Skill UI

This skill guides the process of analyzing Windows Prefetch (.pf) files to reconstruct a detailed program execution history. By parsing these system artifacts, users can determine which applications were run, how many times, and when. It is crucial for building forensic timelines, confirming suspicious binary execution during malware investigations, and localizing evidence in a Windows system.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.