EvidenceOfExecution.tkape

Description: Evidence of execution related files
Author: Eric Zimmerman
Version: 1.1
Id: 13ba1e33-4899-4843-adf0-c7e6a20d758a
RecreateDirectories: true
Targets:
    -
        Name: Amcache
        Category: ApplicationCompatibility
        Path: Amcache.tkape
    -
        Name: AppCompatPCA
        Category: ApplicationCompatibility
        Path: AppCompatPCA.tkape
    -
        Name: Prefetch
        Category: Prefetch
        Path: Prefetch.tkape
    -
        Name: RecentFileCache
        Category: ApplicationCompatibility
        Path: RecentFileCache.tkape
    -
        Name: Syscache
        Category: Syscache
        Path: Syscache.tkape

# Documentation
# ShimCache is not included in this Compound Target, as that would require pulling the entire SYSTEM Registry Hive. To ensure the ShimCache is pulled and parsed, use RegistryHivesSystem.tkape and parse with AppCompatCacheParser.mkape