πŸ”
Windows Forensic Handbook
search
Ctrlk
  • πŸ‘‹Welcome
  • Artifacts by Type
    • πŸ—„οΈRegistry Artifactschevron-right
    • πŸ“‚Filesystem Artifactschevron-right
    • πŸ“…Event Log Artifactschevron-right
  • Artifacts by Activity
    • πŸƒβ€β™‚οΈExecutionchevron-right
      • Evidence of Executionchevron-right
      • First Executedchevron-right
      • Last Executedchevron-right
        • Prefetcharrow-up-right-from-square
        • Background Activity Montitorarrow-up-right-from-square
        • AutomaticDestinations Jumplistsarrow-up-right-from-square
        • Task Scheduler Filesarrow-up-right-from-square
        • Task Scheduler Operational Logarrow-up-right-from-square
      • Command Line Optionschevron-right
      • Execution Accountchevron-right
      • Parent and Child Informationchevron-right
      • Execution Timestampchevron-right
    • πŸ—’οΈFile Activitychevron-right
    • πŸ‘¨β€πŸ”§Account Activitychevron-right
    • 🌎Network Activitychevron-right
    • πŸ”Browser Activitychevron-right
    • πŸ–₯️System Enumerationchevron-right
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Artifacts by Activitychevron-right
  2. πŸƒβ€β™‚οΈExecution

Last Executed

Prefetchchevron-rightBackground Activity Montitorchevron-rightAutomaticDestinations Jumplistschevron-rightTask Scheduler Fileschevron-rightTask Scheduler Operational Logchevron-right

Last updated 2 years ago