# Evidence of Execution

One of the most common questions an analyst must answer is: *"Did the malware actually run?"* 

Just because a malicious file exists on the hard drive does not mean the user actually double-clicked it. To prove execution, we look at several specific Windows artifacts.

## 1. Prefetch (*.pf files)
Windows uses Prefetch to speed up the boot process and application launch times. When an application runs for the first time, Windows analyzes what files and DLLs it needs and creates a `.pf` file in `C:\Windows\Prefetch\`. 

The next time the application runs, Windows reads the `.pf` file and pre-loads the necessary components into memory, making the application launch faster.

*   **Forensic Value:** 
    *   **Proof of execution:** If `nc.exe-0D12ABCD.pf` exists, Netcat was absolutely executed on this machine.
    *   **Execution count:** The file stores exactly how many times the application has been run.
    *   **Timestamps:** It stores the timestamp of the last execution, as well as up to 7 previous execution timestamps (in Windows 8+).
    *   **Target path:** It shows exactly where the executable was located when it ran (e.g., was it run from `C:\Temp` or from a USB drive?).

## 2. Shimcache (Application Compatibility Cache)
Whenever an application runs, Windows checks if it needs any special compatibility settings (shims) to run properly (e.g., "Does this program think it's running on Windows XP?").

Windows caches these checks in the Registry at `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache`.

*   **Forensic Value:** 
    *   The Shimcache tracks the file path, the file size, and the Last Modified time of the executable.
    *   It is fantastic for tracking executables that were run from a USB drive and subsequently deleted. Even if the USB is removed, the trace remains in the Shimcache.
    *   *Note:* The Shimcache does not definitively prove execution (a file can enter the cache just by being browsed in Explorer), but it proves the file existed on the system at a specific path.

## 3. Amcache
A newer artifact (Windows 8+) located at `C:\Windows\AppCompat\Programs\Amcache.hve`. It is technically its own registry hive file.

*   **Forensic Value:**
    *   Similar to Shimcache but records much more detail, notably the **SHA-1 hash** of the executable. 
    *   This is incredibly powerful. Even if an attacker renames their malware from `mimikatz.exe` to `svchost.exe`, the Amcache will record its true SHA-1 hash, allowing analysts to instantly identify the malicious binary.