BAM/DAM registry export · shimcache/4688/prefetch cross-ref · selective clearing · SID coverage · runs locally
sources
drop BAM/DAM export · shimcache · 4688 · prefetch
or click
HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings · gaps = execution evidence without BAM/DAM entry
drop BAM/DAM .reg or hive · shimcache · 4688 · prefetch csv