Installed Programs (Uninstall Keys, MSI, AppX)

What it is

Windows has no single package manager history, but several sources together play that role. The Uninstall registry keys feed "Apps & features" and "Programs and Features". Windows Installer (msiexec) logs every MSI install and removal to the Application log and caches the package under C:\Windows\Installer. Store and MSIX apps are tracked by the AppX deployment stack in a state database. Package managers such as winget and Chocolatey keep their own logs, and Amcache keeps an independent inventory. When an attacker installs a remote access tool, a VPN client or a vulnerable driver package, these are the places that record it.

Location

Package manager paths depend on version and install scope; confirm on a reference system.

What it proves

• Presence of software: a product was registered as installed, with its name, version, publisher and install folder.
• Approximate install time: from InstallDate, the key's LastWrite time and MsiInstaller events.
• Who installed it: MSI events carry the user SID, InstallProperties sits under the installing SID (or S-1-5-18 for per-machine), and HKCU entries belong to that profile.
• Removal: event 1034 or 11724, and orphaned folders or cached MSIs after the Uninstall key is gone.

It does not prove the program was ever run. Portable tools (unzipped binaries, AnyDesk.exe run from Downloads) never create Uninstall keys; use Prefetch and Amcache file entries for those. An Uninstall key can also be written by hand, so treat a lone key as a claim, not proof.

Key fields

Timestamps

• Key LastWrite (FILETIME, UTC): set at install, but also by repairs, updates and some self-updaters, so it is an upper bound on install time.
• InstallDate: local date with no time, written by the installer itself. Some installers leave it empty or write the build date.
• MsiInstaller events: precise UTC timestamps; the most reliable anchor for MSI products.
• Amcache InventoryApplication: carries its own InstallDate and a Source field (for example AddRemoveProgram or Msi); useful when the Uninstall key has been deleted.
• Folder creation of InstallLocation and of the cached .msi ($SI and $FN in the $MFT) corroborate the install time.

Retention and clearing

Uninstall keys stay until the product is removed; a clean uninstall deletes the key but often leaves the install folder, Prefetch, Amcache entries and the MsiInstaller events behind. Application.evtx defaults to 20 MB and rolls over, so on busy servers MSI events may be gone within weeks. Deleted keys can survive in registry transaction logs, unallocated hive space and Volume Shadow Copies.

Collection

KAPE targets RegistryHivesSystem, RegistryHivesUser, EventLogs and Amcache cover most sources. On a live system:

# All three Uninstall views (HKCU only for the current user)
$paths = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
         'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
         'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty $paths | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation, InstallSource |
  Export-Csv E:\case\uninstall.csv -NoTypeInformation

# MsiInstaller install and removal events
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; Id=1033,1034,11707,11724} |
  Select-Object TimeCreated, Id, UserId, Message | Export-Csv E:\case\msi.csv -NoTypeInformation

# AppX packages for all users (admin)
Get-AppxPackage -AllUsers | Select-Object Name, PackageFullName, InstallLocation | Export-Csv E:\case\appx.csv -NoTypeInformation

robocopy C:\ProgramData\Microsoft\Windows\AppRepository E:\case\AppRepository StateRepository-Machine.srd* /B

Parsing tools

• Registry Explorer and RegRipper (uninstall plugin) for offline hives, including deleted keys.
• AmcacheParser (Eric Zimmerman) exports InventoryApplication and links files to programs via ProgramId.
• EvtxECmd with its maps, or Velociraptor Windows.EventLogs.EvtxHunter, for MsiInstaller events.
• Velociraptor Windows.Sys.Programs lists Uninstall entries on live endpoints.
• StateRepository-Machine.srd is SQLite: open a copy with DB Browser for SQLite and review the Package and related tables.
• msiinfo (msitools) or Orca to read the summary information of cached .msi files, which reveals the original product name.

Investigation tips

• Hunt for remote access and tunneling tools (AnyDesk, ScreenConnect, Atera, TeamViewer, NetSupport, ngrok) and compare against your software baseline. See the remote access tools page.
• InstallSource under \Downloads\, \Temp\ or a drive letter that maps to a mounted image shows how the installer arrived.
• Per-user installs in HKCU need no admin rights, which is why they are popular with attackers and why each profile's NTUSER.DAT must be checked.
• A cached .msi in C:\Windows\Installer without a matching Uninstall key points to a removed product; its $MFT dates and summary info tell you what and when.
• MSI custom actions run as SYSTEM for per-machine installs; pair install time with new services, kernel drivers and scheduled tasks created in the same minute.
• For evidence of execution of the installed product, move to Prefetch, Amcache file entries and BAM.