PCA Forensics Cheat Sheet

What it is

The Program Compatibility Assistant (service PcaSvc) watches programs as they start and exit so it can offer compatibility fixes. Two families of traces result:

Since Windows 11 version 22H2, PcaSvc writes plain-text logs in C:\Windows\appcompat\pca\, including a dictionary of launched executables with their last execution time in UTC.
On older versions (and still today), it records executables it has examined under the AppCompatFlags\Compatibility Assistant registry key of the user.

The Windows 11 files are one of the few simple, human-readable execution artifacts on modern Windows.

Location

Windows version	Location	Content
11 22H2 and later	`C:\Windows\appcompat\pca\PcaAppLaunchDic.txt`	`path
11 22H2 and later	`C:\Windows\appcompat\pca\PcaGeneralDb0.txt`, `PcaGeneralDb1.txt`	Event records (errors, abnormal exits), UTF-16LE
8 / 10 / 11	`NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store`	One value per executable path
7	`NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted`	One value per executable path
All	`...\AppCompatFlags\Layers` (NTUSER.DAT and SOFTWARE)	Compatibility-mode settings per executable (for example `RUNASADMIN`)

What it proves

PcaAppLaunchDic.txt: an executable at that path was launched and when it last ran (UTC).
Only launches that go through the graphical shell are recorded. Research by Sygnia found that programs started from a command line, a scheduled task or remotely with PsExec are not registered, while launches inside an RDP session are.
PcaGeneralDb*.txt: abnormal exits, installer failures and blocked drivers, with product and company metadata; a crashing implant or a failed installer can show up here.
Compatibility Assistant\Store: the executable was examined by PCA for that user; treat it as presence with user attribution, and corroborate execution.

Key fields

PcaAppLaunchDic.txt: <full path>|<YYYY-MM-DD HH:MM:SS.fff>

PcaGeneralDb0.txt / PcaGeneralDb1.txt (pipe-delimited):

Field	Meaning
Timestamp	Event time, UTC
Record type	0 installer failed, 1 driver blocked, 2 abnormal process exit, 3 PCA resolve called, 4 unknown
Path	Executable path (user names are partly redacted by Windows as `%USERNAME%` or `x` characters)
Product name, company, version	From the PE version information
Program ID	Identifier also used in Amcache
Exit code / message	Detail of the event

Registry Store key: value name = executable path; value data = binary compatibility data (format not publicly documented in full).

Timestamps

Timestamp	Set when	Format	Pitfalls
Last execution (`PcaAppLaunchDic.txt`)	Each GUI launch of the executable	Text, UTC	Only the latest run is kept per path
Record time (`PcaGeneralDb*.txt`)	The PCA event occurs	Text, UTC	Records describe errors and exits, not every launch
`Store` key LastWrite	A value is added or updated	FILETIME, UTC	Shared by every value in the key

Retention and clearing

PcaAppLaunchDic.txt keeps one line per executable path, updated in place.
PcaGeneralDb0.txt is the active log until it reaches about 2 MB, then PcaGeneralDb1.txt takes over, so roughly two to four megabytes of history are available.
The files are plain text and easy to edit or delete by an administrator; compare with the USN journal for deletions.

Collection

KAPE target: AppCompatPCA (the whole appcompat\pca folder); add RegistryHivesUser for the registry keys.
Velociraptor (Windows.Triage.Targets): AppCompatPCA and RegistryHivesUser.
Built-in:

robocopy C:\Windows\appcompat\pca E:\case\pca /COPY:DAT
type C:\Windows\appcompat\pca\PcaAppLaunchDic.txt

Parsing tools

Any text editor, or import into Timeline Explorer / a spreadsheet with | as the delimiter (open the PcaGeneralDb files as UTF-16).
Registry Explorer or RegRipper (appcompatflags plugin) for the Compatibility Assistant and Layers keys.

Investigation tips

Filter PcaAppLaunchDic.txt on user-writable paths (\Downloads\, \AppData\, \Users\Public\) and removable-drive letters.
Because it records GUI launches only, a tool present in Prefetch but missing from PCA was probably started from a script, service or remote session.
Use record type 2 (abnormal exit) in PcaGeneralDb to spot crashing malware or tools killed by security software.
On Windows 10 and earlier, fall back to the Store key together with BAM/DAM and UserAssist for user-level execution.
A Layers value forcing RUNASADMIN on an unusual binary is worth explaining.

Program Compatibility Assistant (PCA)

Tools