Hi I am stuck on the Memory Mysteries challenge on the 3rd Question: What is the name of the .PS1 script the user ran?
I dumped the console history located at: <virtaddr>\Users\cybrary\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
But this is empty.
Checked all running processes, their commandlines, consoles and cmdscan output. I could not find any powershell script being run anywhere. Could someone provide any hint on how to find it?