsg("Length of data: ".length($data)." bytes.");
+			
+			my @d = printData($data);
+			foreach (0..(scalar(@d) - 1)) {
+				::rptMsg($d[$_]);
+			}
+			
+		};
+		if ($@) {
+			::rptMsg("Error occurred getting data from ".$key_path);
+			::rptMsg(" - ".$@);
+		}
+		else {
+# Check to see if auditing is enabled
+			my $enabled = unpack("C",substr($data,0,1));
+			if ($enabled) {
+				::rptMsg("Auditing is enabled.");
+# Get audit configuration settings			
+				my @vals = unpack("V*",$data);
+				::rptMsg("\tAudit System Events        = ".$audit{$vals[1]});
+				::rptMsg("\tAudit Logon Events         = ".$audit{$vals[2]});
+				::rptMsg("\tAudit Object Access        = ".$audit{$vals[3]});
+				::rptMsg("\tAudit Privilege Use        = ".$audit{$vals[4]});
+				::rptMsg("\tAudit Process Tracking     = ".$audit{$vals[5]});
+				::rptMsg("\tAudit Policy Change        = ".$audit{$vals[6]});
+				::rptMsg("\tAudit Account Management   = ".$audit{$vals[7]});
+				::rptMsg("\tAudit Dir Service Access   = ".$audit{$vals[8]});
+				::rptMsg("\tAudit Account Logon Events = ".$audit{$vals[9]});
+			}
+			else {
+				::rptMsg("**Auditing is NOT enabled.");
+			}
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+
+#-----------------------------------------------------------
+# printData()
+# subroutine used primarily for debugging; takes an arbitrary
+# length of binary data, prints it out in hex editor-style
+# format for easy debugging
+#-----------------------------------------------------------
+sub printData {
+	my $data = shift;
+	my $len = length($data);
+	my $tag = 1;
+	my $cnt = 0;
+	my @display = ();
+	
+	my $loop = $len/16;
+	$loop++ if ($len%16);
+	
+	foreach my $cnt (0..($loop - 1)) {
+#	while ($tag) {
+		my $left = $len - ($cnt * 16);
+		
+		my $n;
+		($left < 16) ? ($n = $left) : ($n = 16);
+
+		my $seg = substr($data,$cnt * 16,$n);
+		my @str1 = split(//,unpack("H*",$seg));
+
+		my @s3;
+		my $str = "";
+
+		foreach my $i (0..($n - 1)) {
+			$s3[$i] = $str1[$i * 2].$str1[($i * 2) + 1];
+			
+			if (hex($s3[$i]) > 0x1f && hex($s3[$i]) < 0x7f) {
+				$str .= chr(hex($s3[$i]));
+			}
+			else {
+				$str .= "\.";
+			}
+		}
+		my $h = join(' ',@s3);
+#		::rptMsg(sprintf "0x%08x: %-47s  ".$str,($cnt * 16),$h);
+		$display[$cnt] = sprintf "0x%08x: %-47s  ".$str,($cnt * 16),$h;
+	}
+	return @display;
+}
+
+
 1;

RecentActivity/release/rr-full/plugins/autoendtasks.pl

@@ -1,66 +1,68 @@
-#-----------------------------------------------------------
-# autoendtasks.pl
-#
-# History
-#   20081128 - created
-# 
-# Ref: 
-#   http://support.microsoft.com/kb/555619
-#   This Registry setting tells XP (and Vista) to automatically
-#   end non-responsive tasks; value may not exist on Vista.
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package autoendtasks;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20081128);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Automatically end a non-responsive task";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching autoendtasks v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Control Panel\\Desktop';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-#		::rptMsg("autoendtasks");
-		::rptMsg($key_path);
-#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		my $autoend;
-		eval {
-			$autoend = $key->get_value("AutoEndTasks")->get_data();
-		};
-		if ($@) {
-			::rptMsg("AutoEndTasks value not found.");
-		}
-		else {
-			::rptMsg("AutoEndTasks = ".$autoend);
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# autoendtasks.pl
+#
+# History
+#   20081128 - created
+# 
+# Ref: 
+#   http://support.microsoft.com/kb/555619
+#   This Registry setting tells XP (and Vista) to automatically
+#   end non-responsive tasks; value may not exist on Vista.
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package autoendtasks;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20081128);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Automatically end a non-responsive task";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching autoendtasks v.".$VERSION);
+	::rptMsg("autoendtasks v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Control Panel\\Desktop';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+#		::rptMsg("autoendtasks");
+		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my $autoend;
+		eval {
+			$autoend = $key->get_value("AutoEndTasks")->get_data();
+		};
+		if ($@) {
+			::rptMsg("AutoEndTasks value not found.");
+		}
+		else {
+			::rptMsg("AutoEndTasks = ".$autoend);
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/autorun.pl

@@ -1,74 +1,76 @@
-#-----------------------------------------------------------
-# autorun.pl
-# Get autorun settings
-#
-# Change history
-#
-#
-# References
-#    http://support.microsoft.com/kb/953252
-#    http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit
-#         /regentry/91525.mspx?mfr=true
-#
-# copyright 2008-2009 H. Carvey
-#-----------------------------------------------------------
-package autorun;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20081212);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets autorun settings";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching autorun v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-#		::rptMsg($key_path);
-#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		
-		eval {
-			my $nodrive = $key->get_value("NoDriveTypeAutoRun")->get_data();
-			my $str = sprintf "%-20s 0x%x","NoDriveTypeAutoRun",$nodrive;
-			::rptMsg($str);
-		};
-		::rptMsg("Error: ".$@) if ($@);
-
-# http://support.microsoft.com/kb/953252		
-		eval {
-			my $honor = $key->get_value("HonorAutorunSetting")->get_data();
-			my $str = sprintf "%-20s 0x%x","HonorAutorunSetting",$honor;
-			::rptMsg($str);
-		};
-		::rptMsg("HonorAutorunSetting not found.") if ($@);
-		::rptMsg("");
-		::rptMsg("Autorun settings in the HKLM hive take precedence over those in");
-		::rptMsg("the HKCU hive.");
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-
-}
-
+#-----------------------------------------------------------
+# autorun.pl
+# Get autorun settings
+#
+# Change history
+#
+#
+# References
+#    http://support.microsoft.com/kb/953252
+#    http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit
+#         /regentry/91525.mspx?mfr=true
+#
+# copyright 2008-2009 H. Carvey
+#-----------------------------------------------------------
+package autorun;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20081212);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets autorun settings";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching autorun v.".$VERSION);
+	::rptMsg("autorun v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+#		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		
+		eval {
+			my $nodrive = $key->get_value("NoDriveTypeAutoRun")->get_data();
+			my $str = sprintf "%-20s 0x%x","NoDriveTypeAutoRun",$nodrive;
+			::rptMsg($str);
+		};
+		::rptMsg("Error: ".$@) if ($@);
+
+# http://support.microsoft.com/kb/953252		
+		eval {
+			my $honor = $key->get_value("HonorAutorunSetting")->get_data();
+			my $str = sprintf "%-20s 0x%x","HonorAutorunSetting",$honor;
+			::rptMsg($str);
+		};
+		::rptMsg("HonorAutorunSetting not found.") if ($@);
+		::rptMsg("");
+		::rptMsg("Autorun settings in the HKLM hive take precedence over those in");
+		::rptMsg("the HKCU hive.");
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+}
+
 1;

RecentActivity/release/rr-full/plugins/backuprestore.pl

@@ -0,0 +1,176 @@
+#-----------------------------------------------------------
+# backuprestore.pl
+#   Access System hive file to get the contents of the FilesNotToSnapshot, KeysNotToRestore, and FilesNotToBackup keys
+# 
+# Change history
+#   9/14/2012: retired the filesnottosnapshot.pl plugin since BackupRestore checks the same key
+#
+# References
+#   Troy Larson's Windows 7 presentation slide deck http://computer-forensics.sans.org/summit-archives/2010/files/12-larson-windows7-foreniscs.pdf
+#   QCCIS white paper Reliably recovering evidential data from Volume Shadow Copies http://www.qccis.com/downloads/whitepapers/QCC%20VSS
+#	http://msdn.microsoft.com/en-us/library/windows/desktop/bb891959(v=vs.85).aspx
+# 
+# copyright 2012 Corey Harrell (Journey Into Incident Response)
+#-----------------------------------------------------------
+package backuprestore;
+use strict;
+
+my %config = (hive          => "System",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120914);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets the contents of the FilesNotToSnapshot, KeysNotToRestore, and FilesNotToBackup keys";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching backuprestore v.".$VERSION);
+    ::rptMsg("backuprestore v.".$VERSION); 
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); 
+	
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		
+		my $fns_path = $ccs."\\Control\\BackupRestore\\FilesNotToSnapshot";
+		my $fns;
+		if ($fns = $root_key->get_subkey($fns_path)) {
+			::rptMsg("FilesNotToSnapshot key");
+			::rptMsg($fns_path);
+			::rptMsg("LastWrite Time ".gmtime($fns->get_timestamp())." (UTC)");
+			::rptMsg("");
+		
+			my %cv;
+			my @valfns = $fns->get_list_of_values();;
+				if (scalar(@valfns) > 0) {
+					foreach my $v (@valfns) {
+					my $name = $v->get_name();
+					my $data = $v->get_data();
+					my $len  = length($data);
+					next if ($name eq "");
+					push(@{$cv{$len}},$name." : ".$data);
+				}
+					foreach my $t (sort {$a <=> $b} keys %cv) {
+						foreach my $item (@{$cv{$t}}) {
+						::rptMsg("  $item");
+					}
+				}
+				::rptMsg("");
+				::rptMsg("The listed directories/files are not backed up in Volume Shadow Copies");
+				::rptMsg("");
+				::rptMsg("");
+		}
+		else {
+			::rptMsg($fns_path." has no values.");
+			::logMsg($fns_path." has no values.");
+			::rptMsg("");
+		}
+	}
+	else {
+		::rptMsg($fns_path." not found.");
+		::logMsg($fns_path." not found.");
+		::rptMsg("");
+	}
+	
+	my $fnb_path = $ccs."\\Control\\BackupRestore\\FilesNotToBackup";
+		my $fnb;
+		if ($fnb = $root_key->get_subkey($fnb_path)) {
+			::rptMsg("FilesNotToBackup key");
+			::rptMsg($fnb_path);
+			::rptMsg("LastWrite Time ".gmtime($fnb->get_timestamp())." (UTC)");
+			::rptMsg("");
+		
+			my %cq;
+			my @valfnb = $fnb->get_list_of_values();;
+				if (scalar(@valfnb) > 0) {
+					foreach my $v (@valfnb) {
+					my $name = $v->get_name();
+					my $data = $v->get_data();
+					my $len  = length($data);
+					next if ($name eq "");
+					push(@{$cq{$len}},$name." : ".$data);
+				}
+					foreach my $t (sort {$a <=> $b} keys %cq) {
+						foreach my $item (@{$cq{$t}}) {
+						::rptMsg("  $item");
+					}
+				}
+				::rptMsg("");
+				::rptMsg("Specifies the directories and files that backup applications should not backup or restore");
+				::rptMsg("");
+				::rptMsg("");
+		}
+		else {
+			::rptMsg($fnb_path." has no values.");
+			::logMsg($fnb_path." has no values.");
+			::rptMsg("");
+		}
+	}
+	else {
+		::rptMsg($fnb_path." not found.");
+		::logMsg($fnb_path." not found.");
+		::rptMsg("");
+	}
+	
+	my $knr_path = $ccs."\\Control\\BackupRestore\\KeysNotToRestore";
+		my $knr;
+		if ($knr = $root_key->get_subkey($knr_path)) {
+			::rptMsg("KeysNotToRestore key");
+			::rptMsg($knr_path);
+			::rptMsg("LastWrite Time ".gmtime($knr->get_timestamp())." (UTC)");
+			::rptMsg("");
+		
+			my %cw;
+			my @valknr = $knr->get_list_of_values();;
+				if (scalar(@valknr) > 0) {
+					foreach my $v (@valknr) {
+					my $name = $v->get_name();
+					my $data = $v->get_data();
+					my $len  = length($data);
+					next if ($name eq "");
+					push(@{$cw{$len}},$name." : ".$data);
+				}
+					foreach my $t (sort {$a <=> $b} keys %cw) {
+						foreach my $item (@{$cw{$t}}) {
+						::rptMsg("  $item");
+					}
+				}
+				::rptMsg("");
+				::rptMsg("Specifies the names of the registry subkeys and values that backup applications should not restore");
+				::rptMsg("");
+		}
+		else {
+			::rptMsg($knr_path." has no values.");
+			::logMsg($knr_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($knr_path." not found.");
+		::logMsg($knr_path." not found.");
+	}
+	
+	}
+
+}
+
+1;

RecentActivity/release/rr-full/plugins/banner.pl

@@ -1,127 +1,129 @@
-#-----------------------------------------------------------
-# banner
-# Get banner information from the SOFTWARE hive file (if any)
-# 
-# Written By:
-# Special Agent Brook William Minnick
-# Brook_Minnick@doioig.gov
-# U.S. Department of the Interior - Office of Inspector General
-# Computer Crimes Unit
-# 12030 Sunrise Valley Drive Suite 250
-# Reston, VA 20191
-#-----------------------------------------------------------
-package banner;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20081119);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get HKLM\\SOFTWARE.. Logon Banner Values";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching banner v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Microsoft\\Windows\\CurrentVersion\\policies\\system";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("Logon Banner Information");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-
-# GET LEGALNOTICECAPTION --
-
-		my $caption;
-		eval {
-			$caption = $key->get_value("Legalnoticecaption")->get_data();
-		};
-		if ($@) {
-			::rptMsg("Legalnoticecaption value not found.");
-		}
-		else {
-			::rptMsg("Legalnoticecaption value = ".$caption);
-		}
-		::rptMsg("");
-
-# GET LEGALNOTICETEXT --
-
-		my $banner;
-		eval {
-			$banner = $key->get_value("Legalnoticetext")->get_data();
-		};
-		if ($@) {
-			::rptMsg("Legalnoticetext value not found.");
-		}
-		else {
-			::rptMsg("Legalnoticetext value = ".$banner);
-		}
-		::rptMsg("");
-	
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-
-my $key_path = "Microsoft\\Windows NT\\CurrentVersion\\Winlogon";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-
-# GET LEGALNOTICECAPTION --
-
-		my $caption2;
-		eval {
-			$caption2 = $key->get_value("Legalnoticecaption")->get_data();
-		};
-		if ($@) {
-			::rptMsg("Legalnoticecaption value not found.");
-		}
-		else {
-			::rptMsg("Legalnoticecaption value = ".$caption2);
-		}
-		::rptMsg("");
-
-# GET LEGALNOTICETEXT --
-
-		my $banner2;
-		eval {
-			$banner2 = $key->get_value("Legalnoticetext")->get_data();
-		};
-		if ($@) {
-			::rptMsg("Legalnoticetext value not found.");
-		}
-		else {
-			::rptMsg("Legalnoticetext value = ".$banner2);
-		}
-		::rptMsg("");
-	
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-
-}
-
+#-----------------------------------------------------------
+# banner
+# Get banner information from the SOFTWARE hive file (if any)
+# 
+# Written By:
+# Special Agent Brook William Minnick
+# Brook_Minnick@doioig.gov
+# U.S. Department of the Interior - Office of Inspector General
+# Computer Crimes Unit
+# 12030 Sunrise Valley Drive Suite 250
+# Reston, VA 20191
+#-----------------------------------------------------------
+package banner;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20081119);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get HKLM\\SOFTWARE.. Logon Banner Values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching banner v.".$VERSION);
+	::rptMsg("banner v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Microsoft\\Windows\\CurrentVersion\\policies\\system";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("Logon Banner Information");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+# GET LEGALNOTICECAPTION --
+
+		my $caption;
+		eval {
+			$caption = $key->get_value("Legalnoticecaption")->get_data();
+		};
+		if ($@) {
+			::rptMsg("Legalnoticecaption value not found.");
+		}
+		else {
+			::rptMsg("Legalnoticecaption value = ".$caption);
+		}
+		::rptMsg("");
+
+# GET LEGALNOTICETEXT --
+
+		my $banner;
+		eval {
+			$banner = $key->get_value("Legalnoticetext")->get_data();
+		};
+		if ($@) {
+			::rptMsg("Legalnoticetext value not found.");
+		}
+		else {
+			::rptMsg("Legalnoticetext value = ".$banner);
+		}
+		::rptMsg("");
+	
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+my $key_path = "Microsoft\\Windows NT\\CurrentVersion\\Winlogon";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+# GET LEGALNOTICECAPTION --
+
+		my $caption2;
+		eval {
+			$caption2 = $key->get_value("Legalnoticecaption")->get_data();
+		};
+		if ($@) {
+			::rptMsg("Legalnoticecaption value not found.");
+		}
+		else {
+			::rptMsg("Legalnoticecaption value = ".$caption2);
+		}
+		::rptMsg("");
+
+# GET LEGALNOTICETEXT --
+
+		my $banner2;
+		eval {
+			$banner2 = $key->get_value("Legalnoticetext")->get_data();
+		};
+		if ($@) {
+			::rptMsg("Legalnoticetext value not found.");
+		}
+		else {
+			::rptMsg("Legalnoticetext value = ".$banner2);
+		}
+		::rptMsg("");
+	
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+}
+
 1;

RecentActivity/release/rr-full/plugins/baseline.pl

@@ -0,0 +1,81 @@
+#! c:\perl\bin\perl.exe
+#-----------------------------------------------------------
+# baseline.pl
+#
+# History
+#    20130211 - Created
+# 
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package baseline;
+use strict;
+
+my %config = (hive          => "All",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20130211);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Scans a hive file, checking sizes of binary value data";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+my %vals;
+my $count = 0;
+my %data_len = ();
+
+sub pluginmain {
+	my $class = shift;
+	my $file = shift;
+	my $reg = Parse::Win32Registry->new($file);
+	my $root_key = $reg->get_root_key;
+	::logMsg("Launching baseline v.".$VERSION);
+	::rptMsg("baseline v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	traverse($root_key);
+# Data structure containing findings is a hash of hashes	
+	::rptMsg("Total values checked    : ".$count);
+#	::rptMsg("");
+	::rptMsg("Number of binary value lengths : ".scalar(keys %data_len));
+	my @len = sort {$a <=> $b} keys %data_len;
+#	::rptMsg("Value 0: ".$len[0]);
+	::rptMsg("...");
+	my $n = scalar @len - 1;
+	for my $i (($n - 15)..$n) {
+		::rptMsg("Value ".$i.": ".$len[$i]." bytes [# times: ".$data_len{$len[$i]}."]");
+	}
+}
+
+sub traverse {
+	my $key = shift;
+#  my $ts = $key->get_timestamp();
+  
+  foreach my $val ($key->get_list_of_values()) {
+  	my $type = $val->get_type();
+  	if ($type == 0 || $type == 3) {
+  		$count++;
+  		my $data = $val->get_data();
+  		if (exists $data_len{length($data)}) {
+  			$data_len{length($data)}++;
+  		}
+  		else {
+				$data_len{length($data)} = 1;
+			}
+  	}
+  }
+  
+	foreach my $subkey ($key->get_list_of_subkeys()) {
+		traverse($subkey);
+  }
+}
+
+1;

RecentActivity/release/rr-full/plugins/bho.pl

@@ -0,0 +1,117 @@
+#-----------------------------------------------------------
+# bho
+#
+#
+# Change history:
+#  20130408 - updated to include Wow6432Node; formating updates
+#  20080418 - created
+#
+#
+# copyright 2013 QAR, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package bho;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20130408);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets Browser Helper Objects from Software hive";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("Browser Helper Objects" => 
+	             "http://msdn2.microsoft.com/en-us/library/bb250436.aspx");	
+	return %refs;
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching bho v.".$VERSION);
+	::rptMsg("bho v.".$VERSION); # banner
+  ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	my @paths = ("Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects",
+	             "Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects");
+	
+	foreach my $key_path (@paths) {
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+			::rptMsg("");
+			my @subkeys = $key->get_list_of_subkeys();
+			if (scalar (@subkeys) > 0) {
+				foreach my $s (@subkeys) {
+					my $name = $s->get_name();
+					next if ($name =~ m/^-/);
+					my $clsid_path = "Classes\\CLSID\\".$name;
+					my $clsid;
+					my %bhos;
+					if ($clsid = $root_key->get_subkey($clsid_path)) {
+						my $class;
+						my $mod;
+						my $lastwrite;
+					
+						eval {
+							$class = $clsid->get_value("")->get_data();
+							$bhos{$name}{class} = $class;
+						};
+						if ($@) {
+							::logMsg("Error getting Class name for CLSID\\".$name);
+							::logMsg("\t".$@);
+						}
+						eval {
+							$mod = $clsid->get_subkey("InProcServer32")->get_value("")->get_data();
+							$bhos{$name}{module} = $mod;
+						};
+						if ($@) {
+							::logMsg("\tError getting Module name for CLSID\\".$name);
+							::logMsg("\t".$@);
+						}
+						eval{
+							$lastwrite = $clsid->get_subkey("InProcServer32")->get_timestamp();
+							$bhos{$name}{lastwrite} = $lastwrite;
+						};
+						if ($@) {
+							::logMsg("\tError getting LastWrite time for CLSID\\".$name);
+							::logMsg("\t".$@);
+						}
+					
+						foreach my $b (keys %bhos) {
+							::rptMsg($b);
+							::rptMsg("  Class     => ".$bhos{$b}{class});
+							::rptMsg("  Module    => ".$bhos{$b}{module});
+							::rptMsg("  LastWrite => ".gmtime($bhos{$b}{lastwrite}));
+							::rptMsg("");
+						}
+					}
+					else {
+						::rptMsg($clsid_path." not found.");
+						::rptMsg("");
+					}
+				}
+			}
+			else {
+				::rptMsg($key_path." has no subkeys.  No BHOs installed.");
+			}
+		}
+		else {
+			::rptMsg($key_path." not found.");
+		}
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/bitbucket.pl

