chore: remove Khalsa bot-session scratch + gitignore root scratch classes
Winter's auto-sync swept ~2.4MB of Khalsa troubleshooting scratch (SC session dumps, diag .ps1/.b64, ticket JSON) into repo root via git add -A. Removed those and added gitignore rules for root dot-.ps1/.b64/.err/.vbs/.tmp + the leaked .json families (prefix-listed to keep .hosts.json/.devs.json/.mcp.json.example protected).
This commit is contained in:
30
.gitignore
vendored
30
.gitignore
vendored
@@ -155,3 +155,33 @@ temp/
|
||||
|
||||
# EDR isolation watcher local state (no secrets, per-host)
|
||||
.claude/scripts/.edr-watch-state.json
|
||||
|
||||
# --- Bot/session scratch that leaks to repo root via `git add -A` (added 2026-07-17) ---
|
||||
# Root dot-prefixed .ps1/.b64/.err/.vbs are ALWAYS scratch here (real scripts live in
|
||||
# .claude/scripts/), so blanket them like the existing .*.txt/.*.sh rules.
|
||||
.*.ps1
|
||||
.*.b64
|
||||
.*.err
|
||||
.*.vbs
|
||||
.*.tmp
|
||||
# Scratch .json families — a blanket .*.json is UNSAFE (.hosts.json/.devs.json/.mcp.json.example
|
||||
# are legit tracked files), so list transient per-session families by prefix/name instead:
|
||||
.khalsa-*
|
||||
.glaztech-*
|
||||
.neptune-*
|
||||
.unifi-*.json
|
||||
.uni-*.json
|
||||
.sy_*.json
|
||||
.syncro-*.json
|
||||
.msp-*.json
|
||||
.bb-*.json
|
||||
.signins.json
|
||||
.sc-tps.json
|
||||
.mon.json
|
||||
.tkt.json
|
||||
.rep.json
|
||||
.uadd.json
|
||||
.bill.json
|
||||
.gmeta.json
|
||||
.oc.json
|
||||
.hosts2.json
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1,28 +0,0 @@
|
||||
$ErrorActionPreference='SilentlyContinue'
|
||||
$o=New-Object System.Text.StringBuilder
|
||||
function W($s){[void]$script:o.AppendLine($s)}
|
||||
W '=DEFENDER='
|
||||
$m=Get-MpComputerStatus
|
||||
W ("mode=$($m.AMRunningMode) rtp=$($m.RealTimeProtectionEnabled) av=$($m.AntivirusEnabled) sig=$($m.AntivirusSignatureLastUpdated)")
|
||||
W '=DETECTIONS(5)='
|
||||
Get-MpThreatDetection|Sort-Object InitialDetectionTime -Descending|Select-Object -First 5|ForEach-Object{W ("$($_.InitialDetectionTime) :: $(($_.Resources -join ';'))")}
|
||||
W '=PUP MATCHES='
|
||||
$u=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
|
||||
$apps=Get-ItemProperty $u|Where-Object DisplayName
|
||||
$apps|Where-Object{$_.DisplayName -match 'McAfee|WebAdvisor|Norton|Avast|AVG|Avira|Driver|CCleaner|Clean|Optim|ByteFence|Segurazo|OneLaunch|Wave|TotalAV|Restoro|Reimage|Booster|Accelerate'}|ForEach-Object{W ("$($_.DisplayName) | $($_.Publisher)")}
|
||||
W '=HKLM RUN='
|
||||
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run').PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("$($_.Name)=$($_.Value)")}
|
||||
(Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run').PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("W64:$($_.Name)=$($_.Value)")}
|
||||
W '=USER RUN='
