Check Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist to see which programs were executed and how many times.
Use SBECmd to track folder access and directory traversal by snackedadmin . Event Log Investigation If .evtx files are present, use Event Viewer or Hayabusa : snackedadmin-10.rar
Registry keys showing the use of tools like Rclone or WinSCP . 5. Conclusion snackedadmin-10.rar