Look for URLs visited just before the "crash" or capture.
Check what the user typed in the command prompt using cmdline or consoles . Download File P_os.zip
Check for suspicious or unusual background tasks that shouldn't be there. vol.py -f P_os.raw --profile=[PROFILE] pslist Look for URLs visited just before the "crash" or capture