|
||||
Get-ChildItem Registry::HKEY_USERS|Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'}|ForEach-Object{
|
||||
$sid=$_.PSChildName
|
||||
(Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Run')).PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("[$sid] $($_.Name)=$($_.Value)")}
|
||||
}
|
||||
W '=NONMS TASKS='
|
||||
Get-ScheduledTask|Where-Object{$_.TaskPath -notlike '\Microsoft*'}|ForEach-Object{W ("$($_.TaskPath)$($_.TaskName) [$($_.State)]")}
|
||||
W ("=APPTOTAL= $($apps.Count)")
|
||||
$full=$o.ToString()
|
||||
$full|Out-File C:\Windows\Temp\acg-diag1.txt -Encoding utf8
|
||||
$apps|Sort-Object DisplayName|ForEach-Object{"$($_.DisplayName) | $($_.Publisher)"}|Add-Content C:\Windows\Temp\acg-diag1.txt -Encoding utf8
|
||||
$full
|
||||
'=DONE STAGE1='
|
||||
@@ -1 +0,0 @@
|
||||
JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJwA9AEEAVgAgAFAAUgBPAEQAVQBDAFQAUwA9ACcACgBHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AC8AUwBlAGMAdQByAGkAdAB5AEMAZQBuAHQAZQByADIAIAAtAEMAbABhAHMAcwBOAGEAbQBlACAAQQBuAHQAaQBWAGkAcgB1AHMAUAByAG8AZAB1AGMAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAIgAkACgAJABfAC4AZABpAHMAcABsAGEAeQBOAGEAbQBlACkAIABzAHQAYQB0AGUAPQAwAHgAJAAoACcAewAwADoAeAB9ACcAIAAtAGYAIAAkAF8ALgBwAHIAbwBkAHUAYwB0AFMAdABhAHQAZQApACIAIAB9AAoAJwA9AFMARQBDAFUAUgBJAFQAWQAgAEEAUABQAFMAIABJAE4AIABJAE4AVgBFAE4AVABPAFIAWQA9ACcACgBHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIABDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcAGEAYwBnAC0AZABpAGEAZwAxAC4AdAB4AHQAIAB8ACAAUwBlAGwAZQBjAHQALQBTAHQAcgBpAG4AZwAgACcAQgBpAHQAZABlAGYAZQBuAGQAZQByAHwAVwBlAGIAcgBvAG8AdAB8AFMAZQBuAHQAaQBuAGUAbAB8AFMAbwBwAGgAbwBzAHwARABhAHQAdABvAHwASAB1AG4AdAByAGUAcwBzAHwATQBhAGwAdwBhAHIAZQBiAHkAdABlAHMAfABUAHIAZQBuAGQAfABLAGEAcwBwAGUAcgBzAGsAeQB8AEUAUwBFAFQAfABNAGMAQQBmAGUAZQB8AE4AbwByAHQAbwBuAHwAQQB2AGEAcwB0AHwAQQBWAEcAfABTAGUAYwB1AHIAaQB0AHkAfABDAEMAbABlAGEAbgBlAHIAfABEAGUAZgBlAG4AZABlAHIAJwAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATABpAG4AZQAuAFQAcgBpAG0AKAApACAAfQAKACcAPQBOAE8AVABJAEYASQBDAEEAVABJAE8ATgAgAEEATABMAE8AVwBTAD0AJwAKAGYAbwByAGUAYQBjAGgAKAAkAGIAIABpAG4AIAAnAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAJwAsACcATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlACcAKQB7AAoAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAJABiAFwAVQBzAGUAcgAgAEQAYQB0AGEAXAAqAFwAUAByAGUAZgBlAHIAZQBuAGMAZQBzACIAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKACAAIAAgACAAJAB3AGgAbwA9ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AcgBlAHAAbABhAGMAZQAgACcAXgBDADoAXABcAFUAcwBlAHIAcwBcAFwAKABbAF4AXABcAF0AKwApAC4AKgAnACwAJwAkADEAJwAKACAAIAAgACAAJABwAHIAbwBmAD0AJABfAC4ARABpAHIAZQBjAHQAbwByAHkALgBOAGEAbQBlAAoAIAAgACAAIAAkAGoAPQBHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAFIAYQB3ACAAfAAgAEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4ACgAgACAAIAAgACQAZQB4AD0AJABqAC4AcAByAG8AZgBpAGwAZQAuAGMAbwBuAHQAZQBuAHQAXwBzAGUAdAB0AGkAbgBnAHMALgBlAHgAYwBlAHAAdABpAG8AbgBzAC4AbgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAKACAAIAAgACAAaQBmACgAJABlAHgAKQB7ACAAJABlAHgALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBWAGEAbAB1AGUALgBzAGUAdAB0AGkAbgBnACAALQBlAHEAIAAxAH0AIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIAQQBMAEwATwBXACAAJAB3AGgAbwAgACgAJABiACAAJABwAHIAbwBmACkAIAA6ADoAIAAkACgAJABfAC4ATgBhAG0AZQApACIAIAB9ACAAfQAKACAAIAB9AAoAfQAKACcAPQBFAFgAVABFAE4AUwBJAE8ATgBTAD0AJwAKAGYAbwByAGUAYQBjAGgAKAAkAGIAIABpAG4AIAAnAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAJwAsACcATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlACcAKQB7AAoAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAJABiAFwAVQBzAGUAcgAgAEQAYQB0AGEAXAAqAFwARQB4AHQAZQBuAHMAaQBvAG4AcwBcACoAIgAgAC0ARABpAHIAZQBjAHQAbwByAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKACAAIAAgACAAJABtAGYAPQBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkAXAAqAFwAbQBhAG4AaQBmAGUAcwB0AC4AagBzAG8AbgAiACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAgACAAIAAgAGkAZgAoACQAbQBmACkAewAgACQAbQA9AEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgACQAbQBmAC4ARgB1AGwAbABOAGEAbQBlACAALQBSAGEAdwB8AEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4AOwAgACQAbgBtAD0AJABtAC4AbgBhAG0AZQA7ACAAaQBmACgAJABuAG0AIAAtAGwAaQBrAGUAIAAnAF8AXwBNAFMARwAqACcAKQB7ACQAbgBtAD0AIgBpAGQAOgAkACgAJABfAC4ATgBhAG0AZQApACIAfQA7ACAAIgAkAGIAIAA6ADoAIAAkAG4AbQAiACAAfQAKACAAIAB9ACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAC0AVQBuAGkAcQB1AGUACgB9AAoAJwA9AEQATwBOAEUAIABTAFQAQQBHAEUAMgA9ACcACgA=
|
||||
@@ -1,23 +0,0 @@
|
||||
$ErrorActionPreference='SilentlyContinue'
|
||||
'=AV PRODUCTS='
|
||||
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | ForEach-Object { "$($_.displayName) state=0x$('{0:x}' -f $_.productState)" }
|
||||
'=SECURITY APPS IN INVENTORY='
|
||||
Get-Content C:\Windows\Temp\acg-diag1.txt | Select-String 'Bitdefender|Webroot|Sentinel|Sophos|Datto|Huntress|Malwarebytes|Trend|Kaspersky|ESET|McAfee|Norton|Avast|AVG|Security|CCleaner|Defender' | ForEach-Object { $_.Line.Trim() }
|
||||
'=NOTIFICATION ALLOWS='
|
||||
foreach($b in 'Google\Chrome','Microsoft\Edge'){
|
||||
Get-ChildItem "C:\Users\*\AppData\Local\$b\User Data\*\Preferences" | ForEach-Object {
|
||||
$who=$_.FullName -replace '^C:\\Users\\([^\\]+).*','$1'
|
||||
$prof=$_.Directory.Name
|
||||
$j=Get-Content $_.FullName -Raw | ConvertFrom-Json
|
||||
$ex=$j.profile.content_settings.exceptions.notifications
|
||||
if($ex){ $ex.PSObject.Properties | Where-Object {$_.Value.setting -eq 1} | ForEach-Object { "ALLOW $who ($b $prof) :: $($_.Name)" } }
|
||||
}
|
||||
}
|
||||
'=EXTENSIONS='
|
||||
foreach($b in 'Google\Chrome','Microsoft\Edge'){
|
||||
Get-ChildItem "C:\Users\*\AppData\Local\$b\User Data\*\Extensions\*" -Directory | ForEach-Object {
|
||||
