GIAC
GCFE · Question #131
Which artifact is typically used to determine application execution on Windows?
The correct answer is B. Prefetch files. See the full explanation below for the reasoning.
Question
Which artifact is typically used to determine application execution on Windows?
Options
- AWebCacheV01.dat
- BPrefetch files
- CJump Lists
- DSRUM database
How the community answered
(28 responses)- A4% (1)
- B75% (21)
- C7% (2)
- D14% (4)
Community Discussion
No community discussion yet for this question.