AnalysisConstructed
Mini-guide: what a Prefetch file proves, and the three things it cannot tell you
Prefetch is the best execution evidence most Windows workstations keep by default. What is inside a .pf file, how to read the eight run times, why two files for one program can be normal or a finding, and where it runs out.
T1204.002T1070.004