@@ -1,81 +1,83 @@
-#-----------------------------------------------------------
-# bitbucket
-# Get HKLM\..\BitBucket keys\values (if any)
-# 
-# Change history
-#   20091020 - Updated; collected additional values
-#
-# References
-#
-# copyright 2009 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package bitbucket;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20080418);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get HKLM\\..\\BitBucket keys\\values";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching bitbucket v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Microsoft\\Windows\\CurrentVersion\\Explorer\\BitBucket";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		eval {
-			my $global = $key->get_value("UseGlobalSettings")->get_data();
-			::rptMsg("UseGlobalSettings = ".$global);
-		};
-		
-		eval {
-			my $nuke = $key->get_value("NukeOnDelete")->get_data();
-			::rptMsg("NukeOnDelete      = ".$nuke);
-		};	
-		::rptMsg("");
-		
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) {
-				::rptMsg($key_path."\\".$s->get_name());
-				::rptMsg("LastWrite Time = ".gmtime($s->get_timestamp())." (UTC)");
-				eval {
-					my $vol = $s->get_value("VolumeSerialNumber")->get_data();
-					::rptMsg("VolumeSerialNumber = 0x".uc(sprintf "%1x",$vol));
-				};
-				::rptMsg("");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# bitbucket
+# Get HKLM\..\BitBucket keys\values (if any)
+# 
+# Change history
+#   20091020 - Updated; collected additional values
+#
+# References
+#
+# copyright 2009 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package bitbucket;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20080418);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get HKLM\\..\\BitBucket keys\\values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching bitbucket v.".$VERSION);
+	::rptMsg("bitbucket v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Microsoft\\Windows\\CurrentVersion\\Explorer\\BitBucket";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		eval {
+			my $global = $key->get_value("UseGlobalSettings")->get_data();
+			::rptMsg("UseGlobalSettings = ".$global);
+		};
+		
+		eval {
+			my $nuke = $key->get_value("NukeOnDelete")->get_data();
+			::rptMsg("NukeOnDelete      = ".$nuke);
+		};	
+		::rptMsg("");
+		
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) {
+				::rptMsg($key_path."\\".$s->get_name());
+				::rptMsg("LastWrite Time = ".gmtime($s->get_timestamp())." (UTC)");
+				eval {
+					my $vol = $s->get_value("VolumeSerialNumber")->get_data();
+					::rptMsg("VolumeSerialNumber = 0x".uc(sprintf "%1x",$vol));
+				};
+				::rptMsg("");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/bitbucket_user.pl

@@ -1,71 +1,73 @@
-#-----------------------------------------------------------
-# bitbucket_user
-# Get HKLM\..\BitBucket keys\values (if any)
-# 
-# Change history
-#
-# References
-#
-# NOTE: In limited testing, the volume letter subkeys beneath the
-#       BitBucket key appear to be volatile.
-#
-# copyright 2009 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package bitbucket_user;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20091020);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "TEST - Get user BitBucket values";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching bitbucket_user v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BitBucket";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) {
-				::rptMsg($key_path."\\".$s->get_name());
-				::rptMsg("LastWrite Time = ".gmtime($s->get_timestamp())." (UTC)");
-				eval {
-					my $purge = $s->get_value("NeedToPurge")->get_data();
-					::rptMsg("  NeedToPurge = ".$purge);
-				};
-				::rptMsg("");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# bitbucket_user
+# Get HKLM\..\BitBucket keys\values (if any)
+# 
+# Change history
+#
+# References
+#
+# NOTE: In limited testing, the volume letter subkeys beneath the
+#       BitBucket key appear to be volatile.
+#
+# copyright 2009 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package bitbucket_user;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20091020);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "TEST - Get user BitBucket values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching bitbucket_user v.".$VERSION);
+	::rptMsg("bitbucket_user v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BitBucket";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) {
+				::rptMsg($key_path."\\".$s->get_name());
+				::rptMsg("LastWrite Time = ".gmtime($s->get_timestamp())." (UTC)");
+				eval {
+					my $purge = $s->get_value("NeedToPurge")->get_data();
+					::rptMsg("  NeedToPurge = ".$purge);
+				};
+				::rptMsg("");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/brisv.pl

@@ -1,63 +1,69 @@
-#-----------------------------------------------------------
-# brisv.pl
-# Plugin to detect the presence of Trojan.Brisv.A
-# Symantec write-up: http://www.symantec.com/security_response/writeup.jsp
-#                    ?docid=2008-071823-1655-99
-#
-# Change History:
-#   20090210: Created
-#
-# Info on URLAndExitCommandsEnabled value:
-#   http://support.microsoft.com/kb/828026
-#
-# copyright 2009 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package brisv;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20090210);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Detect artifacts of a Troj\.Brisv\.A infection";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching brisv v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Software\\Microsoft\\PIMSRV";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my $mp_path = "Software\\Microsoft\\MediaPlayer\\Preferences";
-		my $url;
-		eval {
-			$url = $key->get_subkey($mp_path)->get_value("URLAndExitCommandsEnabled")->get_data();
-			::rptMsg($mp_path."\\URLAndExitCommandsEnabled value set to ".$url);
-		};
-# if an error occurs within the eval{} statement, do nothing		
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# brisv.pl
+# Plugin to detect the presence of Trojan.Brisv.A
+# Symantec write-up: http://www.symantec.com/security_response/writeup.jsp
+#                    ?docid=2008-071823-1655-99
+#
+# Change History:
+#   20130429: added alertMsg() functionality
+#   20090210: Created
+#
+# Info on URLAndExitCommandsEnabled value:
+#   http://support.microsoft.com/kb/828026
+#   http://www.hispasec.com/laboratorio/GetCodecAnalysis.pdf
+#
+# copyright 2013 QAR, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package brisv;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20130429);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Detect artifacts of a Troj\.Brisv\.A infection";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching brisv v.".$VERSION);
+	::rptMsg("brisv v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\PIMSRV";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my $mp_path = "Software\\Microsoft\\MediaPlayer\\Preferences";
+		my $url;
+		eval {
+			$url = $key->get_subkey($mp_path)->get_value("URLAndExitCommandsEnabled")->get_data();
+			::rptMsg($mp_path."\\URLAndExitCommandsEnabled value set to ".$url);
+			::alertMsg($mp_path."\\URLAndExitCommandsEnabled value set: ".$url);
+		};
+# if an error occurs within the eval{} statement, do nothing		
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/btconfig.pl

@@ -0,0 +1,80 @@
+#-----------------------------------------------------------
+# btconfig.pl
+#
+#
+# History:
+#  20130117 - created
+#
+# copyright 2013 Quantum Research Analytics, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package btconfig;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20130117);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Determines BlueTooth devices 'seen' by BroadComm drivers";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching btconfig v.".$VERSION);
+	::rptMsg("Launching btconfig v.".$VERSION);
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'WidComm\\BTConfig\\Devices';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my @sk = $key->get_list_of_subkeys();
+		foreach my $s (@sk) {
+			my $name = $s->get_name();
+			my $lw   = $s->get_timestamp();
+			
+			::rptMsg("Unique ID: ".$name);
+			::rptMsg("  LastWrite: ".gmtime($lw)." Z");
+			
+			my $devname;
+			eval {
+# May need to work on parsing the binary "Name" value data into an actual name...
+				my @str1 = split(//,unpack("H*",$s->get_value("Name")->get_data()));
+				my @s3;
+				my $str;
+				foreach my $i (0..((scalar(@str1)/2) - 1)) {
+					$s3[$i] = $str1[$i * 2].$str1[($i * 2) + 1];
+					if (hex($s3[$i]) > 0x1f && hex($s3[$i]) < 0x7f) {
+						$str .= chr(hex($s3[$i]));
+					}
+					else {
+						$str .= "";
+					}
+				}
+				::rptMsg("  Device Name: ".$str);
+			};
+			
+			::rptMsg("");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/bthport.pl

@@ -0,0 +1,101 @@
+#-----------------------------------------------------------
+# bthport.pl
+# Get BlueTooth device information from the Registry; assumes
+# MS drivers (other drivers, such as BroadComm, will be found in
+# other locations)
+# 
+# Change history
+#   20130115 - created
+#
+# Category:
+# 
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package bthport;
+use strict;
+
+my %config = (hive          => "System",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20130115);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets Bluetooth-connected devices from System hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching bthport v.".$VERSION);
+	::rptMsg("bthport v.".$VERSION); # banner
+::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		my $cn_path = $ccs."\\services\\BTHPORT\\Parameters\\Devices";
+		my $cn;
+		if ($cn = $root_key->get_subkey($cn_path)) {
+			::rptMsg($cn_path);
+			::rptMsg("LastWrite: ".gmtime($cn->get_timestamp())." UTC");
+			
+			my @sk = $cn->get_list_of_subkeys();
+			if (scalar(@sk) > 0) {
+				::rptMsg("");
+				foreach my $s (@sk) {
+					my $name = $s->get_name();
+					my $lw   = $s->get_timestamp();
+					::rptMsg("Device Unique ID: ".$name);
+# Note: Need to get VID and PID values for translation and mapping					
+					my $devname;
+					eval {
+# May need to work on parsing the binary "Name" value data into an actual name...
+						my @str1 = split(//,unpack("H*",$s->get_value("Name")->get_data()));
+						my @s3;
+						my $str;
+						foreach my $i (0..((scalar(@str1)/2) - 1)) {
+							$s3[$i] = $str1[$i * 2].$str1[($i * 2) + 1];
+							if (hex($s3[$i]) > 0x1f && hex($s3[$i]) < 0x7f) {
+								$str .= chr(hex($s3[$i]));
+							}
+							else {
+								$str .= " ";
+							}
+						}
+						::rptMsg("Device Name: ".$str);
+					};
+					
+				}
+			}
+			else {
+				::rptMsg($cn_path." has no subkeys.");
+			}
+		}
+		else {
+			::rptMsg($cn_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+
+}
+
+1;

RecentActivity/release/rr-full/plugins/cain.pl

@@ -0,0 +1,93 @@
+#-----------------------------------------------------------
+# cain.pl
+#   Extracts details for Cain & Abel by oxid.it
+# 
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+#
+# Copyright (c) 2011-02-04 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package cain;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20110204);
+my $VERSION = getVersion();
+
+# Functions #
+sub getDescr {}
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getShortDescr {
+	return "Extracts details for Cain & Abel by oxid.it";
+}
+sub getRefs {
+	my %refs = ("Cain & Abel Homepage:" =>
+	            "http://www.oxid.it/cain.html");
+	return %refs;	
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+
+	# Initialize #
+	::logMsg("Launching cain v.".$VERSION);
+    ::rptMsg("cain v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # 20110830 [fpi] + banner    
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\Cain\\Settings";
+
+	# If # Cain path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("Cain");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from Cain registry path #
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for Cain registry path #
+			foreach my $v (@vals) {
+				::rptMsg($v->get_name()." -> ".$v->get_data());
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # Cain isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;

RecentActivity/release/rr-full/plugins/ccleaner.pl

@@ -0,0 +1,79 @@
+#-----------------------------------------------------------
+# ccleaner.pl
+#   Gets CCleaner User Settings
+#
+# Change history
+#   20120128 [ale] % Initial Version based on warcraft3.pl plugin
+#
+# References
+#
+# Author: Adrian Leong <cheeky4n6monkey@gmail.com>
+#-----------------------------------------------------------
+package ccleaner;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120128);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets User's CCleaner Settings";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift; # pops the first element off @_ ie the parameter array passed in to pluginmain 
+	my $hive = shift; # 1st element in @_ is class/package name (ccleaner), 2nd is the hive name passed in from rip.pl 
+	::logMsg("Launching ccleaner v.".$VERSION);
+	::rptMsg("ccleaner v.".$VERSION);
+	::rptMsg("(".getHive().") ".getShortDescr()."\n");
+	my $reg = Parse::Win32Registry->new($hive); # creates a Win32Registry object 
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\Piriform\\CCleaner";
+	# If CCleaner key_path exists ... ie get_subkey returns a non-empty value
+	if ($key = $root_key->get_subkey($key_path)) {
+		# Print registry key name and last modified date 
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my %cckeys; # temporary associative array for storing name / value pairs eg ("UpdateCheck", 1)
+		# Extract ccleaner key values into ccvals array 
+		# Note: ccvals becomes an array of "Parse::Win32Registry::WinNT::Value"
+		# As this is implemented in an Object oriented manner, we cannot access the values directly -
+		# we have to use the "get_name" and "get_value" subroutines
+		my @ccvals = $key->get_list_of_values();
+		# If ccvals has any "Values" in it, call "Value::get_name" and "Value::get_data" for each 
+		# and store the results in the %cckeys associative array using data returned by Value::get_name as the id/index
+		# and Value::get_data for the actual key value
+		if (scalar(@ccvals) > 0) {
+			foreach my $val (@ccvals) {
+				$cckeys{$val->get_name()} = $val->get_data();
+			}
+			# Sorts keynames into a temp list and then prints each key name + value in list order
+			# the values are retrieved from cckeys assoc. array which was populated in the previous foreach loop
+			foreach my $keyval (sort keys %cckeys) {
+				::rptMsg($keyval." -> ".$cckeys{$keyval});
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." does not exist.");
+	}
+	# Return obligatory new-line
+	::rptMsg("");
+}
+
+1;

RecentActivity/release/rr-full/plugins/clampi.pl

@@ -1,120 +1,122 @@
-#-----------------------------------------------------------
-# clampi.pl
-# Checks keys/values set by new version of Trojan.Clampi
-#
-# Change history
-#   20091019 - created
-#
-# NOTE: This is purely a test plugin, and based solely on the below
-#       reference.  It has not been tested on any systems that were
-#       known to be infected.
-#
-# References
-#   http://www.symantec.com/connect/blogs/inside-trojanclampi-stealing-your-information
-# 
-# copyright 2009 H. Carvey
-#-----------------------------------------------------------
-package clampi;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20091019);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "TEST - Checks for keys set by Trojan\.Clampi PROT module";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching clampi v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-	
-	my $count = 0;
-	
-	my $key_path = 'Software\\Microsoft\\Internet Explorer\\Main';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my ($form1, $form2, $form3);
-		
-		eval {
-			$form1 = $key->get_value("Use FormSuggest")->get_data();
-			::rptMsg("\tUse FormSuggest = ".$form1);
-			$count++ if ($form1 eq "true");
-		};
-		
-		eval {
-			$form2 = $key->get_value("FormSuggest_Passwords")->get_data();
-			::rptMsg("\tFormSuggest_Passwords = ".$form2);
-			$count++ if ($form2 eq "true");
-		};
-		
-		eval {
-			$form3 = $key->get_value("FormSuggest_PW_Ask")->get_data();
-			::rptMsg("\tUse FormSuggest = ".$form3);
-			$count++ if ($form3 eq "no");
-		};
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-	::rptMsg("");
-	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoComplete";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		my $auto;
-		eval {
-			$auto = $key->get_value("AutoSuggest")->get_data();
-			::rptMsg("\tAutoSuggest = ".$auto);
-			$count++ if ($auto eq "true");
-		};
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-	::rptMsg("");
-	my $key_path = "Software\\Microsoft\\Internet Account Manager\\Accounts";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		my $prompt;
-		eval {
-			$prompt = $key->get_value("POP3 Prompt for Password")->get_data();
-			::rptMsg("\tPOP3 Prompt for Password = ".$prompt);
-			$count++ if ($prompt eq "true");
-		};
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-	::rptMsg("");
-	if ($count == 5) {
-		::rptMsg("The system may have been infected with the Trojan.Clampi PROT module.");
-	}
-	else {
-		::rptMsg("The system does not appear to have been infected with the Trojan.Clampi");
-		::rptMsg("PROT module.");
-	}
-}
+#-----------------------------------------------------------
+# clampi.pl
+# Checks keys/values set by new version of Trojan.Clampi
+#
+# Change history
+#   20091019 - created
+#
+# NOTE: This is purely a test plugin, and based solely on the below
+#       reference.  It has not been tested on any systems that were
+#       known to be infected.
+#
+# References
+#   http://www.symantec.com/connect/blogs/inside-trojanclampi-stealing-your-information
+# 
+# copyright 2009 H. Carvey
+#-----------------------------------------------------------
+package clampi;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20091019);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "TEST - Checks for keys set by Trojan\.Clampi PROT module";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching clampi v.".$VERSION);
+	 ::rptMsg("clampi v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+	
+	my $count = 0;
+	
+	my $key_path = 'Software\\Microsoft\\Internet Explorer\\Main';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my ($form1, $form2, $form3);
+		
+		eval {
+			$form1 = $key->get_value("Use FormSuggest")->get_data();
+			::rptMsg("\tUse FormSuggest = ".$form1);
+			$count++ if ($form1 eq "true");
+		};
+		
+		eval {
+			$form2 = $key->get_value("FormSuggest_Passwords")->get_data();
+			::rptMsg("\tFormSuggest_Passwords = ".$form2);
+			$count++ if ($form2 eq "true");
+		};
+		
+		eval {
+			$form3 = $key->get_value("FormSuggest_PW_Ask")->get_data();
+			::rptMsg("\tUse FormSuggest = ".$form3);
+			$count++ if ($form3 eq "no");
+		};
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+	::rptMsg("");
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoComplete";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my $auto;
+		eval {
+			$auto = $key->get_value("AutoSuggest")->get_data();
+			::rptMsg("\tAutoSuggest = ".$auto);
+			$count++ if ($auto eq "true");
+		};
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+	::rptMsg("");
+	my $key_path = "Software\\Microsoft\\Internet Account Manager\\Accounts";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my $prompt;
+		eval {
+			$prompt = $key->get_value("POP3 Prompt for Password")->get_data();
+			::rptMsg("\tPOP3 Prompt for Password = ".$prompt);
+			$count++ if ($prompt eq "true");
+		};
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+	::rptMsg("");
+	if ($count == 5) {
+		::rptMsg("The system may have been infected with the Trojan.Clampi PROT module.");
+	}
+	else {
+		::rptMsg("The system does not appear to have been infected with the Trojan.Clampi");
+		::rptMsg("PROT module.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/clampitm.pl

@@ -1,78 +1,80 @@
-#-----------------------------------------------------------
-# clampitm.pl
-# Checks keys/values set by new version of Trojan.Clampi
-#
-# Change history
-#   20100624 - created
-#
-# NOTE: This is purely a test plugin, and based solely on the below
-#       reference.  It has not been tested on any systems that were
-#       known to be infected.
-#
-# References
-#   http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/ilomo_external.pdf
-# 
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package clampitm;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20100624);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Checks for IOCs for Clampi (per Trend Micro)";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching clampitm v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-	
-	my $count = 0;
-	
-	my $key_path = 'Software\\Microsoft\\Internet Explorer\\Settings';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("ClampiTM plugin");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my $tag = 1;
-		my @list = qw/GatesList GID KeyE KeyM PID/;
-		my @vals = $key->get_list_of_values();
-		if (scalar (@vals) > 0) {
-			foreach my $v (@vals) {
-				my $name = $v->get_name();
-				if (grep(/$name/,@list)) {
-					::rptMsg(sprintf "%-10s %-30s",$name,$v->get_data());
-					$tag = 0;
-				}
-			}
-			if ($tag) {
-				::rptMsg("No Clampi values found.");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# clampitm.pl
+# Checks keys/values set by new version of Trojan.Clampi
+#
+# Change history
+#   20100624 - created
+#
+# NOTE: This is purely a test plugin, and based solely on the below
+#       reference.  It has not been tested on any systems that were
+#       known to be infected.
+#
+# References
+#   http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/ilomo_external.pdf
+# 
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package clampitm;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20100624);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Checks for IOCs for Clampi (per Trend Micro)";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching clampitm v.".$VERSION);
+	::rptMsg("clampitm v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+	
+	my $count = 0;
+	
+	my $key_path = 'Software\\Microsoft\\Internet Explorer\\Settings';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("ClampiTM plugin");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my $tag = 1;
+		my @list = qw/GatesList GID KeyE KeyM PID/;
+		my @vals = $key->get_list_of_values();
+		if (scalar (@vals) > 0) {
+			foreach my $v (@vals) {
+				my $name = $v->get_name();
+				if (grep(/$name/,@list)) {
+					::rptMsg(sprintf "%-10s %-30s",$name,$v->get_data());
+					$tag = 0;
+				}
+			}
+			if ($tag) {
+				::rptMsg("No Clampi values found.");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/clsid.pl

@@ -1,80 +1,82 @@
-#-----------------------------------------------------------
-# clsid.pl
-# Plugin to extract file association data from the Software hive file
-# Can take considerable time to run; recommend running it via rip.exe
-#
-# History
-#   20100227 - created
-#
-# References
-#   http://msdn.microsoft.com/en-us/library/ms724475%28VS.85%29.aspx
-#
-# copyright 2010, Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package clsid;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20100227);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get list of CLSID/registered classes";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	my %clsid;
-	::logMsg("Launching clsid v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Classes\\CLSID";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-# First step will be to get a list of all of the file extensions
-		my %ext;
-		my @sk = $key->get_list_of_subkeys();
-		if (scalar(@sk) > 0) {
-			foreach my $s (@sk) {
-				
-				my $name = $s->get_name();
-				eval {
-					my $n = $s->get_value("")->get_data();
-					$name .= "  ".$n unless ($n eq "");
-				};
-				
-				push(@{$clsid{$s->get_timestamp()}},$name);
-			}
-			
-			foreach my $t (reverse sort {$a <=> $b} keys %clsid) {
-				::rptMsg(gmtime($t)." Z");
-				foreach my $item (@{$clsid{$t}}) {
-					::rptMsg("  ".$item);
-				}
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# clsid.pl
+# Plugin to extract file association data from the Software hive file
+# Can take considerable time to run; recommend running it via rip.exe
+#
+# History
+#   20100227 - created
+#
+# References
+#   http://msdn.microsoft.com/en-us/library/ms724475%28VS.85%29.aspx
+#
+# copyright 2010, Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package clsid;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20100227);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get list of CLSID/registered classes";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	my %clsid;
+	::logMsg("Launching clsid v.".$VERSION);
+	::rptMsg("clsid v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Classes\\CLSID";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+# First step will be to get a list of all of the file extensions
+		my %ext;
+		my @sk = $key->get_list_of_subkeys();
+		if (scalar(@sk) > 0) {
+			foreach my $s (@sk) {
+				
+				my $name = $s->get_name();
+				eval {
+					my $n = $s->get_value("")->get_data();
+					$name .= "  ".$n unless ($n eq "");
+				};
+				
+				push(@{$clsid{$s->get_timestamp()}},$name);
+			}
+			
+			foreach my $t (reverse sort {$a <=> $b} keys %clsid) {
+				::rptMsg(gmtime($t)." Z");
+				foreach my $item (@{$clsid{$t}}) {
+					::rptMsg("  ".$item);
+				}
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/cmd_shell.pl

