drop windows search query exports · browser search history · file access logs · correlate what the user searched for with what they subsequently accessed · establish search intent behind file access · build evidence of deliberate targeting · runs locally
WordWheelQuery · browser URL history · EVTX 4663 · MFT access timestamps
drop wordwheelquery · browser history · 4663 / mft access csv