drop windows evtx csv exports · parse logon events 4624 4648 4776 · reconstruct host-to-host movement as a node graph · color by account · timeline · runs locally