$mf=Get-ChildItem "$($_.FullName)\*\manifest.json" | Select-Object -First 1
|
||||
if($mf){ $m=Get-Content $mf.FullName -Raw|ConvertFrom-Json; $nm=$m.name; if($nm -like '__MSG*'){$nm="id:$($_.Name)"}; "$b :: $nm" }
|
||||
} | Sort-Object -Unique
|
||||
}
|
||||
'=DONE STAGE2='
|
||||
@@ -1 +0,0 @@
|
||||
JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJwA9AE8ARgBGAEkAQwBFAC8ATQBDAEEARgBFAEUAIABJAE4AIABJAE4AVgBFAE4AVABPAFIAWQA9ACcACgBHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIABDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcAGEAYwBnAC0AZABpAGEAZwAxAC4AdAB4AHQAIAB8ACAAUwBlAGwAZQBjAHQALQBTAHQAcgBpAG4AZwAgACcATwBmAGYAaQBjAGUAfAAzADYANQB8AE0AYwBBAGYAZQBlACcAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATABpAG4AZQAuAFQAcgBpAG0AKAApAH0AIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8AIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAXgBTAGUAYwB1AHIAaQB0AHkAIABVAHAAZABhAHQAZQB8AF4AVQBwAGQAYQB0AGUAIABmAG8AcgAgAE0AaQBjAHIAbwBzAG8AZgB0AHwAXgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAVQBwAGQAYQB0AGUAJwB9ACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAC0AVQBuAGkAcQB1AGUACgAnAD0AUABFAFIALQBVAFMARQBSACAASQBOAFMAVABBAEwATABFAEQAIABBAFAAUABTAD0AJwAKAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAFMARQBSAFMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBOAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAFMALQAxAC0ANQAtADIAMQAnACAALQBhAG4AZAAgACQAXwAuAE4AYQBtAGUAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAXwBDAGwAYQBzAHMAZQBzACcAfQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAewAKACAAIAAkAHMAaQBkAD0AJABfAC4AUABTAEMAaABpAGwAZABOAGEAbQBlAAoAIAAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAoACQAXwAuAFAAUwBQAGEAdABoACsAJwBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAKgAnACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIABEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAIAAiAFsAJABzAGkAZABdACAAJAAoACQAXwAuAEQAaQBzAHAAbABhAHkATgBhAG0AZQApACAAfAAgACQAKAAkAF8ALgBQAHUAYgBsAGkAcwBoAGUAcgApACIAIAB9AAoAfQAKACcAPQBFAEQARwBFACAARQBYAFQARQBOAFMASQBPAE4AUwA9ACcACgBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgBDADoAXABVAHMAZQByAHMAXAAqAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAFUAcwBlAHIAIABEAGEAdABhAFwAKgBcAEUAeAB0AGUAbgBzAGkAbwBuAHMAXAAqACIAIAAtAEQAaQByAGUAYwB0AG8AcgB5ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AAoAIAAgACQAbQBmAD0ARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACIAJAAoACQAXwAuAEYAdQBsAGwATgBhAG0AZQApAFwAKgBcAG0AYQBuAGkAZgBlAHMAdAAuAGoAcwBvAG4AIgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoAIAAgAGkAZgAoACQAbQBmACkAewAgACQAbQA9AEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgACQAbQBmAC4ARgB1AGwAbABOAGEAbQBlACAALQBSAGEAdwB8AEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4AOwAgACQAbgBtAD0AJABtAC4AbgBhAG0AZQA7ACAAaQBmACgAJABuAG0AIAAtAGwAaQBrAGUAIAAnAF8AXwBNAFMARwAqACcAKQB7ACQAbgBtAD0AIgBpAGQAOgAkACgAJABfAC4ATgBhAG0AZQApACIAfQA7ACAAJABuAG0AIAB9AAoAfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIAAtAFUAbgBpAHEAdQBlAAoAJwA9AEMASABSAE8ATQBFACAARQBYAFQAIABJAEQAUwA9ACcACgBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgBDADoAXABVAHMAZQByAHMAXAAqAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABVAHMAZQByACAARABhAHQAYQBcACoAXABFAHgAdABlAG4AcwBpAG8AbgBzAFwAKgAiACAALQBEAGkAcgBlAGMAdABvAHIAeQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBOAGEAbQBlAH0AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAALQBVAG4AaQBxAHUAZQAKACcAPQBEAE8ATgBFACAAUwBUAEEARwBFADMAPQAnAAoA
|
||||
@@ -1,16 +0,0 @@
|
||||
$ErrorActionPreference='SilentlyContinue'
|
||||
'=OFFICE/MCAFEE IN INVENTORY='
|
||||
Get-Content C:\Windows\Temp\acg-diag1.txt | Select-String 'Office|365|McAfee' | ForEach-Object{$_.Line.Trim()} | Where-Object{$_ -notmatch '^Security Update|^Update for Microsoft|^Definition Update'} | Sort-Object -Unique
|
||||
'=PER-USER INSTALLED APPS='
|
||||
Get-ChildItem Registry::HKEY_USERS | Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'} | ForEach-Object{
|
||||
$sid=$_.PSChildName
|
||||
Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Uninstall\*') | Where-Object DisplayName | ForEach-Object{ "[$sid] $($_.DisplayName) | $($_.Publisher)" }
|
||||
}
|
||||
'=EDGE EXTENSIONS='
|
||||
Get-ChildItem "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Extensions\*" -Directory | ForEach-Object{
|
||||
$mf=Get-ChildItem "$($_.FullName)\*\manifest.json" | Select-Object -First 1
|
||||
if($mf){ $m=Get-Content $mf.FullName -Raw|ConvertFrom-Json; $nm=$m.name; if($nm -like '__MSG*'){$nm="id:$($_.Name)"}; $nm }
|
||||
} | Sort-Object -Unique
|
||||
'=CHROME EXT IDS='
|
||||
Get-ChildItem "C:\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions\*" -Directory | ForEach-Object{$_.Name} | Sort-Object -Unique
|
||||
'=DONE STAGE3='
|
||||
@@ -1 +0,0 @@
|
||||
JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJwA9AEgATwBTAFQAUwAgACgAbgBvAG4ALQBjAG8AbQBtAGUAbgB0ACkAPQAnAAoARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwBcAGgAbwBzAHQAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAgAC0AbQBhAHQAYwBoACAAJwBcAFMAJwAgAC0AYQBuAGQAIAAkAF8AIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAXgBcAHMAKgAjACcAfQAKACcAPQBXAEkATgBIAFQAVABQACAAUABSAE8AWABZAD0AJwAKAG4AZQB0AHMAaAAgAHcAaQBuAGgAdAB0AHAAIABzAGgAbwB3ACAAcAByAG8AeAB5ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfACAALQBtAGEAdABjAGgAIAAnAFwAUwAnAH0ACgAnAD0AVQBTAEUAUgAgAFAAUgBPAFgAWQA9ACcACgBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBTAEUAUgBTACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBTAC0AMQAtADUALQAyADEAJwAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAG8AdABtAGEAdABjAGgAIAAnAF8AQwBsAGEAcwBzAGUAcwAnAH0AIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsACgAgACAAJABwAD