With the NIKKE launcher tampering in the news this week, here's the order I'd go in if software on your PC turns out to be compromised. Most of this applies to any trojanized installer.

1. Assume anything saved in your browser on that machine is gone. Saved passwords, cookies, autofill. Stealer malware grabs those first.
2. Change passwords from a different, clean device. Start with your main email, then banking, then anything that can reset other accounts.
3. Log out of all sessions. Changing a password doesn't always kill a stolen session cookie. Most big sites have a "sign out everywhere" option. Discord, Steam, Google and Microsoft all do.
4. Check 2FA settings for anything new. Attackers sometimes add their own authenticator or recovery email.
5. Clean or reinstall the machine before logging back in. Otherwise you're just handing over the new passwords.
6. Keep an eye on email for login alerts and password resets you didn't ask for over the next few weeks.

Stolen data like this often ends up in stealer log dumps that get traded later, so a "nothing found" result today doesn't mean much. Worth rechecking down the road.

Disclosure: I'm with OSINT Pro, a breach lookup tool. We wrote up how stealer logs work here if it's useful: https://www.osintpro.dev/resources/what-are-infostealer-logs

Happy to hear what others would add or reorder.