live response tool execution artifact detector — free browser tool | fatcousin

home

drop prefetch shimcache amcache or 4688 evtx csv · detect live response and triage collection tool execution · identify when and how live response was performed · surface kape triage collector and incident response tool artifacts · runs locally

execution artifacts

drop prefetch / shimcache / amcache / 4688 evtx / mft csv

or click

Select file

KAPE · CyLR · Velociraptor · DumpIt · hash verification · collection output in MFT · incident window context

drop prefetch · shimcache · amcache · 4688 evtx · mft csv