@@ -1,75 +1,114 @@
-#-----------------------------------------------------------
-# cmd_shell
-# 
-#
-# Change History
-#   20100830 - added "cs" shell command to the path
-#   20080328 - created
-# 
-# References
-#   http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?
-#        Name=TrojanClicker%3AWin32%2FVB.GE
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package cmd_shell;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 1,
-              version       => 20100830);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Gets shell open cmds for various file types";	
-}
-sub getDescr{}
-sub getRefs {
-	my %refs = ("You Are Unable to Start a Program with an .exe File Extension" =>
-	            "http://support.microsoft.com/kb/310585");
-	return %refs;	
-}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching cmd_shell v.".$VERSION);
-	
-	my @shells = ("exe","cmd","bat","cs","hta","pif");
-	
-	foreach my $sh (@shells) {
-		
-		my $reg = Parse::Win32Registry->new($hive);
-		my $root_key = $reg->get_root_key;
-
-		my $key_path = "Classes\\".$sh."file\\shell\\open\\command";
-		my $key;
-		if ($key = $root_key->get_subkey($key_path)) {
-			::rptMsg("cmd_shell");
-			::rptMsg($key_path);
-			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-			::rptMsg("");
-			my $val;
-			eval {
-				$val = $key->get_value("")->get_data();
-				::rptMsg("\tCmd: ".$val);
-			};
-			::rptMsg("Error: ".$@) if ($@);
-		
-		}
-		else {
-			::rptMsg($key_path." not found.");
-			::logMsg($key_path." not found.");
-		}
-	}
-	::rptMsg("");
-}
+#-----------------------------------------------------------
+# cmd_shell
+# 
+# Change History
+#   20130405 - added Clients subkey
+#   20100830 - added "cs" shell command to the path
+#   20080328 - created
+# 
+# References
+#   http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?
+#        Name=TrojanClicker%3AWin32%2FVB.GE
+#
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package cmd_shell;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              version       => 20130405);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets shell open cmds for various file types";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("You Are Unable to Start a Program with an .exe File Extension" =>
+	            "http://support.microsoft.com/kb/310585");
+	return %refs;	
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching cmd_shell v.".$VERSION);
+	::rptMsg("cmd_shell v.".$VERSION); # banner
+  ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my @shells = ("exe","cmd","bat","cs","hta","pif");
+	
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	foreach my $sh (@shells) {
+		my $key_path = "Classes\\".$sh."file\\shell\\open\\command";
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#			::rptMsg("");
+			my $val;
+			eval {
+				$val = $key->get_value("")->get_data();
+				::rptMsg("  Cmd: ".$val);
+				
+				if ($sh eq "hta") {
+					if ($val eq "C:\\Windows\\SysWOW64\\mshta\.exe \"%1\" %*" || $val eq "C:\\WINDOWS\\system32\\mshta\.exe \"%1\" %*") {
+						
+					}
+					else {
+						::alertMsg("ALERT: cmd_shell: ".$key_path." warning: ".$val);
+					}
+				}
+				else {
+					::alertMsg("ALERT: cmd_shell: ".$key_path." warning: ".$val) unless ($val eq "\"%1\" %*");
+				}
+				
+				::rptMsg("");
+			};
+			::rptMsg("Error: ".$@) if ($@);
+		
+		}
+		else {
+			::rptMsg($key_path." not found.");
+			::rptMsg("");
+		}
+	}
+	::rptMsg("");
+	
+	my $key_path = "Clients\\StartMenuInternet\\IExplore.exe\\shell\\open\\command";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		
+		eval {
+			my $cmd = $key->get_value("")->get_data();
+			::rptMsg("  Cmd: ".$cmd);
+			
+			if ($cmd eq "\"C:\\Program Files\\Internet Explorer\\iexplore\.exe\"" || 
+			  $cmd eq "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore\.exe\"") {
+			  
+			}
+			else {
+				::alertMsg("ALERT: cmd_shell: ".$key_path." warning: ".$cmd);
+			}
+		};
+		::rptMsg("Error: ".$@) if ($@);
+	}
+	else {
+		::rptMsg($key_path." not found\.");
+	}
+
+}
 1;

RecentActivity/release/rr-full/plugins/cmd_shell_tln.pl

@@ -0,0 +1,111 @@
+#-----------------------------------------------------------
+# cmd_shell_tln
+# 
+# Change History
+#   20130425 - created
+# 
+# References
+#   http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?
+#        Name=TrojanClicker%3AWin32%2FVB.GE
+#
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package cmd_shell_tln;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              version       => 20130425);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets shell open cmds for various file types";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("You Are Unable to Start a Program with an .exe File Extension" =>
+	            "http://support.microsoft.com/kb/310585");
+	return %refs;	
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching cmd_shell_tln v.".$VERSION);
+#	::rptMsg("cmd_shell v.".$VERSION); # banner
+#  ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my @shells = ("exe","cmd","bat","cs","hta","pif");
+	
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	foreach my $sh (@shells) {
+		my $key_path = "Classes\\".$sh."file\\shell\\open\\command";
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+#			::rptMsg($key_path);
+#			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#			::rptMsg("");
+      my $lw = $key->get_timestamp();
+			my $val;
+			eval {
+				$val = $key->get_value("")->get_data();
+#				::rptMsg("  Cmd: ".$val);
+				
+				if ($sh eq "hta") {
+					if ($val eq "C:\\Windows\\SysWOW64\\mshta\.exe \"%1\" %*" || $val eq "C:\\WINDOWS\\system32\\mshta\.exe \"%1\" %*") {
+						
+					}
+					else {
+#						::alertMsg("ALERT: cmd_shell: ".$key_path." warning: ".$val);
+						::alertMsg($lw."|ALERT|||Software\\".$key_path." warning: ".$val);
+					}
+				}
+				else {
+#					::alertMsg("ALERT: cmd_shell: ".$key_path." warning: ".$val) unless ($val eq "\"%1\" %*");
+					::alertMsg($lw."|ALERT|||Software\\".$key_path." warning: ".$val) unless ($val eq "\"%1\" %*");
+				}
+			};
+
+		}
+		else {
+#			::rptMsg($key_path." not found.");
+#			::rptMsg("");
+		}
+	}
+#	::rptMsg("");
+	
+	my $key_path = "Clients\\StartMenuInternet\\IExplore.exe\\shell\\open\\command";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+#		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		my $lw = $key->get_timestamp();
+		eval {
+			my $cmd = $key->get_value("")->get_data();
+#			::rptMsg("  Cmd: ".$cmd);
+			
+			if ($cmd eq "\"C:\\Program Files\\Internet Explorer\\iexplore\.exe\"" || 
+			  $cmd eq "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore\.exe\"") {
+			  
+			}
+			else {
+				::alertMsg($lw."|ALERT|||Software\\".$key_path." warning: ".$cmd);
+			}
+		};
+#		::rptMsg("Error: ".$@) if ($@);
+	}
+	else {
+#		::rptMsg($key_path." not found\.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/cmd_shell_u.pl

@@ -0,0 +1,67 @@
+#-----------------------------------------------------------
+# cmd_shell_u
+# Get the shell\open\command settings for various file types; gets
+#  info from USRCLASS.DAT hives, where Classes data is maintained on
+#  Win7
+#
+# Change History
+#   20130405 - created
+#
+# copyright 2013 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package cmd_shell_u;
+use strict;
+
+my %config = (hive          => "USRCLASS\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20130405);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets shell open cmds for various file types from USRCLASS\.DAT";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching cmd_shell_u v.".$VERSION);
+	::rptMsg("cmd_shell_u v.".$VERSION); # banner
+  ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my @shells = ("\.exe","exefile","ftp","http","https");
+	
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	foreach my $sh (@shells) {
+		my $key_path = $sh."\\shell\\open\\command";
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#			::rptMsg("");
+			my $val;
+			eval {
+				$val = $key->get_value("")->get_data();
+				::rptMsg("  Cmd: ".$val);
+				::rptMsg("");
+			};
+			::rptMsg("Error: ".$@) if ($@);
+		}
+		else {
+			::rptMsg($key_path." not found.");
+		}
+	}
+	::rptMsg("");
+}
+1;

RecentActivity/release/rr-full/plugins/cmdproc.pl

@@ -0,0 +1,67 @@
+#-----------------------------------------------------------
+# cmdproc.pl
+# Checks key for files to autostart from cmd.exe
+#
+# Change History
+#   20130425 - added alertMsg() functionality
+#   20130115 - created
+#
+# References:
+#   
+# Category: autostart,malware,programexecution 
+#
+# copyright 2013 Quantum Analytics Research,
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package cmdproc;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20130425);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Autostart - get Command Processor\\AutoRun value from NTUSER\.DAT hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching cmdproc v.".$VERSION);
+	::rptMsg("cmdproc v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	my $key_path = "Software\\Microsoft\\Command Processor";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		
+		my $auto;
+		eval {
+			$auto = $key->get_value("AutoRun")->get_data();
+			::rptMsg("AutoRun = ".$auto);
+			::alertMsg("ALERT: cmdproc: ".$key_path." AutoRun value found: ".$auto);
+		};
+		if ($@) {
+			::rptMsg("AutoRun value not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/cmdproc_tln.pl

@@ -0,0 +1,67 @@
+#-----------------------------------------------------------
+# cmdproc_tln.pl
+# Checks key for files to autostart from cmd.exe
+#
+# Change History
+#   20130425 - created
+#
+# References:
+#   
+# Category: autostart,malware,programexecution 
+#
+# copyright 2013 Quantum Analytics Research,
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package cmdproc_tln;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20130425);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Autostart - get Command Processor\\AutoRun value from NTUSER\.DAT hive (TLN)";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching cmdproc_tln v.".$VERSION);
+#	::rptMsg("cmdproc v.".$VERSION); # banner
+#	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	
+	my $key_path = "Software\\Microsoft\\Command Processor";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+#		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+	  my $lw = $key->get_timestamp();
+		my $auto;
+		eval {
+			$auto = $key->get_value("AutoRun")->get_data();
+#			::rptMsg("AutoRun = ".$auto);
+#			::alertMsg("ALERT: cmdproc: ".$key_path." AutoRun value found: ".$auto);
+			::alertMsg($lw."|ALERT|||HKCU\\".$key_path." AutoRun value found: ".$auto);
+		};
+		if ($@) {
+#			::rptMsg("AutoRun value not found.");
+		}
+	}
+	else {
+#		::rptMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/codeid.pl

@@ -1,75 +1,77 @@
-#-----------------------------------------------------------
-# codeid
-# Get DefaultLevel value from CodeIdentifiers key
-# 
-#
-# Change History
-#   20100608 - created
-#
-# References
-#   SANS ISC blog - http://isc.sans.edu/diary.html?storyid=8917
-#   CodeIdentifiers key
-#       - http://technet.microsoft.com/en-us/library/bb457006.aspx
-#   SAFER_LEVELID_FULLYTRUSTED value 
-#       - http://msdn.microsoft.com/en-us/library/ms722424%28VS.85%29.aspx
-#         (262144 == Unrestricted)
-# 
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package codeid;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20100608);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Gets CodeIdentifier DefaultLevel value";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching codeid v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("CodeID");
-		::rptMsg($key_path);
-		my $lastwrite = $key->get_timestamp();
-		::rptMsg("  LastWrite time: ".gmtime($lastwrite)." Z");
-		::rptMsg("");
-		
-		my $level;
-		eval {
-			$level = $key->get_value("DefaultLevel")->get_data();
-			::rptMsg(sprintf "DefaultLevel = 0x%08x",$level);
-		};
-		
-		my $exe;
-		eval {
-			$exe = $key->get_value("ExecutableTypes")->get_data();
-			$exe =~ s/\s/,/g;
-			::rptMsg("ExecutableTypes = ".$exe);
-			
-		};
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# codeid
+# Get DefaultLevel value from CodeIdentifiers key
+# 
+#
+# Change History
+#   20100608 - created
+#
+# References
+#   SANS ISC blog - http://isc.sans.edu/diary.html?storyid=8917
+#   CodeIdentifiers key
+#       - http://technet.microsoft.com/en-us/library/bb457006.aspx
+#   SAFER_LEVELID_FULLYTRUSTED value 
+#       - http://msdn.microsoft.com/en-us/library/ms722424%28VS.85%29.aspx
+#         (262144 == Unrestricted)
+# 
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package codeid;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20100608);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets CodeIdentifier DefaultLevel value";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching codeid v.".$VERSION);
+	::rptMsg("codeid v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("CodeID");
+		::rptMsg($key_path);
+		my $lastwrite = $key->get_timestamp();
+		::rptMsg("  LastWrite time: ".gmtime($lastwrite)." Z");
+		::rptMsg("");
+		
+		my $level;
+		eval {
+			$level = $key->get_value("DefaultLevel")->get_data();
+			::rptMsg(sprintf "DefaultLevel = 0x%08x",$level);
+		};
+		
+		my $exe;
+		eval {
+			$exe = $key->get_value("ExecutableTypes")->get_data();
+			$exe =~ s/\s/,/g;
+			::rptMsg("ExecutableTypes = ".$exe);
+			
+		};
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/comdlg32.pl

