TechTip: "afterSentDocuments" folder under "My Documents"

Just a random bit of information that proved to be rather difficult to find online for some reason, so in the spirit of this blog I am sharing it just in case it helps save time for someone else.

"afterSentDocuments" folder under "My Documents"

The "afterSentDocuments" folder under "My Documents" (or just "Documents" for Windows 10 users) is created by the SentinelOne endpoint agent.

The contents of this folder actually come from an archive located in the SentinelOne Agent installation folder under "C:\Program Files\SentinelOne\Sentinel Agent x.x.x.x\afterSentDocuments.zip"

These are not malicious. While undocumented, they are used for some internal SentinelOne scanning/encryption mechanisms. Hope this helps.