Ticket #162 (new new_feature)

Description

It would be nice if we had a way of grabbing just the windows event log events which occur starting maybe 2 minutes before the first event seen by capture. The reason for pushing the time back a little bit is because it could give some idea of what may have crashed or started prior to the first seen event (to see what an exploit may have done while still resident in memory).

Also the events in general can be quite interesting, such as b883c2ac6372dede81243a5298 which eventually writes CWINDOWS\system32\RESSDT.exe

But what does it do with RESSDT.exe? Well if we had the ability to grab the relevant last entries from the event log we could see at a glance that it gets started as a service.

Xeno