Skip to content

Commit e0deb02

Browse files
loxy0devlploxy0devlp
committed
v1.0
1 parent 948a2ee commit e0deb02

10 files changed

Lines changed: 658 additions & 0 deletions

‎Image/Interface.png‎

80.6 KB
Loading

‎PathTor.txt‎

Whitespace-only changes.

‎Paths/LinuxFilePaths.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"Linux System": [
3+
["%PATH_USER%", ".vminfo"],
4+
["%PATH_USER%", ".xsession-errors"],
5+
["%PATH_USER%", ".zsh_history"],
6+
["%PATH_USER%", ".local", "share", "recently-used.xbel"],
7+
["%PATH_USER%", ".local", "share", "applications", "mimeinfo.cache"]
8+
],
9+
"Session": [
10+
["%PATH_USER%", ".config", "Session", "crash-log.txt"]
11+
],
12+
"Telegram": [
13+
["%PATH_USER%", ".local", "share", "TelegramDesktop", "log.txt"],
14+
["%PATH_USER%", ".local", "share", "TelegramDesktop", "log_start0.txt"],
15+
["%PATH_USER%", ".local", "share", "TelegramDesktop", "log_start1.txt"],
16+
["%PATH_USER%", ".local", "share", "TelegramDesktop", "log_start2.txt"],
17+
["%PATH_USER%", ".local", "share", "TelegramDesktop", "log_start3.txt"]
18+
],
19+
"Tor": [
20+
["%PATH_USER%", ".tor", "cached-certs"],
21+
["%PATH_USER%", ".tor", "cached-microdesc-consensus"],
22+
["%PATH_USER%", ".tor", "cached-microdescs.new"],
23+
["%PATH_USER%", ".tor", "lock"],
24+
["%PATH_USER%", ".tor", "state"],
25+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "TorBrowser", "Data", "Tor", "cached-certs"],
26+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "TorBrowser", "Data", "Tor", "cached-microdesc-consensus"],
27+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "TorBrowser", "Data", "Tor", "cached-microdescs"],
28+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "TorBrowser", "Data", "Tor", "cached-microdescs.new"],
29+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "TorBrowser", "Data", "Tor", "state"]
30+
],
31+
"Mullvad VPN": [
32+
["/etc", "mullvad-vpn", "account-history.json"]
33+
]
34+
}

‎Paths/LinuxFolderPaths.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"Linux System": [
3+
["%PATH_TMP_1%"],
4+
["%PATH_TMP_2%"],
5+
["%PATH_USER%", ".cache"],
6+
["%PATH_VAR%", "log"],
7+
["%PATH_VAR%", "cache"],
8+
["%PATH_VAR%", "backups"],
9+
["%PATH_VAR%", "tmp"],
10+
["%PATH_VAR%", "run", "log"],
11+
["%PATH_USER%", ".local", "share", "gnome"]
12+
],
13+
"Visual Studio Code": [
14+
["%PATH_USER%", ".config", "Code", "Backups"],
15+
["%PATH_USER%", ".config", "Code", "blob_storage"],
16+
["%PATH_USER%", ".config", "Code", "Cache"],
17+
["%PATH_USER%", ".config", "Code", "CachedData"],
18+
["%PATH_USER%", ".config", "Code", "CachedProfilesData"],
19+
["%PATH_USER%", ".config", "Code", "Code Cache"],
20+
["%PATH_USER%", ".config", "Code", "Crashpad"],
21+
["%PATH_USER%", ".config", "Code", "DawnGraphiteCache"],
22+
["%PATH_USER%", ".config", "Code", "DawnWebGPUCache"],
23+
["%PATH_USER%", ".config", "Code", "GPUCache"],
24+
["%PATH_USER%", ".config", "Code", "logs"],
25+
["%PATH_USER%", ".config", "Code", "Service Worker"],
26+
["%PATH_USER%", ".config", "Code", "Session Storage"],
27+
["%PATH_USER%", ".config", "Code", "Shared Dictionary"],
28+
["%PATH_USER%", ".config", "Code", "User", "History"],
29+
["%PATH_USER%", ".config", "Code", "User", "workspaceStorage"],
30+
["%PATH_USER%", ".config", "Code", "WebStorage"],
31+
["%PATH_USER%", "Downloads"]
32+
],
33+
"Libre Office": [
34+
["%PATH_USER%", ".config", "libreoffice"]
35+
],
36+
"Session": [
37+
["%PATH_USER%", ".config", "Session", "Cache"],
38+
["%PATH_USER%", ".config", "Session", "logs"],
39+
["%PATH_USER%", ".config", "Session", "Shared Dictionary"]
40+
],
41+
"Mullvad VPN": [
42+
["%PATH_USER%", ".config", "Mullvad VPN", "Cache"],
43+
["%PATH_USER%", ".config", "Mullvad VPN", "Code Cache"],
44+
["%PATH_USER%", ".config", "Mullvad VPN", "blob_storage"],
45+
["%PATH_USER%", ".config", "Mullvad VPN", "GPUCache"],
46+
["%PATH_USER%", ".config", "Mullvad VPN", "logs"],
47+
["%PATH_USER%", ".config", "Mullvad VPN", "Shared Dictionary"],
48+
["%PATH_USER%", ".config", "Mullvad VPN", "Service Worker"],
49+
["%PATH_USER%", ".config", "Mullvad VPN", "Session Storage"]
50+
],
51+
"Sqlmap": [
52+
["%PATH_USER%", ".local", "share", "sqlmap", "output"],
53+
["%PATH_USER%", ".local", "share", "sqlmap", "history"]
54+
],
55+
"John": [
56+
["%PATH_USER%", ".john"]
57+
],
58+
"Tor": [
59+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "Desktop"],
60+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "Downloads"],
61+
["%PATH_USER%", ".local", "share", "torbrowser", "tbb", "x86_64", "tor-browser", "Browser", "TorBrowser", "Data", "Browser", "Caches"]
62+
],
63+
"Trash": [
64+
["%PATH_USER%", ".local", "share", "Trash"]
65+
]
66+
}

