@girlunallocated Also the shellbags, prefetch, and LNK parsers from tzworks. Volatility. @dckovar's analyze-mft and @keydet89's mft.pl