prefetch vs execution gap · shimcache/4688/amcache · offensive tool matches · batch deletion windows · runs locally
sources
drop prefetch csv · shimcache · 4688 · amcache
or click
ranks executables with execution evidence but no prefetch · 500+ offensive tool name fragments
drop prefetch listing csv + shimcache / 4688 / amcache csv