‎Paths/WindowsFilePaths.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"Windows System": [
3+
["%PATH_APPDATA_LOCAL%", "IconCache.db"],
4+
["%PATH_APPDATA_LOCAL%", "UsrClass.dat*"],
5+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "IconCache.db"],
6+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "UsrClass.dat*"]
7+
],
8+
"Visual Studio Code": [
9+
["%PATH_APPDATA_ROAMING%", "Code", "User", "storage.json"]
10+
],
11+
"Session": [
12+
["%PATH_APPDATA_ROAMING%", "Session", "crash-log.txt"]
13+
],
14+
"Modern CSV": [
15+
["%PATH_APPDATA_ROAMING%", "Modern CSV", "Modern CSV.ini"]
16+
],
17+
"Tor": [
18+
["%PATH_TOR%", "TorBrowser", "Data", "Torcached-certs"],
19+
["%PATH_TOR%", "TorBrowser", "Data", "Torcached-microdesc-consensus"],
20+
["%PATH_TOR%", "TorBrowser", "Data", "Torcached-microdescs.new"],
21+
["%PATH_TOR%", "TorBrowser", "Data", "Torlock"],
22+
["%PATH_TOR%", "TorBrowser", "Data", "Torstate"]
23+
]
24+
}

‎Paths/WindowsFolderPaths.json‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{
2+
"Windows System": [
3+
["%PATH_APPDATA_LOCAL%", "Temp"],
4+
["%PATH_APPDATA_LOCAL%", "cache"],
5+
["%PATH_APPDATA_LOCAL%", "CrashDumps"],
6+
["%PATH_APPDATA_LOCAL%", "D3DSCache"],
7+
["%PATH_APPDATA_LOCAL%", "ConnectedDevicesPlatform"],
8+
["%PATH_APPDATA_LOCAL%", "Packages", "Microsoft.WindowsTerminal_*/LocalState"],
9+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Caches"],
10+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Burn"],
11+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "WebCache"],
12+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Application Shortcuts"],
13+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Temporary Internet Files"],
14+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "History"],
15+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Explorer"],
16+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "INetCache"],
17+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "INetCookies"],
18+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "WER"],
19+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Notifications"],
20+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Clipboard"],
21+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "PowerShell"],
22+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "PRICache"],
23+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "PPBCompatUaCache"],
24+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "PPBCompatCache"],
25+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Shell"],
26+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "TaskManager"],
27+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "ActionCenterCache"],
28+
["%PATH_APPDATA_LOCAL%", "Microsoft", "Windows", "Recent"],
29+
["%PATH_APPDATA_ROAMING%", "Microsoft", "Windows", "Recent"],
30+
["%PATH_APPDATA_ROAMING%", "Microsoft", "Windows", "Cookies"],
31+
["%PATH_APPDATA_ROAMING%", "Microsoft", "Windows", "PowerShell", "PSReadLine"],
32+
["%PATH_PROGRAM_DATA%", "Microsoft", "Windows", "WER"],
33+
["%PATH_PROGRAM_DATA%", "Microsoft", "Windows", "EventLogs"],
34+
["%PATH_PROGRAM_DATA%", "Microsoft", "Windows", "Diagnosis"],
35+
["%PATH_PROGRAM_DATA%", "Microsoft", "Diagnosis"],
36+
["%PATH_PROGRAM_DATA%", "Microsoft", "Search", "Data"],
37+
["%PATH_PROGRAM_DATA%", "Package Cache"],
38+
["%PATH_USER%", "Documents", "PowerShell", "Transcripts"],
39+
["%PATH_USER%", "Documents", "temp"],
40+
["%PATH_USER%", "Downloads"],
41+
["%PATH_USER%", "Pictures", "Screenshots"],
42+
["%PATH_SYSTEM_ROOT%", "Temp"],
43+
["%PATH_SYSTEM_ROOT%", "Prefetch"],
44+
["%PATH_SYSTEM_ROOT%", "Logs"],
45+
["%PATH_SYSTEM_ROOT%", "Panther"],
46+
["%PATH_SYSTEM_ROOT%", "Debug"],
47+
["%PATH_SYSTEM_ROOT%", "Minidump"],
