Scribd
Upload
13 views

Screenshare

Uploaded by

geertgreveling123
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
13 views

Screenshare

Uploaded by

geertgreveling123
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Recent

C:\Users\%username%\AppData\Local\CrashDumps

Powershell ISE - (Get-PSReadlineOption).HistorySavePath - Open text file

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
AppCompatFlags\Compatibility Assistant\Store

Save to txt - HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\


FileExts - Search process hacker (for dlls injected)

C:\$Recycle.Bin

Look in latest.log for chat logs

Check launcher_accounts.json in .minecraft for alts

Process Hacker

explorer.exe - pcaclient

explorer.exe - file:/// * {"displayText"

explorer.exe - \users\ - .exe / .jar

SearchIndexer - file:c / .exe

Check browser - download

Check last activity viewer

echo.ac/sgrm and follow instructions there

csrss - :\

Cdpu - ,"platform":"x_exe_path"},

Pcasvc - .exe or e,0a000000,Reason,00002100

DPS - !! - .exe / downloads

CMD (run as admin)

fsutil usn readjournal c: csv > AllTheJournal.txt

fsutil usn readjournal c: csv | findstr /i /C:.exe >> client.txt

fsutil usn readjournal c: csv | findstr /i /C:".pf" | findstr /i /C:"0x80000200" >


%userprofile%\Desktop\Deleted-PF.txt

fsutil usn readjournal c: csv | findstr /i /c:.exe | findstr /i /c:0x80000200 >>


DeletedExes.txt

fsutil usn deleteJournal /D C:


fsutil usn queryJournal c:

fsutil usn createJournal m=2147483648 a=1 C:

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy