DFIRHub

RemSupp

RemSupp artifacts

  • Apps
  • 4 paths
  • regex:(Local State|Preferences|chromium\.log|quitAndInstall\.json)
  • Per-user data
  • Version 1
  • Paul Cabon CERT Almond

Paths on disk

4 paths

Paths use Windows environment variable syntax

References

1 link