@@ -0,0 +1,686 @@
+#-----------------------------------------------------------
+# comdlg32.pl
+# Plugin for Registry Ripper 
+#
+# Change history
+#   20121005 - updated to address shell item type 0x3A
+#   20121005 - updated to parse shell item ID lists
+#   20100409 - updated to include Vista and above
+#   20100402 - updated IAW Chad Tilbury's post to SANS
+#              Forensic Blog
+#   20080324 - created
+#
+# References
+#   Win2000 - http://support.microsoft.com/kb/319958
+#   XP - http://support.microsoft.com/kb/322948/EN-US/
+#		
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package comdlg32;
+use strict;
+use Time::Local;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20121008);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's ComDlg32 key";
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching comdlg32 v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+	::rptMsg("comdlg32 v.".$VERSION);
+	::rptMsg("");
+# LastVistedMRU	
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32";
+	my $key;
+	my @vals;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		
+		my @subkeys = $key->get_list_of_subkeys();
+		
+		if (scalar @subkeys > 0) {
+			foreach my $s (@subkeys) {
+				if ($s->get_name() eq "LastVisitedMRU") {
+					::rptMsg("LastVisitedMRU");
+					::rptMsg("LastWrite: ".gmtime($s->get_timestamp()));
+					parseLastVisitedMRU($s); 
+					::rptMsg("");
+				}
+				
+				if ($s->get_name() eq "OpenSaveMRU") {
+					::rptMsg("OpenSaveMRU");
+					::rptMsg("LastWrite: ".gmtime($s->get_timestamp()));
+					parseOpenSaveMRU($s); 
+					::rptMsg("");
+				}
+				
+				if ($s->get_name() eq "CIDSizeMRU") {
+					::rptMsg("CIDSizeMRU");
+					::rptMsg("LastWrite: ".gmtime($s->get_timestamp()));
+					parseCIDSizeMRU($s);
+					::rptMsg("");
+				}
+				
+				if ($s->get_name() eq "FirstFolder") {
+					::rptMsg("FirstFolder");
+					::rptMsg("LastWrite: ".gmtime($s->get_timestamp()));
+					parseFirstFolder($s);
+					::rptMsg("");
+				}
+				
+				if ($s->get_name() eq "LastVisitedPidlMRU" || $s->get_name() eq "LastVisitedPidlMRULegacy") {
+					::rptMsg("LastVisitedPidlMRU");
+					::rptMsg("LastWrite: ".gmtime($s->get_timestamp()));
+					parseLastVisitedPidlMRU($s); 
+					::rptMsg("");
+				}
+				
+				if ($s->get_name() eq "OpenSavePidlMRU") {
+					::rptMsg("OpenSavePidlMRU");
+					::rptMsg("LastWrite: ".gmtime($s->get_timestamp()));
+					parseOpenSavePidlMRU($s); 
+					::rptMsg("");
+				}
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}	
+
+sub parseLastVisitedMRU {
+	my $key = shift;
+	my %lvmru;
+	my @mrulist;
+	my @vals = $key->get_list_of_values();
+	
+	if (scalar(@vals) > 0) {
+# First, read in all of the values and the data
+		foreach my $v (@vals) {
+			$lvmru{$v->get_name()} = $v->get_data();
+		}
+# Then, remove the MRUList value
+		if (exists $lvmru{MRUList}) {
+			::rptMsg("  MRUList = ".$lvmru{MRUList});
+			@mrulist = split(//,$lvmru{MRUList});
+			delete($lvmru{MRUList});
+			foreach my $m (@mrulist) {
+				my ($file,$dir) = split(/\00\00/,$lvmru{$m},2);
+				$file =~ s/\00//g;
+				$dir  =~ s/\00//g;
+				::rptMsg("  ".$m." -> EXE: ".$file);
+				::rptMsg("    -> Last Dir: ".$dir);
+			}
+		}
+		else {
+			::rptMsg("LastVisitedMRU key does not have an MRUList value.");
+		}				
+	}
+	else {
+		::rptMsg("LastVisitedMRU key has no values.");
+	}	
+	::rptMsg("");
+}
+
+sub parseOpenSaveMRU {
+	my $key = shift;
+	
+	parseOpenSaveValues($key);
+	::rptMsg("");
+# Now, let's get the subkeys
+	my @sk = $key->get_list_of_subkeys();
+	if (scalar(@sk) > 0) {
+		foreach my $s (@sk) {
+			parseOpenSaveValues($s);
+			::rptMsg("");
+		}
+	}
+	else {
+		::rptMsg("OpenSaveMRU key has no subkeys.");
+	}	
+	::rptMsg("");
+}
+
+sub parseOpenSaveValues {
+	my $key = shift;
+	::rptMsg("OpenSaveMRU\\".$key->get_name());
+	::rptMsg("LastWrite Time: ".gmtime($key->get_timestamp())." Z");
+	my %osmru;
+	my @vals = $key->get_list_of_values();
+	if (scalar(@vals) > 0) {
+		map{$osmru{$_->get_name()} = $_->get_data()}(@vals);
+		if (exists $osmru{MRUList}) {
+			::rptMsg("  MRUList = ".$osmru{MRUList});
+			my @mrulist = split(//,$osmru{MRUList});
+			delete($osmru{MRUList});
+			foreach my $m (@mrulist) {
+				::rptMsg("  ".$m." -> ".$osmru{$m});
+			}
+		}
+		else {
+			::rptMsg($key->get_name()." does not have an MRUList value.");
+		}	
+	}
+	else {
+		::rptMsg($key->get_name()." has no values.");
+	}	
+}
+
+sub parseCIDSizeMRU {
+	my $key = shift;
+	my %lvmru;
+	my @mrulist;
+	my @vals = $key->get_list_of_values();
+	my %mru;
+	my $count = 0;
+		
+	if (scalar(@vals) > 0) {
+# First, read in all of the values and the data
+		foreach my $v (@vals) {
+			$lvmru{$v->get_name()} = $v->get_data();
+		}
+# Then, remove the MRUList value
+		::rptMsg("Note: All value names are listed in MRUListEx order.");
+		::rptMsg("");
+		if (exists $lvmru{MRUListEx}) {
+			my @mrulist = unpack("V*",$lvmru{MRUListEx});
+			foreach my $n (0..(scalar(@mrulist) - 2)) {
+				$mru{$count++} = $lvmru{$mrulist[$n]};
+			}
+			delete $mru{0xffffffff};	
+			foreach my $m (sort {$a <=> $b} keys %mru) {
+#				my $file = parseStr($mru{$m});
+				my $file = (split(/\00\00/,$mru{$m},2))[0];
+				$file =~ s/\00//g;
+				::rptMsg("  ".$file);
+			}
+		}
+		else {
+#			::rptMsg($key_path." does not have an MRUList value.");
+		}				
+	}
+	else {
+#		::rptMsg($key_path." has no values.");
+	}
+}
+
+sub parseFirstFolder {
+	my $key = shift;
+	my %lvmru;
+	my @mrulist;
+	my @vals = $key->get_list_of_values();
+	my %mru;
+	my $count = 0;
+		
+	if (scalar(@vals) > 0) {
+# First, read in all of the values and the data
+		foreach my $v (@vals) {
+			$lvmru{$v->get_name()} = $v->get_data();
+		}
+# Then, remove the MRUList value
+		::rptMsg("Note: All value names are listed in MRUListEx order.");
+		::rptMsg("");
+		if (exists $lvmru{MRUListEx}) {
+			my @mrulist = unpack("V*",$lvmru{MRUListEx});
+			foreach my $n (0..(scalar(@mrulist) - 2)) {
+				$mru{$count++} = $lvmru{$mrulist[$n]};
+			}
+			delete $mru{0xffffffff};	
+			foreach my $m (sort {$a <=> $b} keys %mru) {
+#				my $file = parseStr($mru{$m});
+				my @files = split(/\00\00/,$mru{$m});
+				if (scalar(@files) == 0) {
+					::rptMsg("  No files listed.");
+				}
+				elsif (scalar(@files) == 1) {
+					$files[0] =~ s/\00//g;
+					::rptMsg("  ".$files[0]);
+				}
+				elsif (scalar(@files) > 1) {
+					my @files2;
+					foreach my $file (@files) {
+						$file =~ s/\00//g;
+						push(@files2,$file);
+					}
+					::rptMsg("  ".join(' ',@files2));
+				}
+				else {
+					
+				}
+			}
+		}
+		else {
+#			::rptMsg($key_path." does not have an MRUList value.");
+		}				
+	}
+	else {
+#		::rptMsg($key_path." has no values.");
+	}
+}
+
+sub parseLastVisitedPidlMRU {
+	my $key = shift;
+	my %lvmru;
+	my @mrulist;
+	my @vals = $key->get_list_of_values();
+	my %mru;
+	my $count = 0;
+	
+	if (scalar(@vals) > 0) {
+# First, read in all of the values and the data
+		foreach my $v (@vals) {
+			$lvmru{$v->get_name()} = $v->get_data();
+		}
+# Then, remove the MRUList value
+		::rptMsg("Note: All value names are listed in MRUListEx order.");
+		::rptMsg("");	
+		if (exists $lvmru{MRUListEx}) {
+			my @mrulist = unpack("V*",$lvmru{MRUListEx});
+			foreach my $n (0..(scalar(@mrulist) - 2)) {
+				$mru{$count++} = $lvmru{$mrulist[$n]};
+			}
+			delete $mru{0xffffffff};	
+
+			foreach my $m (sort {$a <=> $b} keys %mru) {
+				my ($file,$shell) = split(/\00\00/,$mru{$m},2);
+				$file =~ s/\00//g;
+				$shell =~ s/^\00//;
+				my $str = parseShellItem($shell);
+				::rptMsg("  ".$file." - ".$str);
+			}
+		}
+		else {
+			::rptMsg("LastVisitedPidlMRU key does not have an MRUList value.");
+		}				
+	}
+	else {
+		::rptMsg("LastVisitedPidlMRU key has no values.");
+	}	
+}
+
+#-----------------------------------------------------------
+#
+#-----------------------------------------------------------
+sub parseOpenSavePidlMRU {
+	my $key = shift;
+	my @subkeys = $key->get_list_of_subkeys();
+	
+	if (scalar(@subkeys) > 0) {
+		foreach my $s (@subkeys) {
+			::rptMsg("OpenSavePidlMRU\\".$s->get_name());
+			::rptMsg("LastWrite Time: ".gmtime($s->get_timestamp()));
+			
+			my @vals = $s->get_list_of_values();
+			
+			my %lvmru = ();
+			my @mrulist = ();
+			my %mru = ();
+			my $count = 0;
+			
+			
+			if (scalar(@vals) > 0) {
+# First, read in all of the values and the data
+				::rptMsg("Note: All value names are listed in MRUListEx order.");
+				::rptMsg("");
+				foreach my $v (@vals) {
+					$lvmru{$v->get_name()} = $v->get_data();
+				}
+# Then, remove the MRUList value
+				if (exists $lvmru{MRUListEx}) {
+					my @mrulist = unpack("V*",$lvmru{MRUListEx});
+					foreach my $n (0..(scalar(@mrulist) - 2)) {
+						$mru{$count++} = $lvmru{$mrulist[$n]};
+					}
+					delete $mru{0xffffffff};	
+
+					foreach my $m (sort {$a <=> $b} keys %mru) {
+						my $str = parseShellItem($mru{$m});
+						::rptMsg("  ".$str);
+					}
+				}
+			}
+			else {
+				::rptMsg($s->get_name()." has no values.");
+			}
+			::rptMsg("");
+		}
+	}
+	else {	
+		::rptMsg($key->get_name()." has no subkeys.");
+	}
+}
+
+#-----------------------------------------------------------
+#
+#-----------------------------------------------------------
+sub parseShellItem {
+	my $data = shift;
+	my $len = length($data);
+	my $str;
+	
+	my $tag = 1;
+	my $cnt = 0;
+	while ($tag) {
+		my %item = ();
+		my $sz = unpack("v",substr($data,$cnt,2));
+		$tag = 0 if (($sz == 0) || ($cnt + $sz > $len));
+		
+		my $dat = substr($data,$cnt,$sz);
+		my $type = unpack("C",substr($dat,2,1));
+#		::rptMsg(sprintf "  Size: ".$sz."  Type: 0x%x",$type);
+		
+		if ($type == 0x1F) {
+# System Folder 			
+ 			%item = parseSystemFolderEntry($dat);
+ 			$str .= "\\".$item{name};
+ 		}
+ 		elsif ($type == 0x2F) {
+# Volume (Drive Letter) 			
+ 			%item = parseDriveEntry($dat);
+ 			$item{name} =~ s/\\$//;
+ 			$str .= "\\".$item{name};
+ 		}
+ 		elsif ($type == 0x31 || $type == 0x32 || $type == 0x3a || $type == 0x74) {
+ 			%item = parseFolderEntry($dat);
+ 			$str .= "\\".$item{name};
+ 		}
+ 		elsif ($type == 0x00) {
+ 			
+ 		}
+ 		elsif ($type == 0xc3 || $type == 0x41 || $type == 0x42 || $type == 0x46 || $type == 0x47) {
+# Network stuff
+			my $id = unpack("C",substr($dat,3,1));
+			if ($type == 0xc3 && $id != 0x01) {
+				%item = parseNetworkEntry($dat);
+			}
+			else {
+				%item = parseNetworkEntry($dat); 
+			}
+			$str .= "\\".$item{name};
+ 		}
+ 		else {
+ 			$item{name} = sprintf "Unknown Type (0x%x)",$type;
+ 			$str .= "\\".$item{name};
+ 		}		
+		$cnt += $sz;
+	}
+	$str =~ s/^\\//;
+	return $str;
+}
+
+#-----------------------------------------------------------
+#
+#-----------------------------------------------------------
+sub parseSystemFolderEntry {
+	my $data     = shift;
+	my %item = ();
+	
+	my %vals = (0x00 => "Explorer",
+	            0x42 => "Libraries",
+	            0x44 => "Users",
+	            0x4c => "Public",
+	            0x48 => "My Documents",
+	            0x50 => "My Computer",
+	            0x58 => "My Network Places",
+	            0x60 => "Recycle Bin",
+	            0x68 => "Explorer",
+	            0x70 => "Control Panel",
+	            0x78 => "Recycle Bin",
+	            0x80 => "My Games");
+	
+	$item{type} = unpack("C",substr($data,2,1));
+	$item{id}   = unpack("C",substr($data,3,1));
+	if (exists $vals{$item{id}}) {
+		$item{name} = $vals{$item{id}};
+	}
+	else {
+		$item{name} = parseGUID(substr($data,4,16));
+	}
+	return %item;
+}
+
+#-----------------------------------------------------------
+# parseGUID()
+# Takes 16 bytes of binary data, returns a string formatted
+# as an MS GUID.
+#-----------------------------------------------------------
+sub parseGUID {
+	my $data     = shift;
+  my $d1 = unpack("V",substr($data,0,4));
+  my $d2 = unpack("v",substr($data,4,2));
+  my $d3 = unpack("v",substr($data,6,2));
+	my $d4 = unpack("H*",substr($data,8,2));
+  my $d5 = unpack("H*",substr($data,10,6));
+  return sprintf "{%08x-%x-%x-$d4-$d5}",$d1,$d2,$d3;
+}
+
+#-----------------------------------------------------------
+#
+#-----------------------------------------------------------
+sub parseDriveEntry {
+	my $data     = shift;
+	my %item = ();
+	$item{type} = unpack("C",substr($data,2,1));;
+	$item{name} = substr($data,3,3);
+	return %item;
+}
+#-----------------------------------------------------------
+# parseNetworkEntry()
+#
+#-----------------------------------------------------------
+sub parseNetworkEntry {
+	my $data = shift;
+	my %item = ();	
+	$item{type} = unpack("C",substr($data,2,1));
+	
+	my @n = split(/\00/,substr($data,4,length($data) - 4));
+	$item{name} = $n[0];
+	$item{name} =~ s/^\W//;
+	return %item;
+}
+#-----------------------------------------------------------
+#
+#-----------------------------------------------------------
+sub parseFolderEntry {
+	my $data     = shift;
+	my %item = ();
+	
+	$item{type} = unpack("C",substr($data,2,1));
+# Type 0x74 folders have a slightly different format	
+	
+	my $ofs_mdate;
+	my $ofs_shortname;
+	
+	if ($item{type} == 0x74) {
+		$ofs_mdate = 0x12;
+	}
+	elsif (substr($data,4,4) eq "AugM") {
+		$ofs_mdate = 0x1c;
+	}
+	elsif ($item{type} == 0x31 || $item{type} == 0x32 || $item{type} == 0x3a) {
+		$ofs_mdate = 0x08;
+	}
+	else {}
+# some type 0x32 items will include a file size	
+	if ($item{type} == 0x32) {
+		my $size = unpack("V",substr($data,4,4));
+		if ($size != 0) {
+			$item{filesize} = $size;
+		}
+	}
+	
+	my @m = unpack("vv",substr($data,$ofs_mdate,4));
+	($item{mtime_str},$item{mtime}) = convertDOSDate($m[0],$m[1]);
+	
+# Need to read in short name; nul-term ASCII
+#	$item{shortname} = (split(/\00/,substr($data,12,length($data) - 12),2))[0];
+	$ofs_shortname = $ofs_mdate + 6;	
+	my $tag = 1;
+	my $cnt = 0;
+	my $str = "";
+	while($tag) {
+		my $s = substr($data,$ofs_shortname + $cnt,1);
+		if ($s =~ m/\00/ && ((($cnt + 1) % 2) == 0)) {
+			$tag = 0;
+		}
+		else {
+			$str .= $s;
+			$cnt++;
+		}
+	}
+#	$str =~ s/\00//g;
+	my $shortname = $str;
+	my $ofs = $ofs_shortname + $cnt + 1;
+# Read progressively, 1 byte at a time, looking for 0xbeef	
+	my $tag = 1;
+	my $cnt = 0;
+	while ($tag) {
+		if (unpack("v",substr($data,$ofs + $cnt,2)) == 0xbeef) {
+			$tag = 0;
+		}
+		else {
+			$cnt++;
+		}
+	}
+	$item{extver} = unpack("v",substr($data,$ofs + $cnt - 4,2));
+	
+#	::rptMsg(sprintf "  BEEF Offset: 0x%x",$ofs + $cnt);
+#	::rptMsg("  Version: ".$item{extver});
+	
+	$ofs = $ofs + $cnt + 2;
+	
+	my @m = unpack("vv",substr($data,$ofs,4));
+	($item{ctime_str},$item{ctime}) = convertDOSDate($m[0],$m[1]);
+	$ofs += 4;
+	my @m = unpack("vv",substr($data,$ofs,4));
+	($item{atime_str},$item{atime}) = convertDOSDate($m[0],$m[1]);
+	$ofs += 4;
+	
+	my $jmp;
+	if ($item{extver} == 0x03) {
+		$jmp = 8;
+	}
+	elsif ($item{extver} == 0x07) {
+		$jmp = 22;
+	}
+	elsif ($item{extver} == 0x08) {
+		$jmp = 26;
+	}
+	else {}
+	
+	$ofs += $jmp;
+#	::rptMsg(sprintf "  Offset: 0x%x",$ofs);
+	
+	my $str = substr($data,$ofs,length($data) - $ofs);
+	
+	my $longname = (split(/\00\00/,$str,2))[0];
+	$longname =~ s/\00//g;
+
+	if ($longname ne "") {
+		$item{name} = $longname;
+	}
+	else {
+		$item{name} = $shortname;
+	}
+	return %item;
+}
+
+#-----------------------------------------------------------
+# convertDOSDate()
+# subroutine to convert 4 bytes of binary data into a human-
+# readable format.  Returns both a string and a Unix-epoch
+# time.
+#-----------------------------------------------------------
+sub convertDOSDate {
+	my $date = shift;
+	my $time = shift;
+	
+	if ($date == 0x00 || $time == 0x00){
+		return (0,0);
+	}
+	else {
+		my $sec = ($time & 0x1f) * 2;
+		$sec = "0".$sec if (length($sec) == 1);
+		if ($sec == 60) {$sec = 59};
+		my $min = ($time & 0x7e0) >> 5;
+		$min = "0".$min if (length($min) == 1);
+		my $hr  = ($time & 0xF800) >> 11;
+		$hr = "0".$hr if (length($hr) == 1);
+		my $day = ($date & 0x1f);
+		$day = "0".$day if (length($day) == 1);
+		my $mon = ($date & 0x1e0) >> 5;
+		$mon = "0".$mon if (length($mon) == 1);
+		my $yr  = (($date & 0xfe00) >> 9) + 1980;
+		my $gmtime = timegm($sec,$min,$hr,$day,($mon - 1),$yr);
+    return ("$yr-$mon-$day $hr:$min:$sec",$gmtime);
+#		return gmtime(timegm($sec,$min,$hr,$day,($mon - 1),$yr));
+	}
+}
+
+#-----------------------------------------------------------
+# printData()
+# subroutine used primarily for debugging; takes an arbitrary
+# length of binary data, prints it out in hex editor-style
+# format for easy debugging
+#-----------------------------------------------------------
+sub printData {
+	my $data = shift;
+	my $len = length($data);
+	my $tag = 1;
+	my $cnt = 0;
+	
+	my $loop = $len/16;
+	$loop++ if ($len%16);
+	
+	foreach my $cnt (0..($loop - 1)) {
+#	while ($tag) {
+		my $left = $len - ($cnt * 16);
+		
+		my $n;
+		($left < 16) ? ($n = $left) : ($n = 16);
+
+		my $seg = substr($data,$cnt * 16,$n);
+		my @str1 = split(//,unpack("H*",$seg));
+
+		my @s3;
+		my $str = "";
+
+		foreach my $i (0..($n - 1)) {
+			$s3[$i] = $str1[$i * 2].$str1[($i * 2) + 1];
+			
+			if (hex($s3[$i]) > 0x1f && hex($s3[$i]) < 0x7f) {
+				$str .= chr(hex($s3[$i]));
+			}
+			else {
+				$str .= "\.";
+			}
+		}
+		my $h = join(' ',@s3);
+		::rptMsg(sprintf "0x%08x: %-47s  ".$str,($cnt * 16),$h);
+	}
+}
+
+1;		

RecentActivity/release/rr-full/plugins/compatassist.pl

@@ -1,66 +1,71 @@
-#! c:\perl\bin\perl.exe
-#-----------------------------------------------------------
-# muicache.pl
-# Plugin for Registry Ripper, NTUSER.DAT edition - gets the 
-# MUICache values 
-#
-# Change history
-#
-#
-# 
-# copyright 2008 H. Carvey
-#-----------------------------------------------------------
-package muicache;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20080324);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets EXEs from user's MUICache key";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching muicache v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-	my $key_path = 'Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("MUICache");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		my @vals = $key->get_list_of_values();
-		if (scalar(@vals) > 0) {
-			foreach my $v (@vals) {
-				my $name = $v->get_name();
-				next if ($name =~ m/^@/ || $name eq "LangID");
-				my $data = $v->get_data();
-				::rptMsg("\t".$name." (".$data.")");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-			::logMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# compatassist.pl
+# Provides indication of applications run; see the Reference listed
+# below; note that there are no time stamps associated with this
+# information.  Note: Value names that start with "SIGN.MEDIA" indicate
+# that the app was run from removable media
+#
+# Category: Programs launched by user
+#
+# Change history
+#  20120515 - created
+#
+# References
+#  http://msdn.microsoft.com/en-us/library/bb756937.aspx
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package compatassist;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120515);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Checks user's Compatibility Assistant\\Persisted values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	my @temps;
+	
+	::logMsg("Launching compatassist v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Persisted';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("compatassist");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		my @vals = $key->get_list_of_values();
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) { 
+				my $name = $v->get_name();
+				::rptMsg("  ".$name);
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/compdesc.pl

@@ -1,65 +1,67 @@
-#-----------------------------------------------------------
-# compdesc.pl
-# Plugin for Registry Ripper,
-# ComputerDescriptions key parser
-#
-# Change history
-#
-#
-# References
-#
-# 
-# copyright 2008 H. Carvey
-#-----------------------------------------------------------
-package compdesc;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20080324);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets contents of user's ComputerDescriptions key";
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching compdesc v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComputerDescriptions';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("ComputerDescriptions");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		my @vals = $key->get_list_of_values();
-		if (scalar(@vals) > 0) {
-			foreach my $v (@vals) {
-				::rptMsg("  ".$v->get_name()."   ".$v->get_data());
-			}
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-			::logMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# compdesc.pl
+# Plugin for Registry Ripper,
+# ComputerDescriptions key parser
+#
+# Change history
+#
+#
+# References
+#
+# 
+# copyright 2008 H. Carvey
+#-----------------------------------------------------------
+package compdesc;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20080324);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's ComputerDescriptions key";
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching compdesc v.".$VERSION);
+	::rptMsg("compdesc v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComputerDescriptions';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("ComputerDescriptions");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		my @vals = $key->get_list_of_values();
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) {
+				::rptMsg("  ".$v->get_name()."   ".$v->get_data());
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+			::logMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/compname.pl

@@ -1,75 +1,77 @@
-#-----------------------------------------------------------
-# compname.pl
-# Plugin for Registry Ripper; Access System hive file to get the
-# computername
-# 
-# Change history
-#   20090727 - added Hostname
-#
-# References
-#   http://support.microsoft.com/kb/314053/
-# 
-# copyright 2009 H. Carvey
-#-----------------------------------------------------------
-package compname;
-use strict;
-
-my %config = (hive          => "System",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20090727);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets ComputerName and Hostname values from System hive";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching compname v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-# First thing to do is get the ControlSet00x marked current...this is
-# going to be used over and over again in plugins that access the system
-# file
-	my ($current,$ccs);
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		$ccs = "ControlSet00".$current;
-		my $cn_path = $ccs."\\Control\\ComputerName\\ComputerName";
-		my $cn;
-		if ($cn = $root_key->get_subkey($cn_path)) {
-			my $name = $cn->get_value("ComputerName")->get_data();
-			::rptMsg("ComputerName    = ".$name);
-		}
-		else {
-			::rptMsg($cn_path." not found.");
-			::logMsg($cn_path." not found.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-	
-	my $hostname;
-	eval {
-		my $host_path = $ccs."\\Services\\Tcpip\\Parameters";
-		$hostname = $root_key->get_subkey($host_path)->get_value("Hostname")->get_data();
-		::rptMsg("TCP/IP Hostname = ".$hostname);
-	};
-	
-}
-
+#-----------------------------------------------------------
+# compname.pl
+# Plugin for Registry Ripper; Access System hive file to get the
+# computername
+# 
+# Change history
+#   20090727 - added Hostname
+#
+# References
+#   http://support.microsoft.com/kb/314053/
+# 
+# copyright 2009 H. Carvey
+#-----------------------------------------------------------
+package compname;
+use strict;
+
+my %config = (hive          => "System",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20090727);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets ComputerName and Hostname values from System hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching compname v.".$VERSION);
+	::rptMsg("compname v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		my $cn_path = $ccs."\\Control\\ComputerName\\ComputerName";
+		my $cn;
+		if ($cn = $root_key->get_subkey($cn_path)) {
+			my $name = $cn->get_value("ComputerName")->get_data();
+			::rptMsg("ComputerName    = ".$name);
+		}
+		else {
+			::rptMsg($cn_path." not found.");
+			::logMsg($cn_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+	
+	my $hostname;
+	eval {
+		my $host_path = $ccs."\\Services\\Tcpip\\Parameters";
+		$hostname = $root_key->get_subkey($host_path)->get_value("Hostname")->get_data();
+		::rptMsg("TCP/IP Hostname = ".$hostname);
+	};
+	
+}
+
 1;

RecentActivity/release/rr-full/plugins/controlpanel.pl

@@ -1,64 +1,66 @@
-#-----------------------------------------------------------
-# controlpanel.pl
-# Vista ControlPanel key seems to contain some interesting info about the
-# user's activities...
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package controlpanel;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              osmask        => 64,  
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20080428);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Look for RecentTask* values in ControlPanel key (Vista)";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching controlpanel v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		::rptMsg("Analysis Tip: The RecentTask* entries appear to only be populated through the");
-		::rptMsg("choices in the Control Panel Home view (in Vista).  As each new choice is");
-		::rptMsg("selected, the most recent choice is added as RecentTask1, and each ");
-		::rptMsg("RecentTask* entry is incremented and pushed down in the stack.");
-		::rptMsg("");
-		my @vals = $key->get_list_of_values();
-		if (scalar(@vals) > 0) {
-			foreach my $v (@vals) {
-				my $str = sprintf "%-15s %-45s",$v->get_name(),$v->get_data();
-				::rptMsg($str);
-			}
-			::rptMsg("");
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# controlpanel.pl
+# Vista ControlPanel key seems to contain some interesting info about the
+# user's activities...
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package controlpanel;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 64,  
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20080428);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Look for RecentTask* values in ControlPanel key (Vista)";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching controlpanel v.".$VERSION);
+	::rptMsg("controlpanel v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		::rptMsg("Analysis Tip: The RecentTask* entries appear to only be populated through the");
+		::rptMsg("choices in the Control Panel Home view (in Vista).  As each new choice is");
+		::rptMsg("selected, the most recent choice is added as RecentTask1, and each ");
+		::rptMsg("RecentTask* entry is incremented and pushed down in the stack.");
+		::rptMsg("");
+		my @vals = $key->get_list_of_values();
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) {
+				my $str = sprintf "%-15s %-45s",$v->get_name(),$v->get_data();
+				::rptMsg($str);
+			}
+			::rptMsg("");
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/cpldontload.pl

@@ -1,72 +1,74 @@
-#-----------------------------------------------------------
-# cpldontload.pl
-# Check contents of user's Control Panel\don't load key
-#
-# Change history
-#   20100116 - created
-#
-# References
-#   W32.Nekat - http://www.symantec.com/security_response/
-#               writeup.jsp?docid=2008-011419-0705-99&tabid=2
-#   http://www.2-viruses.com/remove-antispywarexp2009
-#
-# Notes: Some malware appears to hide various Control Panel applets
-#        using this means.  If some sort of malware/spyware is thought
-#        to be on the system, check the settings and note the key 
-#        LastWrite time.
-#
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package cpldontload;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20100116);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets contents of user's Control Panel don't load key";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching cpldontload v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Control Panel\\don\'t load";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my @vals = $key->get_list_of_values();
-		if (scalar @vals > 0) {
-			foreach my $v (@vals) {
-				my $str = sprintf "%-20s %-5s",$v->get_name(),$v->get_data();
-				::rptMsg($str);
-			}
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# cpldontload.pl
+# Check contents of user's Control Panel\don't load key
+#
+# Change history
+#   20100116 - created
+#
+# References
+#   W32.Nekat - http://www.symantec.com/security_response/
+#               writeup.jsp?docid=2008-011419-0705-99&tabid=2
+#   http://www.2-viruses.com/remove-antispywarexp2009
+#
+# Notes: Some malware appears to hide various Control Panel applets
+#        using this means.  If some sort of malware/spyware is thought
+#        to be on the system, check the settings and note the key 
+#        LastWrite time.
+#
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package cpldontload;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20100116);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of user's Control Panel don't load key";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching cpldontload v.".$VERSION);
+	::rptMsg("cpldontload v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Control Panel\\don\'t load";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my @vals = $key->get_list_of_values();
+		if (scalar @vals > 0) {
+			foreach my $v (@vals) {
+				my $str = sprintf "%-20s %-5s",$v->get_name(),$v->get_data();
+				::rptMsg($str);
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/crashcontrol.pl

