drop $i files + mft/evtx/browser/prefetch csv · process attribution · download-then-delete · bulk clusters · csv export · runs locally
deletion artifacts
drop $I / RBCmd CSV / correlation CSVs
or click
optional paste correlation csv below if not dropped as files
drop $I files · optional mft/evtx/browser/prefetch csv