Execution
Amcache.hve
Amcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
- Location
- C:\Windows\AppCompat\Programs\Amcache.hve
- Proves
- A binary was present (path, SHA-1, PE metadata); often, but not always, that it ran
- Timestamps
- Entry key LastWrite as FILETIME, UTC; PE LinkDate (compile time, UTC); InstallDate string whose format varies by build
- Retention
- No fixed entry limit; entries age out once the file is gone and a later inventory run refreshes the hive; scheduled tasks bulk-update LastWrite
- Access
- Administrator; hive locked live: collect with its .LOG files via raw NTFS (KAPE) or a shadow copy
- Evidence of
- Execution
- Type
- Registry
- Windows
- Vista / 78 / 8.11011
- KAPE target
- Amcache
- Velociraptor
- Windows.Triage.Targets:Amcache
Tools
Compare all toolsWhat it is
Amcache.hve is a standalone registry hive maintained by the Application Experience components (the Microsoft Compatibility Appraiser and related inventory tasks). It keeps an inventory of executables, installed programs, drivers, shortcuts and devices that Windows has seen. Its killer feature for investigators is the SHA-1 hash of each inventoried executable, which survives even when the binary itself has been deleted.
It replaced RecentFileCache.bcf: Windows 8 introduced it, and Windows 7 received it through compatibility updates.
Location
| Windows version | Path | Notes |
|---|---|---|
| 7 (with compatibility updates) / 8 / 8.1 | C:\Windows\AppCompat\Programs\Amcache.hve | Older layout: Root\File\{Volume GUID}\<file reference> and Root\Programs |
| 10 / 11 | C:\Windows\AppCompat\Programs\Amcache.hve | Newer builds use the Root\Inventory* layout |
| All | Amcache.hve.LOG1, Amcache.hve.LOG2 | Transaction logs; replay them for a consistent hive |
The hive is locked while Windows runs: collect it with raw NTFS access or from a shadow copy.
What it proves
- Presence of a specific binary at a specific path, with its SHA-1, size, version information and PE link (compile) date.
- Installed programs (
InventoryApplication) with publisher, install date and uninstall string, including software removed since. - Drivers (
InventoryDriverBinary) with signing status: useful for rootkits and vulnerable-driver abuse. - Execution only with corroboration. Research (notably ANSSI's 2019 Amcache analysis) showed that entries are also created by inventory scans of installed software, so an Amcache entry alone is not proof that the file ran. Pair it with Prefetch, BAM or event logs.
Key fields
Newer layout (Root\InventoryApplicationFile\<name|id>):
| Value | Meaning |
|---|---|
LowerCaseLongPath | Full path of the file, lower-cased |
FileId | 0000 followed by the SHA-1 of the file |
Name, OriginalFileName | On-disk name and the PE version-info name (renamed tools stand out) |
Publisher, Version, BinFileVersion, ProductName | Version-information strings |
Size | File size in bytes |
LinkDate | PE header compile time (attacker-controllable) |
ProgramId | Links the file to an InventoryApplication entry |
IsOsComponent | Whether Windows considers it part of the OS |
Other useful keys: InventoryApplication (installed programs), InventoryApplicationShortcut (Start menu shortcuts), InventoryDriverBinary and InventoryDriverPackage (drivers), InventoryDevicePnp (plug-and-play devices, including USB).
Older layout (Root\File\...): numbered values, for example 15 = full path, 101 = SHA-1, 0 = product name, 1 = company name.
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Key LastWrite of each file entry | Entry created or updated by an inventory pass | FILETIME, UTC | Often close to first execution, but also moves on re-inventory; treat as "seen by Windows at" |
LinkDate | Compile time in the PE header | UTC string | Can be forged or zeroed; not a file-system time |
InstallDate (InventoryApplication) | Program installation recorded | String, local-time format varies by build | Verify against the SOFTWARE hive Uninstall key |
DriverLastWriteTime | Last modification of the driver file | UTC | Describes the driver file, not a load time |
Retention and clearing
- There is no fixed entry limit; entries age out when the corresponding file or program disappears and a later inventory run refreshes the hive, so deleted binaries may persist for a while but not forever.
- The hive is rewritten by scheduled compatibility tasks, which can update LastWrite times in bulk.
- The SHA-1 is computed over the first 31,457,280 bytes (30 MB) of the file. For larger files the hash will not match a full-file SHA-1.
- Deleting or replacing
Amcache.hveis possible with administrative rights; look for gaps and for the deletion in the USN journal.
Collection
- KAPE target:
Amcache(hive,.LOG*files and the adjacent*.dbfiles) - Velociraptor (
Windows.Triage.Targets):Amcache - Built-in: the file is locked, so copy it from a shadow copy.
vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\AppCompat\Programs\Amcache.hve* E:\case\
Parsing tools
- AmcacheParser (Eric Zimmerman):
AmcacheParser.exe -f Amcache.hve --csv E:\out -iexports every inventory key to CSV;-iincludes entries associated with programs. - Registry Explorer (Eric Zimmerman): interactive view with transaction-log replay.
- RegRipper:
amcacheplugin for a quick text report. - Velociraptor:
Windows.Forensics.AmcacheandWindows.Detection.Amcacheon live endpoints.
Investigation tips
- Pivot on SHA-1: search the hash in threat-intel sources and across the fleet; the same hash under a different name reveals renamed tools.
- Compare
NamewithOriginalFileName:svchost.exewhose original name isprocdumpis a strong lead. - Look for executables in user-writable paths (
\Users\Public\,\ProgramData\,\AppData\Local\Temp\) and unsigned drivers inInventoryDriverBinary. - Amcache has no user attribution; combine it with BAM/DAM or UserAssist to identify the account.
- When the binary is gone, the SHA-1 and path still let you tie the case to a file recovered elsewhere ($MFT, Recycle Bin).
Related artifacts
- ShimCache (AppCompatCache)ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- RecentFileCache.bcfRecentFileCache.bcf cheat sheet: the Windows 7 execution artifact that lists recently run executables, its location, format, limits and how to parse it.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- PE files (Windows executables)PE file triage cheat sheet: hashes, imphash and Rich header, compile timestamp caveats, sections and entropy, version info, signatures, PDB paths and tools.
- Installed Programs (Uninstall Keys, MSI, AppX)Installed programs cheat sheet: Uninstall keys, MsiInstaller events 1033/11707, cached MSIs, AppX packages, winget logs and Amcache to date software installs.
- Kernel Drivers (.sys, Driver Services, BYOVD)Kernel drivers cheat sheet: driver services (Type 1/2), event 7045, DriverStore, setupapi.dev.log, Amcache and CodeIntegrity logs to hunt BYOVD and rootkits.
Glossary terms
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.
- Registry HiveAn on-disk file that backs part of the Windows Registry, such as `SYSTEM`, `SOFTWARE`, or `NTUSER.DAT`.
- Registry transaction logs (.LOG1/.LOG2)The .LOG1 and .LOG2 files next to each registry hive that record pending writes; on Windows 8.1 and later they can hold data missing from the hive.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.