@@ -1,93 +1,95 @@
-#-----------------------------------------------------------
-# crashcontrol.pl
-#
-# Ref: 
-#   http://support.microsoft.com/kb/254649
-#   http://support.microsoft.com/kb/274598
-#
-# copyright 2008-2009 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package crashcontrol;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20081212);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get crash control information";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-my %dumpenabled = (0 => "None",
-                   1 => "Complete memory dump",
-                   2 => "Kernel memory dump",
-                   3 => "Small (64kb) memory dump");
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching crashcontrol v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- my $current;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		
-		my $cc_path = "ControlSet00".$current."\\Control\\CrashControl";
-		my $cc;
-		
-		if ($cc = $root_key->get_subkey($cc_path)) {
-			
-			eval {
-				my $cde = $cc->get_value("CrashDumpEnabled")->get_data();
-				::rptMsg("CrashDumpEnabled = ".$cde." [".$dumpenabled{$cde}."]");
-			};
-			
-			eval {
-				my $df = $cc->get_value("DumpFile")->get_data();
-				::rptMsg("DumpFile         = ".$df);
-			};
-			
-			eval {
-				my $mini = $cc->get_value("MinidumpDir")->get_data();
-				::rptMsg("MinidumpDir      = ".$mini);
-			};
-			
-			eval {
-				my $logevt = $cc->get_value("LogEvent")->get_data();
-				::rptMsg("LogEvent         = ".$logevt);
-				::rptMsg("  Logs an event to the System Event Log (event ID = 1001, source = Save Dump)") if ($logevt == 1);
-			};
-			
-			eval {
-				my $sendalert = $cc->get_value("SendAlert")->get_data();
-				::rptMsg("SendAlert        = ".$sendalert);
-				::rptMsg("  Sends a \'net send\' pop-up if a crash occurs") if ($sendalert == 1);
-			};
-			
-			
-		}	
-		else {
-			::rptMsg($cc_path." not found.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-1;
+#-----------------------------------------------------------
+# crashcontrol.pl
+#
+# Ref: 
+#   http://support.microsoft.com/kb/254649
+#   http://support.microsoft.com/kb/274598
+#
+# copyright 2008-2009 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package crashcontrol;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20081212);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get crash control information";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+my %dumpenabled = (0 => "None",
+                   1 => "Complete memory dump",
+                   2 => "Kernel memory dump",
+                   3 => "Small (64kb) memory dump");
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching crashcontrol v.".$VERSION);
+	::rptMsg("crashcontrol v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ my $current;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		
+		my $cc_path = "ControlSet00".$current."\\Control\\CrashControl";
+		my $cc;
+		
+		if ($cc = $root_key->get_subkey($cc_path)) {
+			
+			eval {
+				my $cde = $cc->get_value("CrashDumpEnabled")->get_data();
+				::rptMsg("CrashDumpEnabled = ".$cde." [".$dumpenabled{$cde}."]");
+			};
+			
+			eval {
+				my $df = $cc->get_value("DumpFile")->get_data();
+				::rptMsg("DumpFile         = ".$df);
+			};
+			
+			eval {
+				my $mini = $cc->get_value("MinidumpDir")->get_data();
+				::rptMsg("MinidumpDir      = ".$mini);
+			};
+			
+			eval {
+				my $logevt = $cc->get_value("LogEvent")->get_data();
+				::rptMsg("LogEvent         = ".$logevt);
+				::rptMsg("  Logs an event to the System Event Log (event ID = 1001, source = Save Dump)") if ($logevt == 1);
+			};
+			
+			eval {
+				my $sendalert = $cc->get_value("SendAlert")->get_data();
+				::rptMsg("SendAlert        = ".$sendalert);
+				::rptMsg("  Sends a \'net send\' pop-up if a crash occurs") if ($sendalert == 1);
+			};
+			
+			
+		}	
+		else {
+			::rptMsg($cc_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/ctrlpnl.pl

@@ -1,143 +1,145 @@
-#-----------------------------------------------------------
-# ctrlpnl.pl
-# Get Control Panel info from the Software hive
-#
-# Change history:
-#   20100116 - created
-#
-# References:
-#   http://support.microsoft.com/kb/292463
-#   http://learning.infocollections.com/ebook%202/Computer/
-#          Operating%20Systems/Windows/Windows.XP.Hacks/
-#          0596005113_winxphks-chp-2-sect-3.html
-#   http://msdn.microsoft.com/en-us/library/cc144195%28VS.85%29.aspx
-#
-# Notes: 
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package ctrlpnl;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20100116);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get Control Panel info from Software hive";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-my %comp;
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching ctrlpnl v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Microsoft\\Windows\\CurrentVersion\\Control Panel";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("");
-		::rptMsg($key_path);
-		::rptMsg("");
-
-# Cpls section
-		if (my $cpl = $key->get_subkey("Cpls")) {
-			my @vals = $cpl->get_list_of_values();
-			if (scalar @vals > 0) {
-				::rptMsg("Cpls key");
-				foreach my $v (@vals) {
-					my $str = sprintf "%-10s %-50s",$v->get_name(),$v->get_data();
-					::rptMsg($str);
-				}
-				::rptMsg("");
-			}
-			else {
-				::rptMsg("Cpls key has no values.");
-			}
-		}
-		else {
-			::rptMsg("Cpls key not found.");
-		}
-	
-# don't load section
-# The 'don't load' key prevents applets from being loaded
-# Be sure to check the user's don't load key, as well
-	if (my $cpl = $key->get_subkey("don't load")) {
-			my @vals = $cpl->get_list_of_values();
-			if (scalar @vals > 0) {
-				::rptMsg("don't load key");
-				foreach my $v (@vals) {
-					::rptMsg($v->get_name());
-				}
-				::rptMsg("");
-			}
-			else {
-				::rptMsg("don't load key has no values.");
-			}
-		}
-		else {
-			::rptMsg("don't load key not found.");
-		}
-
-# Extended Properties section		
-		if (my $ext = $key->get_subkey("Extended Properties")) {
-			my @sk = $ext->get_list_of_subkeys();
-			if (scalar @sk > 0) {
-				foreach my $s (@sk) {
-					my @vals = $s->get_list_of_values();
-					if (scalar @vals > 0) {
-						::rptMsg($s->get_name()." [".gmtime($s->get_timestamp)." UTC]");
-
-# Ref: http://support.microsoft.com/kb/292463						
-						my %cat = (0x00000000 => "Other Control Panel Options",
-                       0x00000001 => "Appearance and Themes",
-                       0x00000002 => "Printers and Other Hardware",
-                       0x00000003 => "Network and Internet Connections",
-                       0x00000004 => "Sounds, Speech, and Audio Devices",
-                       0x00000005 => "Performance and Maintenance",
-                       0x00000006 => "Date, Time, Language, and Regional Options",
-                       0x00000007 => "Accessibility Options",
-                       0xFFFFFFFF => "No Category");
-            my %prop;    
-						foreach my $v (@vals) {
-							push(@{$prop{$v->get_data()}},$v->get_name());
-						}
-						
-						foreach my $t (sort {$a <=> $b} keys %prop) {
-							(exists $cat{$t}) ?	(::rptMsg($cat{$t})) : (::rptMsg("Category ".$t));
-							foreach my $i (@{$prop{$t}}) {
-								::rptMsg("  ".$i);
-							}
-							::rptMsg(""); 
-						}
-					}
-				}
-				::rptMsg("");
-			}
-			else {
-				::rptMsg("Extended Properties key has no subkeys.");
-			}
-		}
-		else {
-			::rptMsg("Extended Properties key not found.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# ctrlpnl.pl
+# Get Control Panel info from the Software hive
+#
+# Change history:
+#   20100116 - created
+#
+# References:
+#   http://support.microsoft.com/kb/292463
+#   http://learning.infocollections.com/ebook%202/Computer/
+#          Operating%20Systems/Windows/Windows.XP.Hacks/
+#          0596005113_winxphks-chp-2-sect-3.html
+#   http://msdn.microsoft.com/en-us/library/cc144195%28VS.85%29.aspx
+#
+# Notes: 
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package ctrlpnl;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20100116);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get Control Panel info from Software hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+my %comp;
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching ctrlpnl v.".$VERSION);
+	::rptMsg("ctrlpnl v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Microsoft\\Windows\\CurrentVersion\\Control Panel";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("");
+		::rptMsg($key_path);
+		::rptMsg("");
+
+# Cpls section
+		if (my $cpl = $key->get_subkey("Cpls")) {
+			my @vals = $cpl->get_list_of_values();
+			if (scalar @vals > 0) {
+				::rptMsg("Cpls key");
+				foreach my $v (@vals) {
+					my $str = sprintf "%-10s %-50s",$v->get_name(),$v->get_data();
+					::rptMsg($str);
+				}
+				::rptMsg("");
+			}
+			else {
+				::rptMsg("Cpls key has no values.");
+			}
+		}
+		else {
+			::rptMsg("Cpls key not found.");
+		}
+	
+# don't load section
+# The 'don't load' key prevents applets from being loaded
+# Be sure to check the user's don't load key, as well
+	if (my $cpl = $key->get_subkey("don't load")) {
+			my @vals = $cpl->get_list_of_values();
+			if (scalar @vals > 0) {
+				::rptMsg("don't load key");
+				foreach my $v (@vals) {
+					::rptMsg($v->get_name());
+				}
+				::rptMsg("");
+			}
+			else {
+				::rptMsg("don't load key has no values.");
+			}
+		}
+		else {
+			::rptMsg("don't load key not found.");
+		}
+
+# Extended Properties section		
+		if (my $ext = $key->get_subkey("Extended Properties")) {
+			my @sk = $ext->get_list_of_subkeys();
+			if (scalar @sk > 0) {
+				foreach my $s (@sk) {
+					my @vals = $s->get_list_of_values();
+					if (scalar @vals > 0) {
+						::rptMsg($s->get_name()." [".gmtime($s->get_timestamp)." UTC]");
+
+# Ref: http://support.microsoft.com/kb/292463						
+						my %cat = (0x00000000 => "Other Control Panel Options",
+                       0x00000001 => "Appearance and Themes",
+                       0x00000002 => "Printers and Other Hardware",
+                       0x00000003 => "Network and Internet Connections",
+                       0x00000004 => "Sounds, Speech, and Audio Devices",
+                       0x00000005 => "Performance and Maintenance",
+                       0x00000006 => "Date, Time, Language, and Regional Options",
+                       0x00000007 => "Accessibility Options",
+                       0xFFFFFFFF => "No Category");
+            my %prop;    
+						foreach my $v (@vals) {
+							push(@{$prop{$v->get_data()}},$v->get_name());
+						}
+						
+						foreach my $t (sort {$a <=> $b} keys %prop) {
+							(exists $cat{$t}) ?	(::rptMsg($cat{$t})) : (::rptMsg("Category ".$t));
+							foreach my $i (@{$prop{$t}}) {
+								::rptMsg("  ".$i);
+							}
+							::rptMsg(""); 
+						}
+					}
+				}
+				::rptMsg("");
+			}
+			else {
+				::rptMsg("Extended Properties key has no subkeys.");
+			}
+		}
+		else {
+			::rptMsg("Extended Properties key not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/ddm.pl

@@ -1,82 +1,84 @@
-#-----------------------------------------------------------
-# ddm.pl
-#
-# History:
-#   20081129 - created
-#
-# Note - Not really sure what this is for or could be used for, other
-#        than to show devices that had been connected to the system
-#
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package ddm;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20081129);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get DDM data from Control Subkey";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching ddm v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- my $current;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		my $ccs = "ControlSet00".$current;
-
-		my $key_path = $ccs."\\Control\\DDM";
-		my $key;
-		my %dev;
-		if ($key = $root_key->get_subkey($key_path)) {
-			my @subkeys = $key->get_list_of_subkeys();
-			if (scalar (@subkeys) > 0) {
-				foreach my $s (@subkeys) {
-					my $name = $s->get_name();
-					my $tag = (split(/\./,$name,2))[1];
-					$dev{$tag}{timestamp} = $s->get_timestamp();
-					eval {
-						$dev{$tag}{make} = $s->get_value("MakeName")->get_data();
-						$dev{$tag}{model} = $s->get_value("ModelName")->get_data();
-					};
-				}
-				foreach my $d (sort keys %dev) {
-					::rptMsg(gmtime($dev{$d}{timestamp})."Z  Device\.".$d."  ".$dev{$d}{make}." ".$dev{$d}{model});
-				}
-			}
-			else {
-				::rptMsg($key_path." has no subkeys.");
-			}
-		}
-		else {
-			::rptMsg($key_path." not found.");
-#			::logMsg($key_path." not found.");
-		}
-	}
-	else {
-		::logMsg("Current value not found.");
-	}
-}
+#-----------------------------------------------------------
+# ddm.pl
+#
+# History:
+#   20081129 - created
+#
+# Note - Not really sure what this is for or could be used for, other
+#        than to show devices that had been connected to the system
+#
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package ddm;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20081129);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get DDM data from Control Subkey";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching ddm v.".$VERSION);
+	::rptMsg("ddm v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner  
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ my $current;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		my $ccs = "ControlSet00".$current;
+
+		my $key_path = $ccs."\\Control\\DDM";
+		my $key;
+		my %dev;
+		if ($key = $root_key->get_subkey($key_path)) {
+			my @subkeys = $key->get_list_of_subkeys();
+			if (scalar (@subkeys) > 0) {
+				foreach my $s (@subkeys) {
+					my $name = $s->get_name();
+					my $tag = (split(/\./,$name,2))[1];
+					$dev{$tag}{timestamp} = $s->get_timestamp();
+					eval {
+						$dev{$tag}{make} = $s->get_value("MakeName")->get_data();
+						$dev{$tag}{model} = $s->get_value("ModelName")->get_data();
+					};
+				}
+				foreach my $d (sort keys %dev) {
+					::rptMsg(gmtime($dev{$d}{timestamp})."Z  Device\.".$d."  ".$dev{$d}{make}." ".$dev{$d}{model});
+				}
+			}
+			else {
+				::rptMsg($key_path." has no subkeys.");
+			}
+		}
+		else {
+			::rptMsg($key_path." not found.");
+#			::logMsg($key_path." not found.");
+		}
+	}
+	else {
+		::logMsg("Current value not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/decaf.pl

@@ -0,0 +1,96 @@
+#-----------------------------------------------------------
+# decaf.pl
+#   Extracts the AcceptedEULA value for DECAF
+#
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+#   Detect and Eliminate Computer Acquired Forensics
+#       http://en.wikipedia.org/wiki/DECAF
+#
+# Copyright (c) 2011-02-10 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package decaf;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20110210);
+my $VERSION = getVersion();
+
+# Functions #
+sub getDescr {}
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getShortDescr {
+	return "Extracts the EULA value for DECAF.";
+}
+sub getRefs {
+	my %refs = ("Detect and Eliminate Computer Acquired Forensics:" =>
+	            "http://en.wikipedia.org/wiki/DECAF");
+	return %refs;	
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+
+	# Initialize #
+	::logMsg("Launching decaf v.".$VERSION);
+    ::rptMsg("decaf v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # 20110830 [fpi] + banner   
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\DECAFme";
+
+	# If # DECAF path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("DECAF");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from DECAF registry path #
+		my %keys;
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for DECAF registry path #
+			foreach my $v (@vals) {
+				::rptMsg($v->get_name()." -> ".$v->get_data());
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # DECAF isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;

RecentActivity/release/rr-full/plugins/defbrowser.pl

@@ -1,78 +1,80 @@
-#-----------------------------------------------------------
-# defbrowser.pl
-# Get default browser information - check #1 can apply to HKLM
-# as well as to HKCU
-#
-# Change History: 
-#   20091116 - Added Check #1
-#   20081105 - created
-# 
-# copyright 2009 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package defbrowser;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20091116);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Gets default browser setting from HKLM";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching defbrowser v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Clients\\StartMenuInternet";
-	if (my $key = $root_key->get_subkey($key_path)) {
-		::rptMsg("Default Browser Check #1");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		my $browser = $key->get_value("")->get_data();
-		::rptMsg("Default Browser : ".$browser);
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-
-	::rptMsg("");
-
-	my $key_path = "Classes\\HTTP\\shell\\open\\command";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("Default Browser Check #2");
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		my $browser;
-		eval {
-			$browser = $key->get_value("")->get_data();
-		};
-		if ($@) {
-			::rptMsg("Error locating default browser setting.");
-		}
-		else {
-			::rptMsg("Default Browser = ".$browser);
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# defbrowser.pl
+# Get default browser information - check #1 can apply to HKLM
+# as well as to HKCU
+#
+# Change History: 
+#   20091116 - Added Check #1
+#   20081105 - created
+# 
+# copyright 2009 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package defbrowser;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20091116);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets default browser setting from HKLM";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching defbrowser v.".$VERSION);
+	::rptMsg("defbrowser v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Clients\\StartMenuInternet";
+	if (my $key = $root_key->get_subkey($key_path)) {
+		::rptMsg("Default Browser Check #1");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my $browser = $key->get_value("")->get_data();
+		::rptMsg("Default Browser : ".$browser);
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+
+	::rptMsg("");
+
+	my $key_path = "Classes\\HTTP\\shell\\open\\command";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("Default Browser Check #2");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my $browser;
+		eval {
+			$browser = $key->get_value("")->get_data();
+		};
+		if ($@) {
+			::rptMsg("Error locating default browser setting.");
+		}
+		else {
+			::rptMsg("Default Browser = ".$browser);
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/dependency_walker.pl

@@ -0,0 +1,95 @@
+#-----------------------------------------------------------
+# dependency_walker.pl
+#   Extracts Recent File List for Dependency Walker.
+#
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+#   Dependency Walker Homepage
+#       http://www.dependencywalker.com/
+#
+# Copyright (c) 2011-02-04 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package dependency_walker;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20110204);
+my $VERSION = getVersion();
+
+# Functions #
+sub getDescr {}
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getShortDescr {
+	return "Extracts Recent File List for Dependency Walker.";
+}
+sub getRefs {
+	my %refs = ("Dependency Walker Homepage:" =>
+	            "http://www.dependencywalker.com/");
+	return %refs;	
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+
+	# Initialize #
+	::logMsg("Launching dependency_walker v.".$VERSION);
+    ::rptMsg("dependency_walker v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # 20110830 [fpi] + banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\Microsoft\\Dependency Walker\\Recent File List";
+
+	# If # Dependency Walker path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("Dependency Walker");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from Dependency Walker registry path #
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for Dependency Walker registry path #
+			foreach my $v (@vals) {
+				::rptMsg($v->get_name()." -> ".$v->get_data());
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # Dependency Walker isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;

RecentActivity/release/rr-full/plugins/devclass.pl

@@ -1,125 +1,127 @@
-#-----------------------------------------------------------
-# devclass
-# Get USB device info from the DeviceClasses keys in the System
-# hive (Disks and Volumes GUIDs)
-#
-# Change History:
-#   20100901 - spelling error in output corrected
-#   20080331 - created
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package devclass;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20100901);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get USB device info from the DeviceClasses keys in the System hive";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching devclass v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- 	my $current;
- 	my $ccs;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		$ccs = "ControlSet00".$current;
-	}
-	else {
-		::logMsg("Could not find ".$key_path);
-		return
-	}
-# Get devices from the Disk GUID
-	my $key_path = $ccs."\\Control\\DeviceClasses\\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("DevClasses - Disks");
-		::rptMsg($key_path);
-		::rptMsg("");
-		my %disks;
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) {
-				my $name = $s->get_name();
-				next unless (grep(/USBSTOR/,$name));
-				my $lastwrite = $s->get_timestamp();
-				my ($dev, $serial) = (split(/#/,$name))[4,5];
-				push(@{$disks{$lastwrite}},$dev.",".$serial);
-			}
-			
-			foreach my $t (reverse sort {$a <=> $b} keys %disks) {
-				::rptMsg(gmtime($t)." (UTC)");
-				foreach my $item (@{$disks{$t}}) {
-					::rptMsg("\t$item");
-				}
-			}
-			
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-			::logMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-	::rptMsg("");
-# Get devices from the Volume GUID
-	my $key_path = $ccs."\\Control\\DeviceClasses\\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("DevClasses - Volumes");
-		::rptMsg($key_path);
-		::rptMsg("");
-		my %vols;
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) {
-				my $name = $s->get_name();
-				next unless (grep(/RemovableMedia/,$name));
-				my $lastwrite = $s->get_timestamp();
-				my $ppi = (split(/#/,$name))[5];
-				push(@{$vols{$lastwrite}},$ppi);
-			}
-			
-			foreach my $t (reverse sort {$a <=> $b} keys %vols) {
-				::rptMsg(gmtime($t)." (UTC)");
-				foreach my $item (@{$vols{$t}}) {
-					::rptMsg("\tParentIdPrefix: ".$item);
-				}
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-			::logMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# devclass
+# Get USB device info from the DeviceClasses keys in the System
+# hive (Disks and Volumes GUIDs)
+#
+# Change History:
+#   20100901 - spelling error in output corrected
+#   20080331 - created
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package devclass;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20100901);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get USB device info from the DeviceClasses keys in the System hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching devclass v.".$VERSION);
+	::rptMsg("devclass v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ 	my $current;
+ 	my $ccs;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+	}
+	else {
+		::logMsg("Could not find ".$key_path);
+		return
+	}
+# Get devices from the Disk GUID
+	my $key_path = $ccs."\\Control\\DeviceClasses\\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("DevClasses - Disks");
+		::rptMsg($key_path);
+		::rptMsg("");
+		my %disks;
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) {
+				my $name = $s->get_name();
+				next unless (grep(/USBSTOR/,$name));
+				my $lastwrite = $s->get_timestamp();
+				my ($dev, $serial) = (split(/#/,$name))[4,5];
+				push(@{$disks{$lastwrite}},$dev.",".$serial);
+			}
+			
+			foreach my $t (reverse sort {$a <=> $b} keys %disks) {
+				::rptMsg(gmtime($t)." (UTC)");
+				foreach my $item (@{$disks{$t}}) {
+					::rptMsg("\t$item");
+				}
+			}
+			
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+			::logMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+	::rptMsg("");
+# Get devices from the Volume GUID
+	my $key_path = $ccs."\\Control\\DeviceClasses\\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("DevClasses - Volumes");
+		::rptMsg($key_path);
+		::rptMsg("");
+		my %vols;
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) {
+				my $name = $s->get_name();
+				next unless (grep(/RemovableMedia/,$name));
+				my $lastwrite = $s->get_timestamp();
+				my $ppi = (split(/#/,$name))[5];
+				push(@{$vols{$lastwrite}},$ppi);
+			}
+			
+			foreach my $t (reverse sort {$a <=> $b} keys %vols) {
+				::rptMsg(gmtime($t)." (UTC)");
+				foreach my $item (@{$vols{$t}}) {
+					::rptMsg("\tParentIdPrefix: ".$item);
+				}
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+			::logMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/dfrg.pl

