Evidence of Execution: Prefetch, Amcache, BAM and More

"Did this program run?" is one of the most common questions in an investigation, and one of the easiest to answer wrongly. Many Windows artifacts record executables, but they do not all mean the same thing. Some prove a process was created, some prove a user launched something through the GUI, and some only prove that a file existed at a path. This guide covers the artifacts that matter, what each truly proves, what its timestamp means, and how to combine them into a conclusion you can defend.

Existence versus execution

Keep three levels of claim separate:

1. Presence: a file existed at a path (ShimCache on Windows 10+, Amcache alone, $MFT).
2. Execution: a process was created from that file (Prefetch, BAM, 4688, Sysmon 1, SRUM, WER).
3. Attributed execution: a specific user ran it at a specific time (BAM per SID, UserAssist, MUICache, 4688 with the subject account).

The evidence of execution glossary entry summarises the idea. Your report should say which level each finding reaches. "The binary existed" and "user jdoe executed the binary at 14:07 UTC" are very different conclusions.

Prefetch

Prefetch files live in C:\Windows\Prefetch as <EXENAME>-<HASH>.pf. Windows creates one when a program is executed, traces the files it loads during its first seconds, and updates it on later runs. That makes Prefetch the strongest single file-based indicator of execution on workstations.

Each file records:

• The executable name and a hash of its path (for hosting processes such as svchost.exe, dllhost.exe or rundll32.exe, the command line also feeds the hash, so several .pf files per name are normal)
• A run count
• The last run time on XP and 7, and up to eight last run times on Windows 8 and later
• The files and directories referenced at launch, which often expose a payload or a staging folder

The .pf file's own creation time is a good approximation of the first run, within about ten seconds. Windows 10 and 11 compress Prefetch files (MAM format), so PECmd must run on Windows 8 or later to decompress them.

Caveats: Prefetch is enabled by default on workstations but disabled by default on Windows Server. Check EnablePrefetcher under SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters (0 = disabled, 3 = applications and boot) rather than assuming. The store holds 128 entries on XP and 7 and 1,024 on Windows 8 and later; old entries roll off.

# Parse the whole Prefetch directory to CSV (plus a per-run timeline CSV)
PECmd.exe -d C:\Windows\Prefetch --csv .\out --csvf prefetch.csv

# Parse a single file, verbose output
PECmd.exe -f C:\Windows\Prefetch\CALC.EXE-DEADBEEF.pf

# Search a triage folder for Prefetch mentioning a keyword
PECmd.exe -d D:\triage\C\Windows\Prefetch -k "temp,public" --csv .\out

ShimCache (AppCompatCache)

The Application Compatibility Cache lives in the SYSTEM hive under ControlSet00x\Control\Session Manager\AppCompatCache. The compatibility engine uses it to decide whether an executable needs a shim. See the ShimCache cheat sheet.

What it gives you:

• The full path of the executable, even after deletion
• The file's last-modified time, copied from its $STANDARD_INFORMATION attribute. This is not a run time
• The entry order: position 0 is the most recently inserted or updated entry, which gives a rough sequence

On Windows 10 and 11, ShimCache does not prove execution. Entries are added when Explorer or another process inspects an executable, for example when a folder is displayed, and the common parsers expose no execution flag on these versions. Some research suggests that a value in the entry data may correlate with execution on recent builds; treat that as corroboration at best until it is widely validated. On Windows 7 and 8 an insert flag set on process creation makes an entry better evidence of execution.

The cache is held in memory and written to the registry at shutdown or reboot. On a machine that has not restarted since the incident, the newest entries exist only in RAM or hiberfil.sys.

# Parse an exported SYSTEM hive (all control sets)
AppCompatCacheParser.exe -f D:\triage\C\Windows\System32\config\SYSTEM --csv .\out --csvf shimcache.csv

# Parse the live system's cache
AppCompatCacheParser.exe --csv .\out --csvf shimcache_live.csv

Amcache

C:\Windows\AppCompat\Programs\Amcache.hve is a standalone registry hive maintained by the Application Experience inventory tasks. It catalogues executables, installed programs, drivers and devices. Its standout feature is the SHA-1 hash of each inventoried file, which survives the deletion of the binary. See the Amcache cheat sheet.

