[18901] 2020-08-20_应急响应手册-程序执行痕迹

文档创建者:s7ckTeam
浏览次数:3
最后更新:2025-01-18
2020-08-20_应急响应手册-程序执行痕迹 -     h u a s e c   2 0 2 0 - 0 8 - 2 0   #   , 2 6 - W i n d o w s 0 1 ( 1 )   S h i m C a c h e 使 S h i m C a c h e A p p C o m p a t C a c h e W i n d o w s S h i m C a c h e S h i m C a c h e 1 0 0 % W i n d o w s W i n d o w s 7 / 8 / 1 0 1 0 2 4 W i n d o w s 7 / 8 / 1 0 H K L M S Y S T E M C u r r e n t C o n t r o l S e t C o n t r o l S e s s i o n M a n a g e r A p p C o m p a t C a c h e h t t p s : / / e r i c z i m m e r m a n . g i t h u b . i o / # ! i n d e x . m d A p p C o m p a t C a c h e P a r s e r 使 A p p C o m p a t C a c h e P a r s e r . e x e   - - c s v   c : t e m p     - t
S h i m C a c h e P a r s e r 使 r e g   e x p o r t   " H K L M S Y S T E M C u r r e n t C o n t r o l S e t C o n t r o l S e s s i o n M a n a g e r A p p C o m p a t C a c h e "   s h i m c a c h e . r e g S h i m C a c h e P a r s e r . p y   - o   o u t . c s v   - r s h i m c a c h e . r e g   - t
( 2 ) U s e r a s s i s t u s e r a s s i s t G U I H K C U S o f t w a r e M i c r o s o f t W i n d o w s C u r r e n t V e r s i o n E x p l o r e r U s e r A s s i s t { G U I D } C o u n t   ( 3 ) M u i C a c h e M U I C a c h e H K C U / S o f t w a r e / M i c r o s o f t / W i n d o w s / S h e l l N o R o a m / M U I C a c h e ( X P ,   2 0 0 0 ,   2 0 0 3 ) H K C U / S o f t w a r e / C l a s s e s / L o c a l   S e t t i n g s / S o f t w a r e / M i c r o s o f t / W i n d o w s / S h e l l / M u i C a c h e   ( V i s t a ,   7 ,   2 0 0 8 ) h t t p : / / w w w . n i r s o f t . n e t / u t i l s / m u i c a c h e _ v i e w . h t m l 0 2
( 1 ) P r e f e t c h P r e f e t c h W i n d o w s   X P P r e f e t c h H a s h   W i n 7 1 2 8 W i n 8 - 1 0 1 0 2 4 : C : W i n d o w s P r e f e t c h H K L M S Y S T E M C u r r e n t C o n t r o l S e t C o n t r o l S e s s i o n M a n a g e r M e m o r y   M a n a g e m e n t P r e f e t c h P a r a m e t e r s E n a b l e P r e f e t c h e r P r e f e t c h   E n a b l e P r e f e t c h e r   0   =   1   =   2   =   3   =   W i n d o w s   2 0 0 3 P r e f e t c h 2 , P E C m d h t t p s : / / e r i c z i m m e r m a n . g i t h u b . i o / # ! i n d e x . m d P E C m d . e x e   - d   " C : W i n d o w s P r e f e t c h "   - - c s v   " E : " ( 2 ) A m c a c h e A m c a c h e . h v e S H A 1   : C : W i n d o w s A p p C o m p a t P r o g r a m s A m c a c h e . h v e
A m c a c h e P a r s e h t t p s : / / g i t h u b . c o m / E r i c Z i m m e r m a n / A m c a c h e P a r s e r A m c a c h e P a r s e r . e x e   - f C : W i n d o w s A p p C o m p a t P r o g r a m s A m c a c h e . h v e   - - c s v   d : t e m p ( 3 ) J u m p   L i s t W i n d o w s   7 - 1 0 使 使 C : U s e r s < u s e r n a m e > A p p D a t a R o a m i n g M i c r o s o f t W i n d o w s R e c e n t A u t o m a t i c D e s t i n a t i o n J u m p L i s t E x p l o r e r h t t p s : / / e r i c z i m m e r m a n . g i t h u b . i o / S o f t w a r e / J u m p L i s t E x p l o r e r . z i p 0 3
( 1 )   S e c u r i t y   L o g   ( 5 9 2 / 4 6 8 8 ) W i n d o w s   7 W i n d o w s   S e r v e r   2 0 0 8   R 2   / 2 0 1 2     I D   4 6 8 8     W i n d o w s   4 6 8 8 ( 2 )   S y s t e m   L o g   ( 7 0 3 5 / 7 0 3 6 ) W i n d o w s   X P / 7 /   W i n d o w s   S e r v e r   2 0 0 3 , I D   7 0 3 5 7 0 3 5     S e r v i c e   C o n t r o l   M a n a g e r         x x x 7 0 3 6     S e r v i c e   C o n t r o l   M a n a g e r         x x x   /   ( 3 )   T a s k S c h e d u l e r H K E Y _ L O C A L _ M A C H I N E S O F T W A R E M i c r o s o f t S c h e d u l i n g A g e n t l o g p a t h

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则