@@ -1,63 +1,65 @@
-#-----------------------------------------------------------
-# dfrg.pl
-# Gets contents of Dfrg\BootOptimizeFunction key
-#
-# Change history:
-#   20110321 - created
-#
-# References
-#   http://technet.microsoft.com/en-us/library/cc784391%28WS.10%29.aspx
-#
-# copyright 2011 Quantum Analytics Research, LLC (keydet89@yahoo.com)
-#-----------------------------------------------------------
-package dfrg;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20110321);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Gets content of Dfrg BootOptim. key";	
-}
-sub getDescr{}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching dfrg v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Microsoft\\Dfrg\\BootOptimizeFunction";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("Dfrg");
-		::rptMsg($key_path);
-		::rptMsg("");
-		
-		my @vals = $key->get_list_of_values();
-		if (scalar(@vals) > 0) {
-			foreach my $v (@vals) {
-				::rptMsg(sprintf "%-20s %-20s",$v->get_name(),$v->get_data());
-			}
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# dfrg.pl
+# Gets contents of Dfrg\BootOptimizeFunction key
+#
+# Change history:
+#   20110321 - created
+#
+# References
+#   http://technet.microsoft.com/en-us/library/cc784391%28WS.10%29.aspx
+#
+# copyright 2011 Quantum Analytics Research, LLC (keydet89@yahoo.com)
+#-----------------------------------------------------------
+package dfrg;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20110321);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets content of Dfrg BootOptim. key";	
+}
+sub getDescr{}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching dfrg v.".$VERSION);
+	::rptMsg("dfrg v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Microsoft\\Dfrg\\BootOptimizeFunction";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("Dfrg");
+		::rptMsg($key_path);
+		::rptMsg("");
+		
+		my @vals = $key->get_list_of_values();
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) {
+				::rptMsg(sprintf "%-20s %-20s",$v->get_name(),$v->get_data());
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/diag_sr.pl

@@ -0,0 +1,81 @@
+#-----------------------------------------------------------
+# diag_sr.pl
+#
+# History:
+#  20120515: created
+#
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey
+#-----------------------------------------------------------
+package diag_sr;
+use strict;
+
+my %config = (hive          => "System",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120515);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Get Diag\\SystemRestore values and data";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching diag_sr v.".$VERSION);
+	::rptMsg("diag_sr v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my ($current,$ccs);
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+		my $volsnap_path = $ccs."\\Services\\VSS\\Diag\\SystemRestore";
+		my $volsnap;
+		if ($volsnap = $root_key->get_subkey($volsnap_path)) {
+			my @vals = $volsnap->get_list_of_values();
+			if (scalar(@vals) > 0) {
+				foreach my $v (@vals) {
+					my $name = $v->get_name();
+					my $t = gmtime(parseData($v->get_data()));
+					
+					::rptMsg(sprintf "%-25s  %-50s",$t,$name);
+					
+				}
+			}
+			else {
+				::rptMsg($volsnap_path." has no values.");
+			}
+		}
+		else {
+			::rptMsg($volsnap_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+sub parseData {
+	my $data = shift;
+	my ($t0,$t1) = unpack("VV",substr($data,0x08,8));
+	return ::getTime($t0,$t1);	
+}
+
+1;

RecentActivity/release/rr-full/plugins/direct.pl

@@ -0,0 +1,75 @@
+#-----------------------------------------------------------
+# direct.pl
+# This plugin runs through the Direct* subkeys beneath the Microsoft key
+# in the Software hive (as well as the Wow6432Node key, if it exists) and 
+# looks to see if there is a MostRecentApplication subkey; if there is, it
+# then tries to retrieve the "Name" value/data
+#
+# History:
+#  20120513 - created
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package direct;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20120513);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Searches Direct* keys for MostRecentApplication subkeys";	
+}
+sub getDescr{}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	my @keys = ('Microsoft','Wow6432Node\\Microsoft');
+	
+	::rptMsg("Launching direct v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	foreach my $key_path (@keys) {
+	  my $key;
+	  if ($key = $root_key->get_subkey($key_path)) {
+		  ::rptMsg($key_path);
+#		  ::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#		  ::rptMsg("");
+		  my @subkeys = $key->get_list_of_subkeys();
+		  if (scalar(@subkeys) > 0) {
+		    foreach my $s (@subkeys) {
+			  	next unless ($s->get_name() =~ m/^Direct/);
+			  	my $name = $s->get_name();
+			  	
+			  	eval {
+			  		my $app;
+			  		$app = $s->get_subkey("MostRecentApplication");
+			  		my $app_lw = gmtime($app->get_timestamp());
+			  		my $app_name = $app->get_value("Name")->get_data();
+			  		::rptMsg(sprintf "%-25s  %-50s",$app_lw,$s->get_name()."\\".$app->get_name()." - ".$app_name);
+			  		
+			  	};
+				}
+			}
+			else {
+		  	::rptMsg($key_path." has no subkeys.");
+			}
+			::rptMsg("");
+		}
+		else {
+	 		::rptMsg($key_path." not found.");
+		}
+	} 
+}
+1;

RecentActivity/release/rr-full/plugins/direct_tln.pl

@@ -0,0 +1,75 @@
+#-----------------------------------------------------------
+# direct_tln.pl
+# This plugin runs through the Direct* subkeys beneath the Microsoft key
+# in the Software hive (as well as the Wow6432Node key, if it exists) and 
+# looks to see if there is a MostRecentApplication subkey; if there is, it
+# then tries to retrieve the "Name" value/data
+#
+# History:
+#  20120608 - created
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package direct_tln;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20120608);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Searches Direct* keys for MostRecentApplication subkeys (TLN)";	
+}
+sub getDescr{}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	my @keys = ('Microsoft','Wow6432Node\\Microsoft');
+	
+	::rptMsg("Launching direct v.".$VERSION);
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	foreach my $key_path (@keys) {
+	  my $key;
+	  if ($key = $root_key->get_subkey($key_path)) {
+#		  ::rptMsg($key_path);
+#		  ::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+#		  ::rptMsg("");
+		  my @subkeys = $key->get_list_of_subkeys();
+		  if (scalar(@subkeys) > 0) {
+		    foreach my $s (@subkeys) {
+			  	next unless ($s->get_name() =~ m/^Direct/);
+			  	my $name = $s->get_name();
+			  	
+			  	eval {
+			  		my $app;
+			  		$app = $s->get_subkey("MostRecentApplication");
+			  		my $app_lw = $app->get_timestamp();
+			  		my $app_name = $app->get_value("Name")->get_data();
+#			  		::rptMsg(sprintf "%-25s  %-50s",$app_lw,$s->get_name()."\\".$app->get_name()." - ".$app_name);
+			  		::rptMsg($app_lw."|REG|||[Program Execution] ".$key_path."\\".$s->get_name()."\\".$app->get_name()." - ".$app_name);
+			  	};
+				}
+			}
+			else {
+#		  	::rptMsg($key_path." has no subkeys.");
+			}
+#			::rptMsg("");
+		}
+		else {
+#	 		::rptMsg($key_path." not found.");
+		}
+	} 
+}
+1;

RecentActivity/release/rr-full/plugins/disablelastaccess.pl

@@ -1,73 +1,75 @@
-#-----------------------------------------------------------
-# disablelastaccess.pl
-# 
-# References:
-#    http://support.microsoft.com/kb/555041
-#    http://support.microsoft.com/kb/894372
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package disablelastaccess;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20090118);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get NTFSDisableLastAccessUpdate value";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching disablelastaccess v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- my $current;
-	my $key_path = 'Select';
-	my $key;
-	my $ccs;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		$ccs = "ControlSet00".$current;
-	}
-
-	my $key_path = $ccs."\\Control\\FileSystem";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("NtfsDisableLastAccessUpdate");
-		::rptMsg($key_path);
-		my @vals = $key->get_list_of_values();
-		my $found = 0;
-		if (scalar(@vals) > 0) {
-			foreach my $v (@vals) {
-				if ($v->get_name() eq "NtfsDisableLastAccessUpdate") {
-					::rptMsg("NtfsDisableLastAccessUpdate = ".$v->get_data());
-					$found = 1;
-				}
-			}
-			::rptMsg("NtfsDisableLastAccessUpdate value not found.") if ($found == 0);
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# disablelastaccess.pl
+# 
+# References:
+#    http://support.microsoft.com/kb/555041
+#    http://support.microsoft.com/kb/894372
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package disablelastaccess;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20090118);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get NTFSDisableLastAccessUpdate value";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching disablelastaccess v.".$VERSION);
+	::rptMsg("disablelastaccess v.".$VERSION); # banner
+    ::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ my $current;
+	my $key_path = 'Select';
+	my $key;
+	my $ccs;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+	}
+
+	my $key_path = $ccs."\\Control\\FileSystem";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("NtfsDisableLastAccessUpdate");
+		::rptMsg($key_path);
+		my @vals = $key->get_list_of_values();
+		my $found = 0;
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) {
+				if ($v->get_name() eq "NtfsDisableLastAccessUpdate") {
+					::rptMsg("NtfsDisableLastAccessUpdate = ".$v->get_data());
+					$found = 1;
+				}
+			}
+			::rptMsg("NtfsDisableLastAccessUpdate value not found.") if ($found == 0);
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/disablesr.pl

@@ -0,0 +1,71 @@
+#-----------------------------------------------------------
+# disablesr.pl
+# 	Gets the value that turns System Restore either on or off
+#
+# Change History
+#   20120914 
+#
+# References
+# 	Registry Keys and Values for the System Restore Utility http://support.microsoft.com/kb/295659
+#
+# copyright 2012 Corey Harrell (Journey Into Incident Response)
+#-----------------------------------------------------------
+package disablesr;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20120914);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets the value that turns System Restore either on or off";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching disablesr v.".$VERSION);
+    ::rptMsg("disablesr v.".$VERSION); 
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); 
+
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key_path = "Microsoft\\Windows NT\\CurrentVersion\\SystemRestore";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my $disable;
+		eval {
+			$disable = $key->get_value("DisableSR")->get_data();
+		};
+		if ($@) {
+			::rptMsg("DisableSR value not found.");
+		}
+		else {
+			::rptMsg("DisableSR = ".$disable);
+			::rptMsg("");
+			::rptMsg("1 means System Restore is turned off");
+		}
+		
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+	
+}
+1;

RecentActivity/release/rr-full/plugins/dllsearch.pl

@@ -1,69 +1,71 @@
-#-----------------------------------------------------------
-# dllsearch.pl
-#
-# References: 
-#  http://support.microsoft.com/kb/2264107
-#
-# Change History:
-#  20100824: created
-# 
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package dllsearch;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20100824);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get crash control information";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching dllsearch v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- my $current;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		
-		my $cc_path = "ControlSet00".$current."\\Control\\Session Manager";
-		my $cc;
-		if ($cc = $root_key->get_subkey($cc_path)) {
-			::rptMsg("dllsearch v.".$VERSION);
-			::rptMsg("");
-			my $found = 1;
-			eval {
-				my $cde = $cc->get_value("CWDIllegalInDllSearch")->get_data();
-				$found = 0;
-				::rptMsg(sprintf "CWDIllegalInDllSearch = 0x%x",$cde);
-			};
-			::rptMsg("CWDIllegalInDllSearch value not found.") if ($found);
-		}	
-		else {
-			::rptMsg($cc_path." not found.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-1;
+#-----------------------------------------------------------
+# dllsearch.pl
+#
+# References: 
+#  http://support.microsoft.com/kb/2264107
+#
+# Change History:
+#  20100824: created
+# 
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package dllsearch;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20100824);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get crash control information";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching dllsearch v.".$VERSION);
+	::rptMsg("dllsearch v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ my $current;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		
+		my $cc_path = "ControlSet00".$current."\\Control\\Session Manager";
+		my $cc;
+		if ($cc = $root_key->get_subkey($cc_path)) {
+			::rptMsg("dllsearch v.".$VERSION);
+			::rptMsg("");
+			my $found = 1;
+			eval {
+				my $cde = $cc->get_value("CWDIllegalInDllSearch")->get_data();
+				$found = 0;
+				::rptMsg(sprintf "CWDIllegalInDllSearch = 0x%x",$cde);
+			};
+			::rptMsg("CWDIllegalInDllSearch value not found.") if ($found);
+		}	
+		else {
+			::rptMsg($cc_path." not found.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/dnschanger.pl

@@ -0,0 +1,94 @@
+#-----------------------------------------------------------
+# dnschanger.pl
+# DNSChanger malware modifies the NameServer and/or DhcpNameServer values
+# within the Registry for the interfaces.
+# 
+# Change history
+#    20120203 - created
+#
+# Need to add grep() for ranges:
+#  start range	end range
+# 85.255.112.0	85.255.127.255
+# 67.210.0.0	67.210.15.255
+# 93.188.160.0	93.188.167.255
+# 77.67.83.0	77.67.83.255
+# 213.109.64.0	213.109.79.255
+# 64.28.176.0	64.28.191.255
+#
+# Note: these may not be the only ranges used.  The best use of the
+# plugin is to know what your ranges are, and eyeball the output of 
+# the plugin.
+#
+# References
+#   https://twitter.com/#!/saved-search/%23DFIR
+# 
+# copyright 2012 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package dnschanger;
+use strict;
+
+my %config = (hive          => "System",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20120203);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Check for indication of DNSChanger infection.";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	my %nics;
+	my $ccs;
+	::logMsg("Launching dnschanger v.".$VERSION);
+	::rptMsg("dnschanger v.".$VERSION);
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my $current;
+	eval {
+		$current = $root_key->get_subkey("Select")->get_value("Current")->get_data();
+	};
+	my @nics;
+	my $key_path = "ControlSet00".$current."\\Services\\Tcpip\\Parameters\\Interfaces";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		my @guids = $key->get_list_of_subkeys();
+		if (scalar @guids > 0) {
+			foreach my $g (@guids) {
+				::rptMsg("Adapter: ".$g->get_name());
+				::rptMsg("LastWrite Time: ".gmtime($g->get_timestamp())." Z");
+				eval {
+					my @vals = $g->get_list_of_values();
+					foreach my $v (@vals) {
+						my $name = $v->get_name();
+						next unless ($name =~ m/NameServer$/);
+						my $data = $v->get_data();
+						::rptMsg(sprintf "  %-28s %-20s",$name,$data);
+					}
+					::rptMsg("");
+				};
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}	
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/domains.pl

@@ -1,74 +1,76 @@
-#-----------------------------------------------------------
-# domains.pl
-#  
-#
-# Change history
-#		 20100116 - Created
-#
-# References
-#    http://support.microsoft.com/kb/919748
-#    http://support.microsoft.com/kb/922704
-# 
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package domains;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20100116);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets contents Internet Settings\\ZoneMap\\Domains key";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	::logMsg("Launching domains v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path."\\Domains")) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my @subkeys = $key->get_list_of_subkeys();
-		if (scalar(@subkeys) > 0) {
-			foreach my $s (@subkeys) { 
-				::rptMsg($s->get_name()." [".gmtime($s->get_timestamp())." (UTC)]");
-				
-				my @vals = $s->get_list_of_values();
-				if (scalar @vals > 0) {
-					foreach my $v (@vals) {
-						::rptMsg("  ".$v->get_name()." -> ".$v->get_data);
-					}
-				}
-				::rptMsg("");
-			}
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-			::logMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# domains.pl
+#  
+#
+# Change history
+#		 20100116 - Created
+#
+# References
+#    http://support.microsoft.com/kb/919748
+#    http://support.microsoft.com/kb/922704
+# 
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package domains;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20100116);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents Internet Settings\\ZoneMap\\Domains key";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching domains v.".$VERSION);
+	::rptMsg("domains v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path."\\Domains")) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my @subkeys = $key->get_list_of_subkeys();
+		if (scalar(@subkeys) > 0) {
+			foreach my $s (@subkeys) { 
+				::rptMsg($s->get_name()." [".gmtime($s->get_timestamp())." (UTC)]");
+				
+				my @vals = $s->get_list_of_values();
+				if (scalar @vals > 0) {
+					foreach my $v (@vals) {
+						::rptMsg("  ".$v->get_name()." -> ".$v->get_data);
+					}
+				}
+				::rptMsg("");
+			}
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+			::logMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/drivers32.pl

@@ -0,0 +1,96 @@
+#-----------------------------------------------------------
+# drivers32
+# Get values from Drivers32 key
+# 
+# History
+#   20130408 - created by copying then modifying the soft_run plug-in
+#
+# References
+#	Location of Windows NT Multimedia Drivers in the Registry
+#		http://support.microsoft.com/kb/126054
+# 
+# copyright 2013 Corey Harrell (jIIr)
+#-----------------------------------------------------------
+package drivers32;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              version       => 20130408);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get values from the Drivers32 key";	
+}
+sub getDescr{}
+sub getRefs {
+	my %refs = ("Location of Windows NT Multimedia Drivers in the Registry" =>
+	            "http://support.microsoft.com/kb/126054");	
+	return %refs;
+}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching drivers32 v.".$VERSION);
+	::rptMsg("drivers32 v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my @paths = ("Microsoft\\Windows NT\\CurrentVersion\\Drivers32",
+	             "Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32",
+	             );
+	
+	foreach my $key_path (@paths) {
+	
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		
+			my %vals = getKeyValues($key);
+			if (scalar(keys %vals) > 0) {
+				foreach my $v (keys %vals) {
+					::rptMsg("  ".$v." - ".$vals{$v});
+				}
+				::rptMsg("");
+			}
+			else {
+				::rptMsg($key_path." has no values.");
+			}
+		
+		}
+		else {
+			::rptMsg($key_path." not found.");
+			::rptMsg("");
+		}
+	}
+}
+
+sub getKeyValues {
+	my $key = shift;
+	my %vals;
+	
+	my @vk = $key->get_list_of_values();
+	if (scalar(@vk) > 0) {
+		foreach my $v (@vk) {
+			next if ($v->get_name() eq "" && $v->get_data() eq "");
+			$vals{$v->get_name()} = $v->get_data();
+		}
+	}
+	else {
+	
+	}
+	return %vals;
+}
+
+1;

RecentActivity/release/rr-full/plugins/drwatson.pl

@@ -1,77 +1,79 @@
-#-----------------------------------------------------------
-# drwatson.pl
-# Author: Don C. Weber
-# Plugin for Registry Ripper; Access Software hive file to get the
-# Dr. Watson settings from Software hive
-# 
-# Change history
-#
-#
-# References
-#  Dr Watson: http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/RegistryTools/DrWatson.html
-# 
-# Author: Don C. Weber, http://www.cutawaysecurity.com/blog/cutaway-security
-#-----------------------------------------------------------
-package drwatson;
-use strict;
-
-my %config = (hive          => "Software",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20081219);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets Dr. Watson settings from Software hive";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching drwatson v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-	my $key_path = "Microsoft\\Windows NT\\CurrentVersion\\AeDebug";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		($key->get_value('Auto') == 0x0) ? ::rptMsg("Debugging is Disabled") : ::rptMsg("Debugging is Enabled");
-		eval {
-			::rptMsg("Debugger: ".$key->get_value('Debugger')->get_data());
-		};
-			
-	} else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-		
-	::rptMsg("");
-	my $key_path = "Microsoft\\DrWatson";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		($key->get_value('LogFilePath')) ? ::rptMsg("DrWatson LogFile Path location: ".$key->get_value('LogFilePath')->get_data()) : ::rptMsg("DrWatson LogFile Path location: %SystemRoot%\\Documents and Settings\\All Users\\Documents\\DrWatson");
-		($key->get_value('CreateCrashDump') == 0x0) ? ::rptMsg("CreateCrashDump is Disabled") : ::rptMsg("CreateCrashDump is Enabled");
-		($key->get_value('CrashDumpFile')) ? ::rptMsg("Crash Dump Path and Name: ".$key->get_value('CrashDumpFile')->get_data()) : ::rptMsg("CrashDumpFile is not set");
-		($key->get_value('AppendToLogFile') == 0x0) ? ::rptMsg("AppendToLogFile is set to create a new file each time") : ::rptMsg("AppendToLogFile is set to append");
-			
-	} else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-	
-	::rptMsg("");
-	::rptMsg("Analysis Tips: For Dr. Watson settings information check: http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/RegistryTools/DrWatson.html");
-}
-
+#-----------------------------------------------------------
+# drwatson.pl
+# Author: Don C. Weber
+# Plugin for Registry Ripper; Access Software hive file to get the
+# Dr. Watson settings from Software hive
+# 
+# Change history
+#
+#
+# References
+#  Dr Watson: http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/RegistryTools/DrWatson.html
+# 
+# Author: Don C. Weber, http://www.cutawaysecurity.com/blog/cutaway-security
+#-----------------------------------------------------------
+package drwatson;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20081219);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets Dr. Watson settings from Software hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching drwatson v.".$VERSION);
+	::rptMsg("drwatson v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key_path = "Microsoft\\Windows NT\\CurrentVersion\\AeDebug";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		($key->get_value('Auto') == 0x0) ? ::rptMsg("Debugging is Disabled") : ::rptMsg("Debugging is Enabled");
+		eval {
+			::rptMsg("Debugger: ".$key->get_value('Debugger')->get_data());
+		};
+			
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+		
+	::rptMsg("");
+	my $key_path = "Microsoft\\DrWatson";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		($key->get_value('LogFilePath')) ? ::rptMsg("DrWatson LogFile Path location: ".$key->get_value('LogFilePath')->get_data()) : ::rptMsg("DrWatson LogFile Path location: %SystemRoot%\\Documents and Settings\\All Users\\Documents\\DrWatson");
+		($key->get_value('CreateCrashDump') == 0x0) ? ::rptMsg("CreateCrashDump is Disabled") : ::rptMsg("CreateCrashDump is Enabled");
+		($key->get_value('CrashDumpFile')) ? ::rptMsg("Crash Dump Path and Name: ".$key->get_value('CrashDumpFile')->get_data()) : ::rptMsg("CrashDumpFile is not set");
+		($key->get_value('AppendToLogFile') == 0x0) ? ::rptMsg("AppendToLogFile is set to create a new file each time") : ::rptMsg("AppendToLogFile is set to append");
+			
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+	
+	::rptMsg("");
+	::rptMsg("Analysis Tips: For Dr. Watson settings information check: http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/RegistryTools/DrWatson.html");
+}
+
 1;

