Amcache.hve — Application Inventory

When an executable runs on a modern Windows system, the operating system records not just its path but its SHA-1 hash, file size, publisher name, and PE compile timestamp in a dedicated registry hive. Amcache.hve is the artifact that answers the question Shimcache cannot: not just where a file existed, but exactly which binary it was.

What Is Amcache.hve?

Amcache.hve is a standalone Windows registry hive located at C:\Windows\AppCompat\Programs\Amcache.hve. Introduced in Windows 8 as a replacement for the earlier RecentFileCache.bcf file, Amcache serves as an application inventory database that Windows uses to track installed and executed programs for compatibility telemetry, application usage reporting, and the Program Compatibility Assistant (PCA).

Unlike Shimcache, which stores only a file path and last-modified timestamp, Amcache records rich metadata about each executable: the SHA-1 hash of the file, the full path, file size, publisher name (from the PE version information), PE compile timestamp (the TimeDateStamp from the PE header), binary type (32-bit or 64-bit), and a first execution timestamp derived from the registry key’s last-write time. This level of detail makes Amcache one of the most valuable execution artifacts in Windows forensics.

The hive is structured around two primary key paths that have changed across Windows versions. On Windows 8 through early Windows 10 builds, application file entries were stored under Root\File\{VolumeGUID}\ with volume GUID subkeys. Starting with Windows 10 Creator’s Update (1703), the primary key shifted to Root\InventoryApplicationFile\, which uses a different naming convention and field layout. Both structures are forensically valuable, and modern parsing tools handle both transparently.

Location & Format

File Path

Key Structure by OS Version

Key Fields — InventoryApplicationFile

What It Reveals

Amcache answers investigative questions that no other single artifact can address. Its combination of hash, path, publisher, and timestamp data makes it uniquely powerful for attribution and tool identification:

• What is the exact identity of the executable? — The SHA-1 hash uniquely identifies the binary, enabling direct lookup in VirusTotal, malware repositories, and threat intelligence platforms.
• Who published the binary? — The Publisher field reveals the developer. Offensive tools often show no publisher, a fabricated name, or the actual author (e.g., “gentilkiwi” for mimikatz).
• When was the binary compiled? — The LinkDate PE compile timestamp reveals when the binary was built. A compile time of hours before deployment suggests a custom build targeting this victim.
• What specific version was used? — The Version and ProductName fields identify the exact release, which matters for understanding the attacker’s specific capabilities.
• When was the tool first executed? — The registry key’s LastWriteTime approximates first execution, providing a timestamp for initial use on the system.
• Was the binary renamed to evade detection? — If ProductName says “mimikatz” but the file path shows svchost.exe, the attacker renamed the binary to masquerade as a legitimate process (T1036).

Forensic Use Cases

1. Malware Identification via Hash

An endpoint detection system quarantines a suspicious file, but the original binary is deleted during remediation before the investigator can collect it. Amcache retains the SHA-1 hash, file size, publisher, and compile time. The hash is submitted to VirusTotal, which returns a 58/72 detection rate identifying the file as a Cobalt Strike stager. The compile time is 6 hours before the initial compromise timestamp, suggesting the payload was custom-built for this operation.

2. Proving Specific Tool Version

In an insider threat investigation, the subject claims they “only used built-in Windows tools.” Amcache shows entries for rclone.exe (Version: 1.65.2, Publisher: https://rclone.org) and WinSCP.exe (Version: 6.1.2, Publisher: Martin Prikryl) with first-execution timestamps during the exfiltration window. The SHA-1 hashes confirm these are official releases and the version numbers enable the investigator to research exact capabilities available to the subject.

3. Detecting Masquerading

An attacker renames their credential harvesting tool to WindowsUpdate.exe and places it in C:\ProgramData\. Shimcache records only the deceptive path, but Amcache records both the path and the PE metadata. The ProductName field reads “mimikatz” and the Publisher field reads “gentilkiwi (Benjamin DELPY)” — immediately revealing the true identity despite the filename masquerade.

4. Correlating with Threat Intelligence

Amcache SHA-1 hashes can be bulk-extracted and submitted to threat intelligence platforms for automated enrichment. A batch query against VirusTotal, MISP, or a commercial TI feed can instantly classify every executable that ran on the system as benign, suspicious, or known-malicious — dramatically accelerating triage during a large-scale incident.

