Skip to content
WMIparser

Posts tagged: #evidence-of-execution

← Back to all posts
SCCM RecentlyUsedApps: evidence of execution in WMI
Read CCM_RecentlyUsedApps from the WMI repository: which programs each user ran, when last and how often, including older copies carved from OBJECTS.DATA.
wmisccmevidence-of-executionobjects-data