# Execution

{% content-ref url="execution/evidence-of-execution" %}
[evidence-of-execution](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/evidence-of-execution)
{% endcontent-ref %}

{% content-ref url="execution/first-executed" %}
[first-executed](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/first-executed)
{% endcontent-ref %}

{% content-ref url="execution/last-executed" %}
[last-executed](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/last-executed)
{% endcontent-ref %}

{% content-ref url="execution/command-line-options" %}
[command-line-options](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/command-line-options)
{% endcontent-ref %}

{% content-ref url="execution/execution-account" %}
[execution-account](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/execution-account)
{% endcontent-ref %}

{% content-ref url="execution/parent-and-child-information" %}
[parent-and-child-information](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/parent-and-child-information)
{% endcontent-ref %}

{% content-ref url="execution/execution-timestamp" %}
[execution-timestamp](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/execution/execution-timestamp)
{% endcontent-ref %}