diff --git a/ShimCacheParser.py b/ShimCacheParser.py index 64762bb..4c181d7 100755 --- a/ShimCacheParser.py +++ b/ShimCacheParser.py @@ -811,7 +811,7 @@ def read_zip(zip_name): tmp_list = [] final_list = [] out_list = [] - hostname = "" + hostname = "N/A" try: # Open the zip archive. @@ -822,7 +822,7 @@ def read_zip(zip_name): print "[+] Processing %d registry acquisitions..." % len(zip_contents) for item in zip_contents: try: - if '_w32registry.xml' not in item: + if 'w32registry' not in item: continue filename = item.split('/') if len(filename) > 0: @@ -853,8 +853,7 @@ def read_zip(zip_name): print "[-] Error opening file: %s in MIR archive: %s" % (item, err) continue # Add the final header. - final_list.insert(0, ("Hostname", "Last Modified", "Last Update", - "Path", "File Size", "File Executed", "Key Path")) + final_list.insert(0, ("Hostname", "Last Modified", "Last Update", "Path", "File Size", "Exec Flag")) return final_list except (IOError, zipfile.BadZipfile, struct.error), err: @@ -969,4 +968,3 @@ def main(argv=[]): if __name__ == '__main__': main(sys.argv) -