Look for (Registry keys, Scheduled Tasks). Inspect Network Artifacts (pcap files or browser history).
If you'd like me to help draft a specific section of your report: (from your analysis tools) Step-by-step methodology Incident timeline construction
Always use a to prevent accidental infection or C2 (Command & Control) callbacks.