Terminal device and method for investigating file distributor of the terminal device

The terminal device and method make baepocheo file of the terminal device is disclosed. Embodiments of the present invention, files that are said cache when leaving the machine is running (pre-executed) files and baepocheo information of the files that were at the terminal device to the cache (cache), which is a new file generated in the terminal device and by comparing the new file to extract baepocheo information of the new file, it is possible to prevent the spread of malicious code in advance.