Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
Something on this host survives a reboot.
Nothing here is racing you. Nothing here expires quickly, which is the one piece of good news in this list. Work through all three locations rather than stopping at the first hit.
survivesUntil rolled out by the 1024-entry cap. On a normal workstation this is months.
does not proveWHO ran it — Prefetch carries no user context at all
the trap
Checking Run keys and calling it done. WMI event subscriptions touch no autostart key and no task folder, and they are what survives a cleanup that removed everything else. Enumerate root\subscription explicitly: nothing surfaces it by accident.
if you find nothing
A registry key proves configuration, not execution. Pair anything you find with Prefetch or the Task Scheduler operational log to show it actually fired.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
