Practical Windows Forensics

Prefetch files

To try to answer the previous question, we can start analyzing the prefetch files. From DART, open the WinPrefetchView tool. This tool will automatically parse the prefetch files of the live system and view their results in human readable format.

After spending some time in viewing the files and searching for the executable named epqe, we can find that eqpe.exe ran just two seconds after a file named latest_report.pdf.exe ran in the system, and at the same second the Explorer.exe started:

As we can see, the first filename is very suspicious. It is located under C:\Users\<<UserName>>\Downloads\latest_report.pdf.exe. If we tried to search ...