Amcache.hve

A registry hive recording programs the system has encountered, and one of very few artifacts that stores a hash. When a binary has been deleted, the SHA-1 here is often the only way to identify what it was.

windows · Execution · T1204

where it lives

C:\Windows\AppCompat\Programs\Amcache.hve

Windows 8 through 11

InventoryApplicationFile holds the per-binary entries on Windows 10 and later.

what it proves

  • A binary was present at a given path
  • Its SHA-1 — computed over the first 31.4 MB, which matters when you compare against a threat-intel hash of the whole file
  • Compilation timestamp and file version metadata
  • Frequently, the publisher and whether it was signed

what it does not prove

  • Execution, despite being widely cited as an execution artifact — presence is what it records
  • A whole-file hash for anything over 31.4 MB
  • Timing precise enough to sequence an intrusion on its own

parsing it

  • AmcacheParser (Eric Zimmerman)
  • RegRipper

tampering and anti-forensics

The hive is large and actively written, so selective tampering is hard to do cleanly. Its presence of a hash for a file the attacker later deleted is the reason it is worth pulling early.

how long it survives

Long — often the full life of the installation.

read next

shimcache · prefetch

Corrections are welcome and this is a working document, if your estate behaves differently, that is a finding worth having. Say so in the community.