saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 16:40:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/analyzing-prefetch-files-for-execution-history/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

3.1 KiB
Raw Blame History

API Reference: Windows Prefetch Analysis Tools

Prefetch File Format

Location

C:\Windows\Prefetch\

Filename Convention

EXECUTABLE_NAME-XXXXXXXX.pf
  • EXECUTABLE_NAME - Uppercase name of the executed program
  • XXXXXXXX - Hash of the executable path (8 hex characters)
  • .pf - Prefetch file extension

Version History

Version Windows OS Notes
17 XP Basic format
23 Vista, 7 Added run count, timestamps
26 8, 8.1 Extended timestamps (8 entries)
30 10, 11 MAM compressed, 8 timestamps

Header Structure (Uncompressed)

Offset Size Field
0 4 Version
4 4 Signature (SCCA)
12 4 File size
16 60 Executable name (UTF-16LE)
76 4 Prefetch hash

PECmd (Eric Zimmerman) - Full Parser

Syntax

PECmd.exe -f <prefetch_file>              # Single file
PECmd.exe -d <prefetch_directory>          # Entire directory
PECmd.exe -d <dir> --csv <output_dir>     # Export to CSV
PECmd.exe -d <dir> --json <output_dir>    # Export to JSON
PECmd.exe -f <file> -q                    # Quiet mode

Output Fields

Field Description
SourceFilename Original executable path
RunCount Number of times executed
LastRun Most recent execution timestamp
PreviousRun0-7 Up to 8 previous run timestamps (Win8+)
FilesLoaded DLLs and files accessed during execution
Directories Directories accessed
VolumeSerialNumber Volume where executable resided

WinPrefetchView (NirSoft)

GUI Features

  • Lists all prefetch files with execution details
  • Shows run count, timestamps, referenced files
  • Export to CSV, HTML, or text
  • Sort by any column for analysis

Python Prefetch Parsing

Structure Parsing

import struct

with open("APP.EXE-HASH.pf", "rb") as f:
    data = f.read()

version = struct.unpack_from("<I", data, 0)[0]
signature = data[4:8]   # Should be b"SCCA"
exe_name = data[16:76].decode("utf-16-le").rstrip("\x00")
pf_hash = struct.unpack_from("<I", data, 76)[0]

FILETIME Conversion

import datetime

def filetime_to_datetime(filetime):
    epoch = datetime.datetime(1601, 1, 1)
    delta = datetime.timedelta(microseconds=filetime // 10)
    return epoch + delta

Suspicious Prefetch Indicators

Offensive Tools

Tool Prefetch Name
Mimikatz MIMIKATZ.EXE-*.pf
PsExec PSEXEC.EXE-*.pf, PSEXESVC.EXE-*.pf
BloodHound SHARPHOUND.EXE-*.pf
Rubeus RUBEUS.EXE-*.pf
LaZagne LAZAGNE.EXE-*.pf

LOLBins (Living Off the Land)

Binary Concern
CERTUTIL.EXE File download, Base64 decode
MSHTA.EXE Script execution via HTA
REGSVR32.EXE COM scriptlet execution
BITSADMIN.EXE File download
MSBUILD.EXE Code execution via project files

Timeline Integration

Plaso / log2timeline

log2timeline.py timeline.plaso /path/to/prefetch/
psort.py -o l2tcsv timeline.plaso > prefetch_timeline.csv