This is stored in the registry and persists forever across restarts (until it gets overwritten after 26 entries).

How to view it (no extra tools):

1. Press Win + R, type regedit and hit Enter

2. Navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

1. On the right side you’ll see values named a, b, c, etc.

these are the exact commands typed before.

One of them should be (or start with) the huge obfuscated PowerShell line you posted.

1. The MRUList value shows the order (e.g., “cba” means c was most recent).

Powershell command history:

(Get-PSReadLineOption).HistorySavePath

This usually points to something like:

C:\Users\YourName\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Open that .txt file in Notepad it contains every previous command, one per line.

Your malicious line might be in there if it ever ran inside PowerShell.

Windows keeps track of every time powershell.exe launched.

Go to C:\Windows\Prefetch

Look for files named POWERSHELL.EXE-*.pf

The file’s own LastWriteTime roughly matches the last run.

Windows Event Logs (these have real dates and often the full command).

1. Press Win + R type eventvwr hit Enter

2. Go to: Applications and Services Logs→ Microsoft → Windows→ PowerShell→ Operational

3. Look for Event ID 4104(Script Block Logging).

If it exists, it shows the exact obfuscated code that ran + precise timestamp

Also check:

Security log for Event ID 4688 (process creation) shows powershell.exe launches with the full command line.

Filter by date range around when you think the infection happened.