🔍
Windows Forensic Handbook
Search
Ctrl + K
First Executed
Last updated
8 months ago
Prefetch
AutomaticDestinations Jumplists
Task Scheduler Files
Tracing Registry Keys
Task Scheduler Operational Log
EventID 4104: PowerShell Script Block Logging