On Windows 10 and 11, Root\InventoryApplicationFile holds, per file:

• LowerCaseLongPath (full path) and Size
• FileId: 0000 followed by the SHA-1 (computed over the first 30 MB of large files)
• Name versus OriginalFileName: a renamed tool stands out
• LinkDate: the PE compile time, set by the developer and forgeable, not a run time
• Publisher, Version, ProgramId

The nuance: Amcache is written by inventory scans (the Microsoft Compatibility Appraiser and related tasks) as well as when programs run. Research such as ANSSI's 2019 analysis showed that entries appear for files that were never executed. So an Amcache entry alone proves presence, and the key's last write time means "inventoried by Windows at", which is often close to first execution but not guaranteed. On older Windows 8 and early Windows 10 builds (Root\File layout), entries correlate more closely with execution, but still corroborate.

# Parse Amcache (replay .LOG1/.LOG2 transaction logs if they sit alongside)
AmcacheParser.exe -f D:\triage\C\Windows\AppCompat\Programs\Amcache.hve --csv .\out -i

The -i switch includes file entries linked to installed programs, which are skipped by default.

BAM and DAM

The Background Activity Moderator, introduced in Windows 10 1709, stores the last execution time of executables per user SID in the SYSTEM hive, under Services\bam\State\UserSettings\<SID> (1809 and later) or Services\bam\UserSettings\<SID> (1709 to 1803). DAM keeps a similar list under Services\dam. See the BAM/DAM cheat sheet.

BAM is one of the few execution artifacts tied to a security identifier, which makes it excellent for attribution. Limits: it keeps only the last run, no run count, and entries older than about seven days are purged at boot. Paths use device notation (\Device\HarddiskVolume3\...), which you map to drive letters.

# Dump BAM with RECmd and the Kroll batch file (covers BAM, UserAssist, MUICache and more)
RECmd.exe -d D:\triage\C --bn .\BatchExamples\Kroll_Batch.reb --csv .\out --csvf registry.csv

UserAssist

UserAssist keys in each user's NTUSER.DAT, under Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count, record programs and shortcuts launched through the Explorer shell: Start menu, desktop, double-click. Value names are ROT13-encoded paths; data holds a run count, focus count, focus time and the last run time. The {CEBFF5CD-...} GUID tracks executables and {F4E57C4B-...} tracks shortcuts. See the UserAssist cheat sheet.

UserAssist proves GUI execution by that user. It does not record programs started from cmd.exe, PowerShell, services or scheduled tasks, so its absence proves little.

MUICache

MUICache, stored in UsrClass.dat under Local Settings\Software\Microsoft\Windows\Shell\MuiCache, keeps the FriendlyAppName and ApplicationCompany of executables whose display name the shell resolved, usually because the user ran them. It keeps the full path and survives deletion, but has no per-entry timestamp. Use it as supporting evidence tied to a user.

SRUM

The System Resource Usage Monitor database, C:\Windows\System32\sru\SRUDB.dat (Windows 8 and later), is an ESE database that records per-application, per-user resource usage: CPU time, bytes read and written, and network bytes sent and received. Records are written roughly hourly and typically retained for 30 to 60 days. See the SRUM cheat sheet.

A SRUM record proves the application was running during that interval and consumed resources, which is invaluable for exfiltration (an unknown process that sent 4 GB) and for programs whose other traces were wiped. The timestamp is the interval, not the launch time.

# Parse SRUM; the SOFTWARE hive resolves network interface names
SrumECmd.exe -f D:\triage\C\Windows\System32\sru\SRUDB.dat -r D:\triage\C\Windows\System32\config\SOFTWARE --csv .\out

Copy the database with its .log and .chk files; if it was not cleanly shut down, repair a copy with esentutl /r sru /i and esentutl /p before parsing, never the original.

