: Check Registry keys like Run and RunOnce or scheduled tasks.

: For analyzing process trees and hidden injections.

: The "Zo" and "S" prefixes often refer to specific challenge categories in regional forensics competitions (such as those hosted on platforms like CyberDefenders or HTB).