04 · Evidence of Execution
Evidence of Execution: Prefetch, Amcache, BAM and More
Prove a program ran on Windows, not just existed: Prefetch, ShimCache, Amcache, BAM, UserAssist, SRUM, PCA, WER and 4688 compared, with parsing commands.
Area 04
Evidence of Execution
Showing that malware or a tool ran is often the core of a case. This area compares Prefetch, Amcache, ShimCache, BAM, UserAssist, SRUM and newer sources such as the Program Compatibility Assistant, with what each timestamp really means on each Windows version.
Key sources
- Prefetch
- Amcache.hve
- ShimCache
Guides in this area
04 · Evidence of Execution
SRUM Forensics: App Usage and Network Bytes per Hour
Use SRUM (SRUDB.dat) to prove which apps ran, under which user, and how many bytes they sent: tables, ID mapping, dirty database repair, SrumECmd, pitfalls.
04 · Evidence of Execution
Phishing Forensics: MotW, ISO, LNK and Initial Access
Trace a phishing attack from email to first execution: Outlook temp files, Zone.Identifier, ISO and LNK MotW bypass, macros, OneNote, LOLBins and a timeline.
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- Amcache.hveAmcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
- ShimCache (AppCompatCache)ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- UserAssistUserAssist cheat sheet: NTUSER.DAT GUID keys, ROT13 value names, run count, focus time and last run FILETIME for programs a user launched from Explorer.
- SRUM (System Resource Usage Monitor)SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
- MUICacheMUICache cheat sheet: UsrClass.dat and NTUSER.DAT locations, FriendlyAppName and ApplicationCompany values, what they prove and their timestamp limits.
- Program Compatibility Assistant (PCA)Program Compatibility Assistant cheat sheet: Windows 11 PcaAppLaunchDic.txt and PcaGeneralDb files, the AppCompatFlags Store key, fields and UTC times.
- RecentFileCache.bcfRecentFileCache.bcf cheat sheet: the Windows 7 execution artifact that lists recently run executables, its location, format, limits and how to parse it.
- Installed Programs (Uninstall Keys, MSI, AppX)Installed programs cheat sheet: Uninstall keys, MsiInstaller events 1033/11707, cached MSIs, AppX packages, winget logs and Amcache to date software installs.
- Kernel Drivers (.sys, Driver Services, BYOVD)Kernel drivers cheat sheet: driver services (Type 1/2), event 7045, DriverStore, setupapi.dev.log, Amcache and CodeIntegrity logs to hunt BYOVD and rootkits.
- Windows Subsystem for Linux (WSL)WSL cheat sheet: Lxss registry key, WSL1 rootfs vs WSL2 ext4.vhdx, bash_history inside distros, wsl.exe execution traces, wsl$ share access and evasion.
- PE files (Windows executables)PE file triage cheat sheet: hashes, imphash and Rich header, compile timestamp caveats, sections and entropy, version info, signatures, PDB paths and tools.
- Syscache.hveSyscache.hve cheat sheet: the Windows 7 / Server 2008 R2 hive in System Volume Information that links MFT file IDs to SHA-1 hashes, and its limits.