48+
["%PATH_SYSTEM_ROOT%", "System32", "LogFiles"],
49+
["%PATH_SYSTEM_ROOT%", "System32", "winevt", "Logs"],
50+
["%PATH_SYSTEM_ROOT%", "System32", "sru"],
51+
["%PATH_SYSTEM_ROOT%", "System32", "Tasks"],
52+
["%PATH_SYSTEM_ROOT%", "System32", "spool", "PRINTERS"],
53+
["%PATH_SYSTEM_ROOT%", "System32", "config", "systemprofile", "AppData", "Local", "Microsoft", "Windows", "Notifications"],
54+
["%PATH_SYSTEM_ROOT%", "System32", "config", "systemprofile", "AppData", "Local", "Microsoft", "Windows", "Caches"],
55+
["%PATH_SYSTEM_ROOT%", "System32", "config", "systemprofile", "AppData", "Local", "Microsoft", "Windows", "Explorer"],
56+
["%PATH_SYSTEM_ROOT%", "SoftwareDistribution", "Download"],
57+
["%PATH_SYSTEM_ROOT%", "SoftwareDistribution", "DataStore"]
58+
],
59+
"Visual Studio Code": [
60+
["%PATH_APPDATA_ROAMING%", "Code", "Backups"],
61+
["%PATH_APPDATA_ROAMING%", "Code", "blob_storage"],
62+
["%PATH_APPDATA_ROAMING%", "Code", "Cache"],
63+
["%PATH_APPDATA_ROAMING%", "Code", "CachedData"],
64+
["%PATH_APPDATA_ROAMING%", "Code", "CachedProfilesData"],
65+
["%PATH_APPDATA_ROAMING%", "Code", "Code Cache"],
66+
["%PATH_APPDATA_ROAMING%", "Code", "Crashpad"],
67+
["%PATH_APPDATA_ROAMING%", "Code", "DawnGraphiteCache"],
68+
["%PATH_APPDATA_ROAMING%", "Code", "DawnWebGPUCache"],
69+
["%PATH_APPDATA_ROAMING%", "Code", "GPUCache"],
70+
["%PATH_APPDATA_ROAMING%", "Code", "logs"],
71+
["%PATH_APPDATA_ROAMING%", "Code", "Network"],
72+
["%PATH_APPDATA_ROAMING%", "Code", "Service Worker"],
73+
["%PATH_APPDATA_ROAMING%", "Code", "Session Storage"],
74+
["%PATH_APPDATA_ROAMING%", "Code", "Shared Dictionary"],
75+
["%PATH_APPDATA_ROAMING%", "Code", "User", "History"],
76+
["%PATH_APPDATA_ROAMING%", "Code", "User", "workspaceStorage"],
77+
["%PATH_APPDATA_ROAMING%", "Code", "WebStorage"]
78+
],
79+
"Libre Office": [
80+
["%PATH_APPDATA_ROAMING%", "LibreOffice"]
81+
],
82+
"CCleaner": [
83+
["%PATH_APPDATA_ROAMING%", "CCleaner", "dumps"],
84+
["%PATH_APPDATA_ROAMING%", "CCleaner", "Log"]
85+
],
86+
"MySQL": [
87+
["%PATH_APPDATA_ROAMING%", "MySQL", "mysqlsh"],
88+
["%PATH_APPDATA_ROAMING%", "MySQL", "Workbench", "cache"],
89+
["%PATH_APPDATA_ROAMING%", "MySQL", "Workbench", "log"],
90+
["%PATH_APPDATA_ROAMING%", "MySQL", "Workbench", "sql_history"],
91+
["%PATH_PROGRAM_DATA%", "MySQL", "MySQL Installer for Windows", "Logs"],
92+
["%PATH_PROGRAM_DATA%", "MySQL", "MySQL Installer for Windows", "Product Cache"]
93+
],
94+
"Session": [
95+
["%PATH_APPDATA_ROAMING%", "Session", "Cache"],
96+
["%PATH_APPDATA_ROAMING%", "Session", "logs"],
97+
["%PATH_APPDATA_ROAMING%", "Session", "Shared Dictionary"]
98+
],
99+
"Telegram": [
100+
["%PATH_APPDATA_ROAMING%", "Telegram Desktop", "tdata", "user_data", "cache"],
101+
["%PATH_APPDATA_ROAMING%", "Telegram Desktop", "tdata", "user_data", "media_cache"],
102+
["%PATH_APPDATA_ROAMING%", "Telegram Desktop", "tdata", "temp"]
103+
],
104+
"Mullvad VPN": [
105+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "Cache"],
106+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "Code Cache"],
107+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "blob_storage"],
108+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "GPUCache"],
109+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "logs"],
110+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "Shared Dictionary"],
111+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "Service Worker"],
112+
["%PATH_APPDATA_LOCAL%", "Mullvad VPN", "Session Storage"],
113+
["%PATH_PROGRAM_DATA%", "Mullvad VPN"]
114+
],
115+
"Tor": [
116+
["%PATH_TOR%", "TorBrowser", "Data", "Browser", "Caches"]
117+
],
118+
"EmEditor": [
119+
["%PATH_APPDATA_ROAMING%", "Emurasoft", "EmEditor", "Common"]
120+
]
121+
}