5. Establishing Execution Timeline

By extracting the LastWriteTime of each Amcache key, investigators build a timeline of first-execution events. Combined with Shimcache ordering, Prefetch timestamps, and Event Log process creation events (4688), this creates a comprehensive picture of which tools were deployed in what order — essential for kill chain reconstruction.

Acquisition Methods

Live System — Volume Shadow Copy

:: Create a Volume Shadow Copy
vssadmin create shadow /for=C:

:: Copy Amcache.hve from the shadow (bypasses file lock)
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Windows\AppCompat\Programs\Amcache.hve C:\Evidence\

:: Copy transaction logs
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Windows\AppCompat\Programs\Amcache.hve.LOG* C:\Evidence\

:: Alternative: KAPE targeted collection
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target Amcache

Forensic Image — Direct Extraction

# Mount forensic image read-only
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Copy Amcache.hve and transaction logs
cp /mnt/evidence/Windows/AppCompat/Programs/Amcache.hve /analysis/amcache/
cp /mnt/evidence/Windows/AppCompat/Programs/Amcache.hve.LOG* /analysis/amcache/

Parsing Tools & Analysis

Parsing with AmcacheParser

:: Parse Amcache.hve to CSV
AmcacheParser.exe -f C:\Evidence\Amcache.hve --csv C:\Analysis\Amcache_Output

:: Output files:
::   Amcache_UnassociatedFileEntries.csv
::   Amcache_AssociatedFileEntries.csv
::   Amcache_ProgramEntries.csv
::   Amcache_DevicePnPEntries.csv

:: Include deleted entries from transaction logs
AmcacheParser.exe -f C:\Evidence\Amcache.hve --csv C:\Analysis\ -i

Analysis Script — Automated Hash Lookup

# Extract SHA-1 hashes and filter for suspicious entries

import pandas as pd

df = pd.read_csv('/analysis/amcache/Amcache_UnassociatedFileEntries.csv')

# Strip leading 0000 prefix from FileId to get clean SHA-1
df['SHA1_Clean'] = df['SHA1'].str.replace('^0000', '', regex=True)

# Filter for executables in suspicious locations
suspicious = df[
    df['FullPath'].str.contains(
        r'Temp|ProgramData|Public|Perflogs|Recycle',
        case=False, na=False
    )
]

print(f"Suspicious entries: {len(suspicious)}")
print(suspicious[['FullPath', 'Publisher', 'SHA1_Clean']].to_string())

Sample Output

Suspicious entries: 3
   FullPath                                                Publisher                          SHA1_Clean
   c:\users\jdoe\appdata\local\temp\windowsupdate.exe      gentilkiwi (Benjamin DELPY)        a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
   c:\programdata\microsoft\crypto\beacon.dll               (empty)                            d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
   c:\perflogs\procdump64.exe                               Sysinternals - www.sysinternals.com  f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1

Retention & Persistence

Anti-Forensics Resilience

Amcache.hve resides in a system directory and is locked during normal operation, making it resistant to casual cleanup. However, it is more accessible than the SYSTEM hive because it is a standalone file rather than a core OS hive.

MITRE ATT&CK Detection Mapping

Amcache data provides evidentiary support for detecting the following MITRE ATT&CK techniques:

Related Artifacts & Cross-Correlation

References

1. Eric Zimmerman, “AmcacheParser” — https://ericzimmerman.github.io/
2. ANSSI (French National Cybersecurity Agency), “Amcache Analysis” — https://www.ssi.gouv.fr
3. SANS Institute, “Amcache.hve in Windows 10” — https://www.sans.org/blog/
4. Harlan Carvey, “RegRipper” — https://github.com/keydet89/RegRipper3.0
5. 13Cubed, “Amcache.hve Deep Dive” — https://www.13cubed.com/blog
6. Microsoft, “Application Compatibility Infrastructure” — https://learn.microsoft.com
7. Yogesh Khatri, “Amcache.hve — Part 2” — https://www.swiftforensics.com
8. ForensicArtifacts.com, “Windows Amcache Definition” — https://github.com/ForensicArtifacts/artifacts