This section depends on what you find inside the .7z file. Common scenarios include:
If it contains a .raw or .vmem file, use Volatility Framework to look for rogue processes ( pstree ), hidden injections ( malfind ), or network connections ( netscan ). NsKri3-001.7z
If it contains a disk image, use Autopsy to reconstruct the file system and check for "Recently Used" files, Browser History, or Prefetch files. This section depends on what you find inside the