Q88
Single choice
Which telemetry source most directly shows whether a word processor spawned a shell and created a startup file during a known time window?