Daily Blog #626: Sunday Funday 2/17/19

Hello Reader,
         Let's reevaluate challenges again. Last week I either asked for too much or went to Niche so let's open it up again. The point of these challenges is to get you the larger DFIR community to get involved in your own research and testing so you can surprise yourself and help others in their work. So with that, here is this week's challenge.

The Prize:
$100 Amazon Giftcard

The Rules:

1. You must post your answer before Friday 2/22/19 7PM CST (GMT -5)
2. The most complete answer wins
3. You are allowed to edit your answer after posting
4. If two answers are too similar for one to win, the one with the earlier posting time wins
5. Be specific and be thoughtful
6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:
On a OSX Mojave system what are the different places that record that a program has executed?