‎Paths/WindowsRegistryKeys.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"Windows System": [
3+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs",
4+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU",
5+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths",
6+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU",
7+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRU",
8+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU",
9+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags",
10+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU",
11+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags",
12+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedMRU",
13+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\CIDSizeMRU",
14+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutomaticDestinations",
15+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CustomDestinations",
16+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Map Network Drive MRU",
17+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2",
18+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist",
19+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search",
20+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\RecentApps",
21+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
22+
"HKEY_CURRENT_USER\\Software\\Microsoft\\PowerShell",
23+
"HKEY_CURRENT_USER\\Software\\Microsoft\\PowerShell\\1\\ShellIds",
24+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunHistory",
25+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage",
26+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery",
27+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default",
28+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers",
29+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Persisted",
30+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentApps",
31+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts",
32+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\MRUList",
33+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchHistory",
34+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Explorer\\RunMRU",
35+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Taskband",
36+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2",
37+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\PowerShell\\PSReadLine",
38+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\Autorun",
39+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
40+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
41+
"HKEY_CURRENT_USER\\Network",
42+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
43+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
44+
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\CloudStore\\Store\\Cache\\DefaultAccount\\$$windows.data.taskflow.shellactivities\\Current",
45+
"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\MuiCache",
46+
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BAM\\State\\UserSettings",
47+
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Dam\\UserSettings",
48+
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache\\AppCompatCache",
49+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",
50+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
51+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Persisted",
52+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
53+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
54+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks",
55+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree",
56+
"HKEY_LOCAL_MACHINE\\SYSTEM\\MountedDevices",
57+
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Portable Devices",
58+
"HKEY_USERS\\<SID>\\Software\\Microsoft\\Internet Explorer\\TypedURLs",
59+
"HKEY_USERS\\<SID>\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags",
60+
"HKEY_USERS\\<SID>\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU",
61+
"HKEY_CLASSES_ROOT\\http\\shell\\open\\command",
62+
"HKEY_CLASSES_ROOT\\https\\shell\\open\\command"
63+
],
64+
"WinRAR": [
65+
"HKEY_CURRENT_USER\\Software\\WinRAR\\ArcHistory",
66+
"HKEY_CURRENT_USER\\Software\\WinRAR\\DialogEditHistory\\ArcName",
67+
"HKEY_CURRENT_USER\\Software\\WinRAR\\DialogEditHistory\\DictSize",
68+
"HKEY_CURRENT_USER\\Software\\WinRAR\\DialogEditHistory\\ExtrPath"
69+
]
70+
}

0 commit comments

Comments
 (0)