RecentActivity/release/rr-full/plugins/emdmgmt.pl

@@ -0,0 +1,96 @@
+#-----------------------------------------------------------
+# emdmgmt.pl
+#
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author: H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package emdmgmt;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20120207);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets contents of EMDMgmt subkeys and values";	
+}
+sub getDescr{}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching emdmgmt v.".$VERSION);
+	::rptMsg("emdmgmt v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Microsoft\\Windows NT\\CurrentVersion\\EMDMgmt';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("EMDMgmt");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my @sk = $key->get_list_of_subkeys();
+		foreach my $s (@sk) {
+			my $name = $s->get_name();
+			if ($name =~ m/^_\?\?_USBSTOR/) {
+				my ($usb,$sn,$vol) = (split(/#/,$name,4))[1,2,3];
+				::rptMsg($usb);
+				::rptMsg("  LastWrite: ".gmtime($s->get_timestamp())." Z");
+				::rptMsg("  SN: ".$sn);
+				$vol =~ s/{53f56307-b6bf-11d0-94f2-00a0c91efb8b}//;
+				my ($volname,$vsn) = split(/_/,$vol,2);
+				$vsn = uc(sprintf "%x",$vsn);
+				if (length($vsn) >= 8) {
+					my ($f,$l) = unpack("(A4)*",$vsn);
+					$vsn = $f."-".$l;
+				}
+				::rptMsg("  Vol Name: ".$volname) if ($volname ne "");
+				::rptMsg("  VSN: ".$vsn);
+				my $last = $s->get_value_data("LastTestedTime");
+				my ($lo,$hi) = unpack("VV",$last);
+				if ($lo != 0 && $hi != 0) {
+					::rptMsg("  LastTestedTime: ".gmtime(::getTime($lo,$hi))." Z");
+				}
+				::rptMsg("");	
+			}
+			else {
+				my @n = split(/_/,$name);
+				my $t = scalar(@n);
+				my $volname = $n[$t - 2];
+				my $vsn = $n[$t - 1];
+				$vsn = uc(sprintf "%x",$vsn);
+				if (length($vsn) >= 8) {
+					my ($f,$l) = unpack("(A4)*",$vsn);
+					$vsn = $f."-".$l;
+				}
+				$volname = "Unknown Volume" unless ($volname ne "");
+				::rptMsg($volname);
+				::rptMsg("  LastWrite: ".gmtime($s->get_timestamp())." Z");
+				::rptMsg("  VSN: ".$vsn);
+				
+				my $last = $s->get_value_data("LastTestedTime");
+				my ($lo,$hi) = unpack("VV",$last);
+				if ($lo != 0 && $hi != 0) {
+					::rptMsg("  LastTestedTime: ".gmtime(::getTime($lo,$hi))." Z");
+				}
+				::rptMsg("");
+			}
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/environment.pl

@@ -0,0 +1,89 @@
+#-----------------------------------------------------------
+# environment.pl
+#   Extracts user's Environment paths from NTUSER.DAT
+# 
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+# 
+# Copyright (c) 2011-02-04 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package environment;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20110204);
+my $VERSION = getVersion();
+
+# Functions #
+sub getDescr {}
+sub getRefs {}
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getShortDescr {
+	return "Extracts user's Environment paths from NTUSER.DAT";
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+
+	# Initialize #
+	::logMsg("Launching environment v.".$VERSION);
+    ::rptMsg("environment v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # 20110830 [fpi] + banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Environment";
+
+	# If # Environment path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("Environment");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from Environment registry path #
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for Environment registry path #
+			foreach my $v (@vals) {
+				::rptMsg($v->get_name()." -> ".$v->get_data());
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # Environment isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;

RecentActivity/release/rr-full/plugins/esent.pl

@@ -1,78 +1,80 @@
-#-----------------------------------------------------------
-# esent
-# Get contents of Esent\Process key from Software hive
-# 
-# Note: Not sure why I wrote this one; just thought it might come
-#       in handy as info about this key is developed.
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package esent;
-use strict;
-
-my %config = (hive          => "Software",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 1,
-              version       => 20101202);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get ESENT\\Process key contents";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching esent v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Microsoft\\ESENT\\Process";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg($key_path);
-#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		::rptMsg("");
-		
-		my @sk = $key->get_list_of_subkeys();
-		
-		if (scalar(@sk) > 0) {
-			my %esent;
-			
-			foreach my $s (@sk) {
-				my $sk = $s->get_subkey("DEBUG");
-#				my $lw = $s->get_timestamp();
-				my $lw = $sk->get_timestamp();
-
-				my $name = $s->get_name();
-				
-				push(@{$esent{$lw}},$name);
-			}
-			
-			foreach my $t (reverse sort {$a <=> $b} keys %esent) {
-				::rptMsg(gmtime($t)." (UTC)");
-				foreach my $item (@{$esent{$t}}) {
-					::rptMsg("  $item");
-				}
-			}
-			
-		}
-		else {
-			::rptMsg($key_path." has no subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# esent
+# Get contents of Esent\Process key from Software hive
+# 
+# Note: Not sure why I wrote this one; just thought it might come
+#       in handy as info about this key is developed.
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package esent;
+use strict;
+
+my %config = (hive          => "Software",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              version       => 20101202);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get ESENT\\Process key contents";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching esent v.".$VERSION);
+	::rptMsg("esent v.".$VERSION); # banner
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Microsoft\\ESENT\\Process";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+#		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		
+		my @sk = $key->get_list_of_subkeys();
+		
+		if (scalar(@sk) > 0) {
+			my %esent;
+			
+			foreach my $s (@sk) {
+				my $sk = $s->get_subkey("DEBUG");
+#				my $lw = $s->get_timestamp();
+				my $lw = $sk->get_timestamp();
+
+				my $name = $s->get_name();
+				
+				push(@{$esent{$lw}},$name);
+			}
+			
+			foreach my $t (reverse sort {$a <=> $b} keys %esent) {
+				::rptMsg(gmtime($t)." (UTC)");
+				foreach my $item (@{$esent{$t}}) {
+					::rptMsg("  $item");
+				}
+			}
+			
+		}
+		else {
+			::rptMsg($key_path." has no subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/eventlog.pl

@@ -1,156 +1,158 @@
-#-----------------------------------------------------------
-# eventlog.pl
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package eventlog;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20090112);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get EventLog configuration info";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching eventlog v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-# Code for System file, getting CurrentControlSet
- my $current;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		
-		my $evt_path = "ControlSet00".$current."\\Services\\Eventlog";
-		my $evt;
-		if ($evt = $root_key->get_subkey($evt_path)) {
-			::rptMsg("");
-			my @subkeys = $evt->get_list_of_subkeys();
-			if (scalar (@subkeys) > 0) {
-				foreach my $s (@subkeys) {
-					my $logname = $s->get_name();
-					::rptMsg($logname." \\ ".scalar gmtime($s->get_timestamp())."Z");
-					eval {
-						my $file = $s->get_value("File")->get_data();
-						::rptMsg("  File               = ".$file);
-					};
-					
-					eval {
-						my $display = $s->get_value("DisplayNameFile")->get_data();
-						::rptMsg("  DisplayNameFile    = ".$display);
-					};
-					
-					eval {
-						my $max = $s->get_value("MaxSize")->get_data();
-						::rptMsg("  MaxSize            = ".processSize($max));
-					};
-					
-					eval {
-						my $ret = $s->get_value("Retention")->get_data();
-						::rptMsg("  Retention          = ".processRetention($ret));
-					};
-
-# AutoBackupLogFiles; http://support.microsoft.com/kb/312571/					
-					eval {
-						my $auto = $s->get_value("AutoBackupLogFiles")->get_data();
-						::rptMsg("  AutoBackupLogFiles = ".$auto);
-					};
-
-# Check WarningLevel value on Security EventLog; http://support.microsoft.com/kb/945463
-					eval {
-						if ($logname eq "Security") {
-							my $wl = $s->get_value("WarningLevel")->get_data();
-							::rptMsg("  WarningLevel       = ".$wl);
-						}
-					};
-					
-					::rptMsg("");
-				}
-				
-			}
-			else {
-				::rptMsg($evt_path." has no subkeys.");
-			}
-		}
-		else {
-			::rptMsg($evt_path." not found.");
-			::logMsg($evt_path." not found.");
-		}	
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
-1;
-
-sub processSize {
-	my $sz = shift;
-	
-	my $kb = 1024;
-	my $mb = $kb * 1024;
-	my $gb = $mb * 1024;
-	
-	if ($sz > $gb) {
-		my $d = $sz/$gb;
-		my $l = length((split(/\./,$d,2))[0]) + 2;
-		return sprintf "%$l.2fGB",$d;
-	}
-	elsif ($sz > $mb) {
-		my $d = $sz/$mb;
-		my $l = length((split(/\./,$d,2))[0]) + 2;
-		return sprintf "%$l.2fMB",$d;
-	}
-	elsif ($sz > $kb) {
-		my $d = $sz/$kb;
-		my $l = length((split(/\./,$d,2))[0]) + 2;
-		return sprintf "%$l.2fKB",$d;
-	}
-	else {return $sz."B"};
-}
-
-sub processRetention {
-# Retention maintained in seconds
-# http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/
-#        regentry/30709.mspx?mfr=true
-	my $ret = shift;
-	
-	my $min = 60;
-	my $hr  = $min * 60;
-	my $day = $hr * 24;
-	
-	if ($ret > $day) {
-		my $d = $ret/$day;
-		my $l = length((split(/\./,$d,2))[0]) + 2;
-		return sprintf "%$l.2f days",$d; 
-	}
-	elsif ($ret > $hr) {
-		my $d = $ret/$hr;
-		my $l = length((split(/\./,$d,2))[0]) + 2;
-		return sprintf "%$l.2f hr",$d;
-	}
-	elsif ($ret > $min) {
-		my $d = $ret/$min;
-		my $l = length((split(/\./,$d,2))[0]) + 2;
-		return sprintf "%$l.2f min",$d;
-	}
-	else {return $ret." sec"};
+#-----------------------------------------------------------
+# eventlog.pl
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package eventlog;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20090112);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get EventLog configuration info";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching eventlog v.".$VERSION);
+	::rptMsg("eventlog v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+# Code for System file, getting CurrentControlSet
+ my $current;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		
+		my $evt_path = "ControlSet00".$current."\\Services\\Eventlog";
+		my $evt;
+		if ($evt = $root_key->get_subkey($evt_path)) {
+			::rptMsg("");
+			my @subkeys = $evt->get_list_of_subkeys();
+			if (scalar (@subkeys) > 0) {
+				foreach my $s (@subkeys) {
+					my $logname = $s->get_name();
+					::rptMsg($logname." \\ ".scalar gmtime($s->get_timestamp())."Z");
+					eval {
+						my $file = $s->get_value("File")->get_data();
+						::rptMsg("  File               = ".$file);
+					};
+					
+					eval {
+						my $display = $s->get_value("DisplayNameFile")->get_data();
+						::rptMsg("  DisplayNameFile    = ".$display);
+					};
+					
+					eval {
+						my $max = $s->get_value("MaxSize")->get_data();
+						::rptMsg("  MaxSize            = ".processSize($max));
+					};
+					
+					eval {
+						my $ret = $s->get_value("Retention")->get_data();
+						::rptMsg("  Retention          = ".processRetention($ret));
+					};
+
+# AutoBackupLogFiles; http://support.microsoft.com/kb/312571/					
+					eval {
+						my $auto = $s->get_value("AutoBackupLogFiles")->get_data();
+						::rptMsg("  AutoBackupLogFiles = ".$auto);
+					};
+
+# Check WarningLevel value on Security EventLog; http://support.microsoft.com/kb/945463
+					eval {
+						if ($logname eq "Security") {
+							my $wl = $s->get_value("WarningLevel")->get_data();
+							::rptMsg("  WarningLevel       = ".$wl);
+						}
+					};
+					
+					::rptMsg("");
+				}
+				
+			}
+			else {
+				::rptMsg($evt_path." has no subkeys.");
+			}
+		}
+		else {
+			::rptMsg($evt_path." not found.");
+			::logMsg($evt_path." not found.");
+		}	
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
+1;
+
+sub processSize {
+	my $sz = shift;
+	
+	my $kb = 1024;
+	my $mb = $kb * 1024;
+	my $gb = $mb * 1024;
+	
+	if ($sz > $gb) {
+		my $d = $sz/$gb;
+		my $l = length((split(/\./,$d,2))[0]) + 2;
+		return sprintf "%$l.2fGB",$d;
+	}
+	elsif ($sz > $mb) {
+		my $d = $sz/$mb;
+		my $l = length((split(/\./,$d,2))[0]) + 2;
+		return sprintf "%$l.2fMB",$d;
+	}
+	elsif ($sz > $kb) {
+		my $d = $sz/$kb;
+		my $l = length((split(/\./,$d,2))[0]) + 2;
+		return sprintf "%$l.2fKB",$d;
+	}
+	else {return $sz."B"};
+}
+
+sub processRetention {
+# Retention maintained in seconds
+# http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/
+#        regentry/30709.mspx?mfr=true
+	my $ret = shift;
+	
+	my $min = 60;
+	my $hr  = $min * 60;
+	my $day = $hr * 24;
+	
+	if ($ret > $day) {
+		my $d = $ret/$day;
+		my $l = length((split(/\./,$d,2))[0]) + 2;
+		return sprintf "%$l.2f days",$d; 
+	}
+	elsif ($ret > $hr) {
+		my $d = $ret/$hr;
+		my $l = length((split(/\./,$d,2))[0]) + 2;
+		return sprintf "%$l.2f hr",$d;
+	}
+	elsif ($ret > $min) {
+		my $d = $ret/$min;
+		my $l = length((split(/\./,$d,2))[0]) + 2;
+		return sprintf "%$l.2f min",$d;
+	}
+	else {return $ret." sec"};
 }

RecentActivity/release/rr-full/plugins/eventlogs.pl

@@ -1,98 +1,100 @@
-#-----------------------------------------------------------
-# eventlogs.pl
-# Author: Don C. Weber
-# Plugin for Registry Ripper; Access System hive file to get the
-# Event Log settings from System hive
-# 
-# Change history
-#
-#
-# References
-#  Eventlog Key: http://msdn.microsoft.com/en-us/library/aa363648(VS.85).aspx
-# 
-# Author: Don C. Weber, http://www.cutawaysecurity.com/blog/cutaway-security
-#-----------------------------------------------------------
-package eventlogs;
-use strict;
-
-my %config = (hive          => "System",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20081219);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets Event Log settings from System hive";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching eventlogs v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-# First thing to do is get the ControlSet00x marked current...this is
-# going to be used over and over again in plugins that access the system
-# file
-	my $current;
-	my $key_path = 'Select';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		$current = $key->get_value("Current")->get_data();
-		my $ccs = "ControlSet00".$current;
-		my $win_path = $ccs."\\Services\\Eventlog";
-		my $win;
-		if ($win = $root_key->get_subkey($win_path)) {
-			::rptMsg("EventLog Configuration");
-			::rptMsg($win_path);
-			::rptMsg("LastWrite Time ".gmtime($win->get_timestamp())." (UTC)");
-			my $cn;
-			if ($cn = $win->get_value("ComputerName")->get_data()) {
-				::rptMsg("ComputerName = ".$cn);				
-			}
-			else {
-				::rptMsg("ComputerName value not found.");
-			}
-		}
-		else {
-			::rptMsg($win_path." not found.");
-		}
-
-#		Cycle through each type of log
-		my $logname;
-		my $evpath;
-		my $evlog;
-		my @list_logs = $win->get_list_of_subkeys();
-		foreach $logname (@list_logs){
-			::rptMsg("");
-			$evpath = $win_path."\\".$logname->get_name();
-			if ($evlog = $root_key->get_subkey($evpath)) {
-				::rptMsg("	".$logname->get_name()." EventLog");
-				::rptMsg("	".$evpath);
-				::rptMsg("	LastWrite Time ".gmtime($evlog->get_timestamp())." (UTC)");
-				::rptMsg("	Configuration Settings");
-				::rptMsg("		Log location: ".$evlog->get_value('File')->get_data());
-				::rptMsg("		Log Size: ".$evlog->get_value('MaxSize')->get_data()." Bytes");
-				($evlog->get_value('AutoBackupLogFiles') == 0x0) ? ::rptMsg("		AutoBackupLogFiles is Disabled") : ::rptMsg("		AutoBackupLogFiles is Enabled")
-			}
-			else {
-				::rptMsg($logname->get_name()." Event Log not found.");
-			}				
-		}		
-		::rptMsg("");
-		::rptMsg("Analysis Tips: For Event Log settings information check: http://msdn.microsoft.com/en-us/library/aa363648(VS.85).aspx");
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# eventlogs.pl
+# Author: Don C. Weber
+# Plugin for Registry Ripper; Access System hive file to get the
+# Event Log settings from System hive
+# 
+# Change history
+#
+#
+# References
+#  Eventlog Key: http://msdn.microsoft.com/en-us/library/aa363648(VS.85).aspx
+# 
+# Author: Don C. Weber, http://www.cutawaysecurity.com/blog/cutaway-security
+#-----------------------------------------------------------
+package eventlogs;
+use strict;
+
+my %config = (hive          => "System",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20081219);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets Event Log settings from System hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching eventlogs v.".$VERSION);
+	::rptMsg("eventlogs v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# First thing to do is get the ControlSet00x marked current...this is
+# going to be used over and over again in plugins that access the system
+# file
+	my $current;
+	my $key_path = 'Select';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		$current = $key->get_value("Current")->get_data();
+		my $ccs = "ControlSet00".$current;
+		my $win_path = $ccs."\\Services\\Eventlog";
+		my $win;
+		if ($win = $root_key->get_subkey($win_path)) {
+			::rptMsg("EventLog Configuration");
+			::rptMsg($win_path);
+			::rptMsg("LastWrite Time ".gmtime($win->get_timestamp())." (UTC)");
+			my $cn;
+			if ($cn = $win->get_value("ComputerName")->get_data()) {
+				::rptMsg("ComputerName = ".$cn);				
+			}
+			else {
+				::rptMsg("ComputerName value not found.");
+			}
+		}
+		else {
+			::rptMsg($win_path." not found.");
+		}
+
+#		Cycle through each type of log
+		my $logname;
+		my $evpath;
+		my $evlog;
+		my @list_logs = $win->get_list_of_subkeys();
+		foreach $logname (@list_logs){
+			::rptMsg("");
+			$evpath = $win_path."\\".$logname->get_name();
+			if ($evlog = $root_key->get_subkey($evpath)) {
+				::rptMsg("	".$logname->get_name()." EventLog");
+				::rptMsg("	".$evpath);
+				::rptMsg("	LastWrite Time ".gmtime($evlog->get_timestamp())." (UTC)");
+				::rptMsg("	Configuration Settings");
+				::rptMsg("		Log location: ".$evlog->get_value('File')->get_data());
+				::rptMsg("		Log Size: ".$evlog->get_value('MaxSize')->get_data()." Bytes");
+				($evlog->get_value('AutoBackupLogFiles') == 0x0) ? ::rptMsg("		AutoBackupLogFiles is Disabled") : ::rptMsg("		AutoBackupLogFiles is Enabled")
+			}
+			else {
+				::rptMsg($logname->get_name()." Event Log not found.");
+			}				
+		}		
+		::rptMsg("");
+		::rptMsg("Analysis Tips: For Event Log settings information check: http://msdn.microsoft.com/en-us/library/aa363648(VS.85).aspx");
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/fileexts.pl

@@ -1,73 +1,75 @@
-#-----------------------------------------------------------
-# fileexts.pl
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package fileexts;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              osmask        => 22,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20080818);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Get user FileExts values";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching fileexts v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts";
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("fileexts");
-		::rptMsg($key_path);
-		::rptMsg("");
-		
-		my @sk = $key->get_list_of_subkeys();
-		if (scalar(@sk) > 0) {
-			foreach my $s (@sk) {
-				my $name = $s->get_name();
-				next unless ($name =~ m/^\.\w+/);
-				
-				eval {
-					my $data = $s->get_subkey("OpenWithList")->get_value("MRUList")->get_data();
-					if ($data =~ m/^\w/) {
-						::rptMsg("File Extension: ".$name);
-						::rptMsg("LastWrite: ".gmtime($s->get_subkey("OpenWithList")->get_timestamp()));
-						::rptMsg("MRUList: ".$data);
-						my @list = split(//,$data);
-						foreach my $l (@list) {
-							my $valdata = $s->get_subkey("OpenWithList")->get_value($l)->get_data();
-							::rptMsg("  ".$l." => ".$valdata);
-						}
-						::rptMsg("");
-					}
-				};
-			}
-		}
-		else {
-			::rptMsg($key_path." does not have subkeys.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-		::logMsg($key_path." not found.");
-	}
-}
+#-----------------------------------------------------------
+# fileexts.pl
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package fileexts;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              osmask        => 22,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20080818);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Get user FileExts values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching fileexts v.".$VERSION);
+	::rptMsg("fileexts v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("fileexts");
+		::rptMsg($key_path);
+		::rptMsg("");
+		
+		my @sk = $key->get_list_of_subkeys();
+		if (scalar(@sk) > 0) {
+			foreach my $s (@sk) {
+				my $name = $s->get_name();
+				next unless ($name =~ m/^\.\w+/);
+				
+				eval {
+					my $data = $s->get_subkey("OpenWithList")->get_value("MRUList")->get_data();
+					if ($data =~ m/^\w/) {
+						::rptMsg("File Extension: ".$name);
+						::rptMsg("LastWrite: ".gmtime($s->get_subkey("OpenWithList")->get_timestamp()));
+						::rptMsg("MRUList: ".$data);
+						my @list = split(//,$data);
+						foreach my $l (@list) {
+							my $valdata = $s->get_subkey("OpenWithList")->get_value($l)->get_data();
+							::rptMsg("  ".$l." => ".$valdata);
+						}
+						::rptMsg("");
+					}
+				};
+			}
+		}
+		else {
+			::rptMsg($key_path." does not have subkeys.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+}
 1;

RecentActivity/release/rr-full/plugins/filehistory.pl

@@ -0,0 +1,95 @@
+#-----------------------------------------------------------
+# filehistory.pl
+# Get filehistory settings
+#
+# Change history
+#   20120722 - updated %config hash
+#   20120620 - updated/modified by H. Carvey
+#   20120607 - created by K. Johnson
+#
+# References
+#   This RegRipper plugin was created based on research I have done on 
+#   the FileHistory Feature of Windows 8. 
+#   http://randomthoughtsofforensics.blogspot.com/
+# 
+# FileHistoy Plugin copyright 2012 K. Johnson
+# Edited by H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package filehistory;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+							hivemask      => 16,
+							output        => "report",
+							category      => "",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 32,  #Windows 8
+              version       => 20120620);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets filehistory settings";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	::logMsg("Launching filehistory v.".$VERSION);
+	::rptMsg("filehistory v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = "Software\\Microsoft\\Windows\\CurrentVersion\\FileHistory";
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+		my @vals = $key->get_list_of_values();
+		
+		if (scalar(@vals) > 0) {
+			foreach my $v (@vals) {
+				
+				if ($v->get_name() eq "ProtectedUpToTime") {
+					my @t = unpack("VV",$v->get_data());
+					my $pft = ::getTime($t[0],$t[1]);
+					::rptMsg("  ProtectedUpToTime = ".gmtime($pft)." (UTC)");	
+				}
+				
+				if ($v->get_name() eq "ReassociationPerformed") {
+					::rptMsg(sprintf "%-20s 0x%x","ReassociationPerformed",$v->get_data());
+				}
+				
+				if ($v->get_name() eq "RestoreAllowed") {
+					::rptMsg(sprintf "%-20s 0x%x","RestoreAllowed",$v->get_data());
+				}
+				
+				if ($v->get_name() eq "SearchRebuildRequired") {
+					::rptMsg(sprintf "%-20s 0x%x","SearchRebuildRequired",$v->get_data());
+				}
+				
+				if ($v->get_name() eq "TargetChanged") {
+					::rptMsg(sprintf "%-20s 0x%x","TargetChanged",$v->get_data());
+				}
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+			::rptMsg("File History may not be configured for this user.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
+1;

