warning: todo
- check PE signatures
- check by file hash
- https://virustotal.com
- entropy analysis
- pssuspend.bat, procdump.bat
- http://www.procdot.com/
- registry hives
- (HKLM|HKCU)\Software\Microsoft\Windows\CurrentVersion(Run|RunOnce|RunOnceServices?|RunServices?|RunServicesOnce?)
- HKLM\System\CurrentControlSet\Services\
- user profile startup folder (%USERPROFILE%\Start Menu\Programs\Startup; shell:startup)
- Windows Event Log (%windir%\System32\winevt, https://github.com/williballenthin/python-evtx)
- scheduler (%windir%\tasks)
- c:\windows\temp
- profile paths for users and services
- %windir%\System32\config\systemprofile
- %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV
- %USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files\
- %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE<subdir>
- %USERPROFILE%\AppData\Local\Temp (generaly all temp localtions)
get-childitem | convertto-csv | convertfrom-csv | format-table -auto