Program Compatibility Assistant (Windows 11 22H2+)

Since Windows 11 22H2, the PCA service writes C:\Windows\appcompat\pca\PcaAppLaunchDic.txt: one line per executable, path|last execution time, in UTC. Research by Sygnia showed it records launches through the graphical shell (including inside RDP sessions) but not programs started from a command line, a scheduled task or PsExec. PcaGeneralDb0.txt and PcaGeneralDb1.txt add abnormal exits and installer failures. See the PCA cheat sheet.

Import-Csv C:\Windows\appcompat\pca\PcaAppLaunchDic.txt -Delimiter '|' -Header Path,LastRunUtc |
  Sort-Object LastRunUtc -Descending | Select-Object -First 30

Windows Error Reporting

Unstable implants, exploits and credential dumpers crash. When they do, Windows Error Reporting writes a Report.wer under C:\ProgramData\Microsoft\Windows\WER\ReportArchive or ReportQueue (and per-user equivalents), with AppPath, EventTime, loaded modules and, on many Windows 10+ reports, the SHA-1 in TargetAppId. Application event 1000 records the faulting process path and its start time. A crash report proves the program ran; its absence proves nothing.

Get-ChildItem C:\ProgramData\Microsoft\Windows\WER -Recurse -Filter Report.wer |
  Select-String -Pattern '^AppPath=' | Select-Object Path, Line

Event logs: 4688 and Sysmon 1

When enabled, logs give the richest execution records:

• Security 4688 (process creation) requires the "Audit Process Creation" policy. The command line is logged only if "Include command line in process creation events" is also enabled. It records the subject account, new process path, parent process and token elevation.
• Sysmon event 1 adds hashes, parent command line, ProcessGuid and integrity level.

Both are subject to log rollover and clearing. See the event logs cheat sheet and the event log forensics guide.

# Extract only process creation events
EvtxECmd.exe -f D:\triage\C\Windows\System32\winevt\Logs\Security.evtx --csv .\out --csvf 4688.csv --inc 4688
EvtxECmd.exe -f "D:\triage\C\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx" --csv .\out --csvf sysmon.csv --inc 1

Comparison table

Correlating the evidence

A typical chain: ShimCache and Amcache show C:\Users\Public\svch0st.exe existed, with an Amcache SHA-1 that matches threat intelligence. Prefetch confirms four runs and gives timestamps. BAM attributes the last run to the SID of a compromised account. SRUM shows the process sent 2.3 GB over the network in the following hour. The $MFT gives the file's creation time, and 4624 logons in the Security log explain how the account was used. Every step uses an independent source.

When Prefetch is disabled or wiped, lean on BAM, Amcache, PCA, SRUM and 4688. When logs are cleared, lean on the file-based artifacts. The anti-forensics guide covers how to spot deliberate gaps, and building a super timeline shows how to line all these sources up.

Pitfalls

• Reading the ShimCache time as a run time. It is the file's modification time, which timestomping can change.
• Treating Amcache or ShimCache presence as execution on Windows 10 and 11.
• Concluding "never ran" from missing Prefetch on a server, or after a cleaner emptied the folder.
• Ignoring hosting processes. rundll32.exe and svchost.exe Prefetch entries hide the real payload in the referenced files list.
• Missing the newest ShimCache entries because the host was never rebooted and memory was not captured.
• Forgetting BAM's seven-day window and the last-run-only design.
• Assuming UserAssist or PCA catch everything. Both miss command-line and remote execution.
• Mixing time zones. All these artifacts store UTC; some tools display local time by default.

Checklist

• Collect Prefetch, SYSTEM, SOFTWARE, every NTUSER.DAT and UsrClass.dat, Amcache.hve (with logs), SRUDB.dat, the pca folder, WER folders and event logs, including from shadow copies
• Confirm EnablePrefetcher and the audit policy before interpreting absences
• Parse with PECmd, AppCompatCacheParser, AmcacheParser, RECmd, SrumECmd and EvtxECmd
• For each suspicious binary, record presence, execution and attribution separately
• Check every hash from Amcache and WER against threat intelligence
• Corroborate each execution claim with at least two independent artifacts
• State timestamps in UTC and the meaning of each one in the report

Every artifact above has a one-page reference with locations per Windows version, linked from its section, plus RecentFileCache for Windows 7 and the printable artifact cheat sheet.