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACgAJABfAC4AUABTAFAAYQB0AGgAKwAnAFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwASQBuAHQAZQByAG4AZQB0ACAAUwBlAHQAdABpAG4AZwBzACcAKQAKACAAIAAiAFsAJAAoACQAXwAuAFAAUwBDAGgAaQBsAGQATgBhAG0AZQApAF0AIABlAG4AYQBiAGwAZQA9ACQAKAAkAHAALgBQAHIAbwB4AHkARQBuAGEAYgBsAGUAKQAgAHMAZQByAHYAZQByAD0AJAAoACQAcAAuAFAAcgBvAHgAeQBTAGUAcgB2AGUAcgApACAAYQB1AHQAbwBjAGYAZwA9ACQAKAAkAHAALgBBAHUAdABvAEMAbwBuAGYAaQBnAFUAUgBMACkAIgAKAH0ACgAnAD0ARABOAFMAPQAnAAoARwBlAHQALQBEAG4AcwBDAGwAaQBlAG4AdABTAGUAcgB2AGUAcgBBAGQAZAByAGUAcwBzACAALQBBAGQAZAByAGUAcwBzAEYAYQBtAGkAbAB5ACAASQBQAHYANAAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAFMAZQByAHYAZQByAEEAZABkAHIAZQBzAHMAZQBzAH0AIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAIAAiACQAKAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBBAGwAaQBhAHMAKQA6ACAAJAAoACQAXwAuAFMAZQByAHYAZQByAEEAZABkAHIAZQBzAHMAZQBzACAALQBqAG8AaQBuACAAJwAsACcAKQAiACAAfQAKACcAPQBCAFIATwBXAFMARQBSACAAUwBFAEEAUgBDAEgALwBTAFQAQQBSAFQAVQBQAD0AJwAKAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAFUAcwBlAHIAIABEAGEAdABhAFwAKgBcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiACwAIgBDADoAXABVAHMAZQByAHMAXAAqAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAFUAcwBlAHIAIABEAGEAdABhAFwAKgBcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AAoAIAAgACQAdwBoAG8APQAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAHIAZQBwAGwAYQBjAGUAIAAnAF4AQwA6AFwAXABVAHMAZQByAHMAXABcACgAWwBeAFwAXABdACsAKQAuACoAJwAsACcAJAAxACcACgAgACAAJABqAD0ARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAJABfAC4ARgB1AGwAbABOAGEAbQBlACAALQBSAGEAdwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuAAoAIAAgACQAcwBwAD0AJABqAC4AZABlAGYAYQB1AGwAdABfAHMAZQBhAHIAYwBoAF8AcAByAG8AdgBpAGQAZQByAF8AZABhAHQAYQAuAHQAZQBtAHAAbABhAHQAZQBfAHUAcgBsAF8AZABhAHQAYQAuAGsAZQB5AHcAbwByAGQACgAgACAAJABzAHUAPQAoACQAagAuAHMAZQBzAHMAaQBvAG4ALgBzAHQAYQByAHQAdQBwAF8AdQByAGwAcwAgAC0AagBvAGkAbgAgACcAOwAnACkACgAgACAAJABoAHAAPQAkAGoALgBoAG8AbQBlAHAAYQBnAGUACgAgACAAaQBmACgAJABzAHAAIAAtAG8AcgAgACQAcwB1ACAALQBvAHIAIAAkAGgAcAApAHsAIAAiAFsAJAB3AGgAbwAgACQAKAAkAF8ALgBEAGkAcgBlAGMAdABvAHIAeQAuAE4AYQBtAGUAKQBdACAAcwBlAGEAcgBjAGgAPQAkAHMAcAAgAHMAdABhAHIAdAB1AHAAPQAkAHMAdQAgAGgAbwBtAGUAPQAkAGgAcAAiACAAfQAKAH0ACgAnAD0AQgBSAE8AVwBTAEUAUgAgAFMASABPAFIAVABDAFUAVABTAD0AJwAKACQAcwBoAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAoARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAKgBcAEQAZQBzAGsAdABvAHAAXAAqAC4AbABuAGsAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAGUAcwBrAHQAbwBwAFwAKgAuAGwAbgBrACcALAAnAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAUQB1AGkAYwBrACAATABhAHUAbgBjAGgAXABVAHMAZQByACAAUABpAG4AbgBlAGQAXABUAGEAcwBrAEIAYQByAFwAKgAuAGwAbgBrACcAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsACgAgACAAJABsAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAKQAKACAAIABpAGYAKAAkAGwALgBUAGEAcgBnAGUAdABQAGEAdABoACAALQBtAGEAdABjAGgAIAAnAGMAaAByAG8AbQBlAHwAbQBzAGUAZABnAGUAfABmAGkAcgBlAGYAbwB4AHwAaQBlAHgAcABsAG8AcgBlACcAIAAtAGEAbgBkACAAJABsAC4AQQByAGcAdQBtAGUAbgB0AHMAIAAtAG0AYQB0AGMAaAAgACcAXABTACcAKQB7ACAAIgAkACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkAIAAtAD4AIAAkACgAJABsAC4AVABhAHIAZwBlAHQAUABhAHQAaAApACAAQQBSAEcAUwA6ACAAJAAoACQAbAAuAEEAcgBnAHUAbQBlAG4AdABzACkAIgAgAH0ACgB9AAoAJwA9AEQATwBOAEUAIABTAFQAQQBHAEUANAA9ACcACgA=