RecentActivity/release/rr-full/plugins/findexes.pl

@@ -1,95 +1,96 @@
-#! c:\perl\bin\perl.exe
-#-----------------------------------------------------------
-# findexes.pl
-# Plugin for RegRipper; traverses through a Registry hive,
-# looking for values with binary data types, and checks to see
-# if they start with "MZ"; if so, records the value path, key 
-# LastWrite time, and length of the data
-#
-# Change history
-#    20090728 - Created
-# 
-# copyright 2009 H. Carvey
-#-----------------------------------------------------------
-package findexes;
-use strict;
-
-my %config = (hive          => "All",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20090728);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Scans a hive file looking for binary value data that contains MZ";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-my %vals;
-my $bin_count = 0;
-my $exe_count = 0;
-
-sub pluginmain {
-	my $class = shift;
-	my $file = shift;
-	my $reg = Parse::Win32Registry->new($file);
-	my $root_key = $reg->get_root_key;
-	::logMsg("Launching findexes v.".$VERSION);
-	
-	traverse($root_key);
-# Data structure containing findings is a hash of hashes	
-	foreach my $k (keys %vals) {
-		::rptMsg("Key: ".$k."   LastWrite time: ".gmtime($vals{$k}{lastwrite}));
-		foreach my $i (keys %{$vals{$k}}) {
-			next if ($i eq "lastwrite");
-			::rptMsg("  Value: ".$i."  Length: ".$vals{$k}{$i}." bytes");
-		}
-		::rptMsg("");
-	}
-	::rptMsg("Number of values w/ binary data types: ".$bin_count);
-	::rptMsg("Number of values w/ MZ in binary data:   ".$exe_count);
-}
-
-sub traverse {
-	my $key = shift;
-#  my $ts = $key->get_timestamp();
-  
-  foreach my $val ($key->get_list_of_values()) {
-  	my $type = $val->get_type();
-  	if ($type == 0 || $type == 3) {
-  		$bin_count++;
-  		my $data = $val->get_data();
-# This code looks for data that starts with MZ
-#  		my $i    = unpack("v",substr($data,0,2)); 		
-#  		if ($i == 0x5a4d) {
-			if (grep(/MZ/,$data)) {
-				$exe_count++;		
-				my $path;
-				my @p = split(/\\/,$key->get_path());
-				if (scalar(@p) == 1) {
-					$path = "root";
-				}
-				else {
-					shift(@p);
-					$path = join('\\',@p);
-				}
-				
-				$vals{$path}{lastwrite} = $key->get_timestamp();
-				$vals{$path}{$val->get_name()}    = length($data);			
-			}
-  	}
-  }
-  
-	foreach my $subkey ($key->get_list_of_subkeys()) {
-		traverse($subkey);
-  }
-}
-
+#! c:\perl\bin\perl.exe
+#-----------------------------------------------------------
+# findexes.pl
+# Plugin for RegRipper; traverses through a Registry hive,
+# looking for values with binary data types, and checks to see
+# if they start with "MZ"; if so, records the value path, key 
+# LastWrite time, and length of the data
+#
+# Change history
+#    20090728 - Created
+# 
+# copyright 2009 H. Carvey
+#-----------------------------------------------------------
+package findexes;
+use strict;
+
+my %config = (hive          => "All",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20090728);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Scans a hive file looking for binary value data that contains MZ";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+my %vals;
+my $bin_count = 0;
+my $exe_count = 0;
+
+sub pluginmain {
+	my $class = shift;
+	my $file = shift;
+	my $reg = Parse::Win32Registry->new($file);
+	my $root_key = $reg->get_root_key;
+	::logMsg("Launching findexes v.".$VERSION);
+	::rptMsg("findexes v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner 
+	traverse($root_key);
+# Data structure containing findings is a hash of hashes	
+	foreach my $k (keys %vals) {
+		::rptMsg("Key: ".$k."   LastWrite time: ".gmtime($vals{$k}{lastwrite}));
+		foreach my $i (keys %{$vals{$k}}) {
+			next if ($i eq "lastwrite");
+			::rptMsg("  Value: ".$i."  Length: ".$vals{$k}{$i}." bytes");
+		}
+		::rptMsg("");
+	}
+	::rptMsg("Number of values w/ binary data types: ".$bin_count);
+	::rptMsg("Number of values w/ MZ in binary data:   ".$exe_count);
+}
+
+sub traverse {
+	my $key = shift;
+#  my $ts = $key->get_timestamp();
+  
+  foreach my $val ($key->get_list_of_values()) {
+  	my $type = $val->get_type();
+  	if ($type == 0 || $type == 3) {
+  		$bin_count++;
+  		my $data = $val->get_data();
+# This code looks for data that starts with MZ
+#  		my $i    = unpack("v",substr($data,0,2)); 		
+#  		if ($i == 0x5a4d) {
+			if (grep(/MZ/,$data)) {
+				$exe_count++;		
+				my $path;
+				my @p = split(/\\/,$key->get_path());
+				if (scalar(@p) == 1) {
+					$path = "root";
+				}
+				else {
+					shift(@p);
+					$path = join('\\',@p);
+				}
+				
+				$vals{$path}{lastwrite} = $key->get_timestamp();
+				$vals{$path}{$val->get_name()}    = length($data);			
+			}
+  	}
+  }
+  
+	foreach my $subkey ($key->get_list_of_subkeys()) {
+		traverse($subkey);
+  }
+}
+
 1;

RecentActivity/release/rr-full/plugins/fw_config.pl

@@ -1,116 +1,118 @@
-#-----------------------------------------------------------
-# fw_config
-#
-# References
-#   http://technet2.microsoft.com/WindowsServer/en/library/47f25d7d-
-#          882b-4f87-b05f-31e5664fc15e1033.mspx?mfr=true
-#
-#
-# copyright 2008 H. Carvey, keydet89@yahoo.com
-#-----------------------------------------------------------
-package fw_config;
-use strict;
-
-my %config = (hive          => "System",
-              osmask        => 20,
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              version       => 20080328);
-
-sub getConfig{return %config}
-
-sub getShortDescr {
-	return "Gets the Windows Firewall config from the System hive";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $hive = shift;
-	::logMsg("Launching fw_config v.".$VERSION);
-	my $reg = Parse::Win32Registry->new($hive);
-	my $root_key = $reg->get_root_key;
-# Code for System file, getting CurrentControlSet
- 	my $current;
- 	my $ccs;
-	my $select_path = 'Select';
-	my $sel;
-	if ($sel = $root_key->get_subkey($select_path)) {
-		$current = $sel->get_value("Current")->get_data();
-		$ccs = "ControlSet00".$current;
-	}
-	else {
-		::rptMsg($select_path." could not be found.");
-		::logMsg($select_path." could not be found.");
-		return;
-	}
-
-	my @profiles = ("DomainProfile","StandardProfile");
-	foreach my $profile (@profiles) {
-		my $key_path = $ccs."\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\".$profile;
-		my $key;
-		if ($key = $root_key->get_subkey($key_path)) {
-			::rptMsg("Windows Firewall Configuration");
-			::rptMsg($key_path);
-			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		
-			my %vals = getKeyValues($key);
-			if (scalar(keys %vals) > 0) {
-				foreach my $v (keys %vals) {
-					::rptMsg("\t".$v." -> ".$vals{$v});
-				}
-			}
-			else {
-#				::rptMsg($key_path." has no values.");
-			}
-			
-			my @configs = ("RemoteAdminSettings", 
-			               "IcmpSettings",
-			               "GloballyOpenPorts\\List",
-			               "AuthorizedApplications\\List");
-		
-			foreach my $config (@configs) {
-				eval {
-					my %vals = getKeyValues($key->get_subkey($config));
-					if (scalar(keys %vals) > 0) {
-						::rptMsg("");
-						::rptMsg($key_path."\\".$config);
-						::rptMsg("LastWrite Time ".gmtime($key->get_subkey($config)->get_timestamp())." (UTC)");
-						foreach my $v (keys %vals) {
-							::rptMsg("\t".$v." -> ".$vals{$v});
-						}
-					}
-				};
-			}
-		}
-		else {
-			::rptMsg($key_path." not found.");
-			::logMsg($key_path." not found.");
-		}
-		::rptMsg("");
-	} # end foreach
-}
-
-sub getKeyValues {
-	my $key = shift;
-	my %vals;
-	
-	my @vk = $key->get_list_of_values();
-	if (scalar(@vk) > 0) {
-		foreach my $v (@vk) {
-			next if ($v->get_name() eq "" && $v->get_data() eq "");
-			$vals{$v->get_name()} = $v->get_data();
-		}
-	}
-	else {
-	
-	}
-	return %vals;
-}
+#-----------------------------------------------------------
+# fw_config
+#
+# References
+#   http://technet2.microsoft.com/WindowsServer/en/library/47f25d7d-
+#          882b-4f87-b05f-31e5664fc15e1033.mspx?mfr=true
+#
+#
+# copyright 2008 H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package fw_config;
+use strict;
+
+my %config = (hive          => "System",
+              osmask        => 20,
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              version       => 20080328);
+
+sub getConfig{return %config}
+
+sub getShortDescr {
+	return "Gets the Windows Firewall config from the System hive";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching fw_config v.".$VERSION);
+	::rptMsg("fw_config v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+# Code for System file, getting CurrentControlSet
+ 	my $current;
+ 	my $ccs;
+	my $select_path = 'Select';
+	my $sel;
+	if ($sel = $root_key->get_subkey($select_path)) {
+		$current = $sel->get_value("Current")->get_data();
+		$ccs = "ControlSet00".$current;
+	}
+	else {
+		::rptMsg($select_path." could not be found.");
+		::logMsg($select_path." could not be found.");
+		return;
+	}
+
+	my @profiles = ("DomainProfile","StandardProfile");
+	foreach my $profile (@profiles) {
+		my $key_path = $ccs."\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\".$profile;
+		my $key;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg("Windows Firewall Configuration");
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		
+			my %vals = getKeyValues($key);
+			if (scalar(keys %vals) > 0) {
+				foreach my $v (keys %vals) {
+					::rptMsg("\t".$v." -> ".$vals{$v});
+				}
+			}
+			else {
+#				::rptMsg($key_path." has no values.");
+			}
+			
+			my @configs = ("RemoteAdminSettings", 
+			               "IcmpSettings",
+			               "GloballyOpenPorts\\List",
+			               "AuthorizedApplications\\List");
+		
+			foreach my $config (@configs) {
+				eval {
+					my %vals = getKeyValues($key->get_subkey($config));
+					if (scalar(keys %vals) > 0) {
+						::rptMsg("");
+						::rptMsg($key_path."\\".$config);
+						::rptMsg("LastWrite Time ".gmtime($key->get_subkey($config)->get_timestamp())." (UTC)");
+						foreach my $v (keys %vals) {
+							::rptMsg("\t".$v." -> ".$vals{$v});
+						}
+					}
+				};
+			}
+		}
+		else {
+			::rptMsg($key_path." not found.");
+			::logMsg($key_path." not found.");
+		}
+		::rptMsg("");
+	} # end foreach
+}
+
+sub getKeyValues {
+	my $key = shift;
+	my %vals;
+	
+	my @vk = $key->get_list_of_values();
+	if (scalar(@vk) > 0) {
+		foreach my $v (@vk) {
+			next if ($v->get_name() eq "" && $v->get_data() eq "");
+			$vals{$v->get_name()} = $v->get_data();
+		}
+	}
+	else {
+	
+	}
+	return %vals;
+}
 1;

RecentActivity/release/rr-full/plugins/gauss.pl

@@ -0,0 +1,66 @@
+#-----------------------------------------------------------
+# gauss.pl
+# Checks Software hive for existance of TimeStampforUI value
+# beneath the Reliability key within the Software hive.  According
+# to the Kasperky write-up for the malware, the configuration file is
+# written to a binary value named "TimeStampforUI".
+#
+# copyright 2012 Quantum Analytics Research, LLC
+# Author H. Carvey, keydet89@yahoo.com
+#-----------------------------------------------------------
+package gauss;
+use strict;
+
+my %config = (hive          => "Software",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20120809);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Checks Reliability key for TimeStampforUI value";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $hive = shift;
+	::logMsg("Launching gauss v.".$VERSION);
+	::rptMsg("Launching gauss v.".$VERSION);
+	::rptMsg("(".$config{hive}.") ".getShortDescr()."\n"); # banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+
+	my @key_paths = ('Microsoft\\Windows\\CurrentVersion\\Reliability',
+	                 'Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Reliability');
+	::rptMsg("gauss v\.".$VERSION);
+	foreach my $key_path (@key_paths) {
+		my $key;
+		my $notfound = 1;
+		if ($key = $root_key->get_subkey($key_path)) {
+			::rptMsg($key_path);
+			::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+			my @vals = $key->get_list_of_values();
+			foreach my $v (@vals) {
+				my $name = $v->get_name();
+				if ($name eq "TimeStampforUI") {
+					::rptMsg("TimeStampforUI value found.");
+					$notfound = 0;
+				}
+			}
+			::rptMsg("TimeStampforUI value not found.") if ($notfound);
+		}
+		else {
+			::rptMsg($key_path." not found.");
+		}
+		::rptMsg("");
+	}
+}
+1;

RecentActivity/release/rr-full/plugins/gthist.pl

@@ -1,71 +1,72 @@
-#-----------------------------------------------------------
-# gthist.pl
-# Google Toolbar Search History plugin
-# 
-#
-# Change history
-#   20100218 - created
-#
-# References
-#
-# 
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package gthist;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20100218);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets Google Toolbar Search History";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	my %hist;
-	::logMsg("Launching gthist v.".$VERSION);
-	
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Software\\Google\\NavClient\\1.1\\History';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		my @vals = $key->get_list_of_values();
-		if (scalar @vals > 0) {
-			::rptMsg("");
-			foreach my $v (@vals) {
-				my $tv = unpack("V",$v->get_data());
-				$hist{$tv} = $v->get_name();
-			}
-			
-			foreach my $t (reverse sort {$a <=> $b} keys %hist) {
-				my $str = gmtime($t)."  ".$hist{$t};
-				::rptMsg($str);
-			}
-		}
-		else {
-			::rptMsg($key_path." has no values.");
-		}
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# gthist.pl
+# Google Toolbar Search History plugin
+# 
+#
+# Change history
+#   20100218 - created
+#
+# References
+#
+# 
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package gthist;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20100218);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets Google Toolbar Search History";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	my %hist;
+	::logMsg("Launching gthist v.".$VERSION);
+	::rptMsg("gthist v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Google\\NavClient\\1.1\\History';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		my @vals = $key->get_list_of_values();
+		if (scalar @vals > 0) {
+			::rptMsg("");
+			foreach my $v (@vals) {
+				my $tv = unpack("V",$v->get_data());
+				$hist{$tv} = $v->get_name();
+			}
+			
+			foreach my $t (reverse sort {$a <=> $b} keys %hist) {
+				my $str = gmtime($t)."  ".$hist{$t};
+				::rptMsg($str);
+			}
+		}
+		else {
+			::rptMsg($key_path." has no values.");
+		}
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/gtwhitelist.pl

@@ -1,74 +1,75 @@
-#-----------------------------------------------------------
-# gtwhitelist.pl
-# Google Toolbar Search History plugin
-# 
-#
-# Change history
-#   20100218 - created
-#
-# References
-#
-# 
-#
-# copyright 2010 Quantum Analytics Research, LLC
-#-----------------------------------------------------------
-package gtwhitelist;
-use strict;
-
-my %config = (hive          => "NTUSER\.DAT",
-              hasShortDescr => 1,
-              hasDescr      => 0,
-              hasRefs       => 0,
-              osmask        => 22,
-              version       => 20100218);
-
-sub getConfig{return %config}
-sub getShortDescr {
-	return "Gets Google Toolbar whitelist values";	
-}
-sub getDescr{}
-sub getRefs {}
-sub getHive {return $config{hive};}
-sub getVersion {return $config{version};}
-
-my $VERSION = getVersion();
-
-sub pluginmain {
-	my $class = shift;
-	my $ntuser = shift;
-	my %hist;
-	::logMsg("Launching gtwhitelist v.".$VERSION);
-	
-	my $reg = Parse::Win32Registry->new($ntuser);
-	my $root_key = $reg->get_root_key;
-
-	my $key_path = 'Software\\Google\\Google Toolbar\\4.0\\whitelist';
-	my $key;
-	if ($key = $root_key->get_subkey($key_path)) {
-		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
-		my $allow2;
-		eval {
-			$allow2 = $key->get_value("allow2")->get_data();
-			my @vals = split(/\|/,$allow2);
-			::rptMsg("");
-			::rptMsg("whitelist");
-			foreach my $v (@vals) {
-				next if ($v eq "");
-				::rptMsg("  ".$v);
-			}
-			::rptMsg("");
-		};
-		
-		my $lastmod;
-		eval {
-			$lastmod = $key->get_value("lastmod")->get_data();
-			::rptMsg("lastmod ".gmtime($lastmod)." (UTC)");
-		};
-		
-	}
-	else {
-		::rptMsg($key_path." not found.");
-	}
-}
-
+#-----------------------------------------------------------
+# gtwhitelist.pl
+# Google Toolbar Search History plugin
+# 
+#
+# Change history
+#   20100218 - created
+#
+# References
+#
+# 
+#
+# copyright 2010 Quantum Analytics Research, LLC
+#-----------------------------------------------------------
+package gtwhitelist;
+use strict;
+
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 0,
+              osmask        => 22,
+              version       => 20100218);
+
+sub getConfig{return %config}
+sub getShortDescr {
+	return "Gets Google Toolbar whitelist values";	
+}
+sub getDescr{}
+sub getRefs {}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+
+my $VERSION = getVersion();
+
+sub pluginmain {
+	my $class = shift;
+	my $ntuser = shift;
+	my %hist;
+	::logMsg("Launching gtwhitelist v.".$VERSION);
+	::rptMsg("gtwhitelist v.".$VERSION); # banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # banner
+	my $reg = Parse::Win32Registry->new($ntuser);
+	my $root_key = $reg->get_root_key;
+
+	my $key_path = 'Software\\Google\\Google Toolbar\\4.0\\whitelist';
+	my $key;
+	if ($key = $root_key->get_subkey($key_path)) {
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		my $allow2;
+		eval {
+			$allow2 = $key->get_value("allow2")->get_data();
+			my @vals = split(/\|/,$allow2);
+			::rptMsg("");
+			::rptMsg("whitelist");
+			foreach my $v (@vals) {
+				next if ($v eq "");
+				::rptMsg("  ".$v);
+			}
+			::rptMsg("");
+		};
+		
+		my $lastmod;
+		eval {
+			$lastmod = $key->get_value("lastmod")->get_data();
+			::rptMsg("lastmod ".gmtime($lastmod)." (UTC)");
+		};
+		
+	}
+	else {
+		::rptMsg($key_path." not found.");
+	}
+}
+
 1;

RecentActivity/release/rr-full/plugins/haven_and_hearth.pl

@@ -0,0 +1,108 @@
+#-----------------------------------------------------------
+# haven_and_hearth.pl
+#   Extracts the username and savedtoken for Haven & Hearth
+#
+# Change history
+#   20110830 [fpi] + banner, no change to the version number
+#
+# References
+#  Haven & Hearth Homepage
+#       http://www.havenandhearth.com/
+#
+# Copyright (c) 2011-02-04 Brendan Coles <bcoles@gmail.com>
+#-----------------------------------------------------------
+# Require #
+package haven_and_hearth;
+use strict;
+
+# Declarations #
+my %config = (hive          => "NTUSER\.DAT",
+              hasShortDescr => 1,
+              hasDescr      => 0,
+              hasRefs       => 1,
+              osmask        => 22,
+              version       => 20110204);
+my $VERSION = getVersion();
+
+# Functions #
+sub getDescr {}
+sub getConfig {return %config}
+sub getHive {return $config{hive};}
+sub getVersion {return $config{version};}
+sub getShortDescr {
+	return "Extracts the username and savedtoken for Haven & Hearth.";
+}
+sub getRefs {
+	my %refs = ("Haven & Hearth Homepage:" =>
+	            "http://www.havenandhearth.com/");
+	return %refs;	
+}
+
+############################################################
+# pluginmain #
+############################################################
+sub pluginmain {
+
+	# Declarations #
+	my $class = shift;
+	my $hive = shift;
+	my @interesting_keys = (
+		"username",
+		"password",
+		"savedtoken"
+	);
+
+	# Initialize #
+	::logMsg("Launching haven_and_hearth v.".$VERSION);
+    ::rptMsg("haven_and_hearth v.".$VERSION); # 20110830 [fpi] + banner
+    ::rptMsg("(".getHive().") ".getShortDescr()."\n"); # 20110830 [fpi] + banner 
+	my $reg = Parse::Win32Registry->new($hive);
+	my $root_key = $reg->get_root_key;
+	my $key;
+	my $key_path = "Software\\JavaSoft\\Prefs\\haven";
+
+	# If # Haven & Hearth path exists #
+	if ($key = $root_key->get_subkey($key_path)) {
+
+		# Return # plugin name, registry key and last modified date #
+		::rptMsg("Haven & Hearth");
+		::rptMsg($key_path);
+		::rptMsg("LastWrite Time ".gmtime($key->get_timestamp())." (UTC)");
+		::rptMsg("");
+
+		# Extract # all keys from Haven & Hearth registry path #
+		my %keys;
+		my @vals = $key->get_list_of_values();
+
+		# If # registry keys exist in path #
+		if (scalar(@vals) > 0) {
+
+			# Extract # all key names+values for Haven & Hearth registry path #
+			foreach my $v (@vals) {
+				$keys{$v->get_name()} = $v->get_data();
+			}
+
+			# Return # all key names+values for interesting keys #
+			foreach my $var (@interesting_keys) {
+				if (exists $keys{$var}) {
+					::rptMsg($var." -> ".$keys{$var});
+				}
+			}
+
+		# Error # key value is null #
+		} else {
+			::rptMsg($key_path." has no values.");
+		}
+
+	# Error # Haven & Hearth isn't here, try another castle #
+	} else {
+		::rptMsg($key_path." not found.");
+		::logMsg($key_path." not found.");
+	}
+
+	# Return # obligatory new-line #
+	::rptMsg("");
+}
+
+# Error # oh snap! #
+1;