Networking
- Networking
Windows
Linux
Enterprise Architecture
Mac
- Forensics
  - Page 3
Attacker Information
IR Playbook
- Activity from Unmanaged Host
- Recommendations
Reverse Engineering
- Python - Pyinstaller

Powered by GitBook

On this page

File Location
Parsing Data
Considerations
Anti Forensics

Windows

Forensics

Evidence of Execution

PCA

Tracks GUI execution, not user based.

PreviousAmCache NextMUICache

Last updated 1 year ago

File Location

C:\Windows\appcompat\pca

Parsing Data

No need to parse data, comes in formated text file.

Considerations

New Windows 11 execution artifact.
Tracks GUI execution.
Tracks full binary path and last executed time in UTC PcaAppLaunchDic.txt.
Usually PcaGeneralDb1.txt won't have data.

PcaGeneralDb0.txt

Ties in with amcache and contains FileID. Can be used to correlate execution and file existence.

Anti Forensics

New Windows 11 Pro (22H2) Evidence of Execution Artifact! - AboutDFIR - The Definitive Compendium ProjectAboutDFIR - The Definitive Compendium Project