|
||||
@@ -1,28 +0,0 @@
|
||||
$ErrorActionPreference='SilentlyContinue'
|
||||
'=HOSTS (non-comment)='
|
||||
Get-Content C:\Windows\System32\drivers\etc\hosts | Where-Object{$_ -match '\S' -and $_ -notmatch '^\s*#'}
|
||||
'=WINHTTP PROXY='
|
||||
netsh winhttp show proxy | Where-Object{$_ -match '\S'}
|
||||
'=USER PROXY='
|
||||
Get-ChildItem Registry::HKEY_USERS | Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'} | ForEach-Object{
|
||||
$p=Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Internet Settings')
|
||||
"[$($_.PSChildName)] enable=$($p.ProxyEnable) server=$($p.ProxyServer) autocfg=$($p.AutoConfigURL)"
|
||||
}
|
||||
'=DNS='
|
||||
Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object{$_.ServerAddresses} | ForEach-Object{ "$($_.InterfaceAlias): $($_.ServerAddresses -join ',')" }
|
||||
'=BROWSER SEARCH/STARTUP='
|
||||
Get-ChildItem "C:\Users\*\AppData\Local\Google\Chrome\User Data\*\Preferences","C:\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Preferences" | ForEach-Object{
|
||||
$who=$_.FullName -replace '^C:\\Users\\([^\\]+).*','$1'
|
||||
$j=Get-Content $_.FullName -Raw | ConvertFrom-Json
|
||||
$sp=$j.default_search_provider_data.template_url_data.keyword
|
||||
$su=($j.session.startup_urls -join ';')
|
||||
$hp=$j.homepage
|
||||
if($sp -or $su -or $hp){ "[$who $($_.Directory.Name)] search=$sp startup=$su home=$hp" }
|
||||
}
|
||||
'=BROWSER SHORTCUTS='
|
||||
$sh=New-Object -ComObject WScript.Shell
|
||||
Get-ChildItem 'C:\Users\*\Desktop\*.lnk','C:\Users\Public\Desktop\*.lnk','C:\Users\*\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\*.lnk' | ForEach-Object{
|
||||
$l=$sh.CreateShortcut($_.FullName)
|
||||
if($l.TargetPath -match 'chrome|msedge|firefox|iexplore' -and $l.Arguments -match '\S'){ "$($_.FullName) -> $($l.TargetPath) ARGS: $($l.Arguments)" }
|
||||
}
|
||||
'=DONE STAGE4='
|
||||
12989
.khalsa-manual.json
12989
.khalsa-manual.json
File diff suppressed because one or more lines are too long
12989
.khalsa-session.json
12989
.khalsa-session.json
File diff suppressed because one or more lines are too long
13016
.khalsa-session2.json
13016
.khalsa-session2.json
File diff suppressed because one or more lines are too long
13043
.khalsa-session3.json
13043
.khalsa-session3.json
File diff suppressed because one or more lines are too long
13070
.khalsa-session4.json
13070
.khalsa-session4.json
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user