Amcache
Executables Windows has inventoried, with full path, SHA-1, publisher and version.
Use it to get a program's full path and SHA-1, even after the file has gone, to check against threat intelligence.
- Amcache.hve
- Program Execution
What It Is
Amcache is a hive of its own, the file Amcache.hve, which Windows keeps for application compatibility. In it Windows records the programs and drivers it has inventoried, with each file's full path, its SHA-1 hash (a fingerprint of the file's contents), its publisher and its version. Because the hash stays after the file is deleted, an investigator can check a program against threat intelligence long after it has gone. It is not part of the live Registry that regedit shows, so it is read from a copy of the file.
What It Proves
A file with that path and SHA-1 was on the system and Windows recorded it. The hash lets you check it against threat intelligence after the file has gone.
What It Does Not Prove
Being listed does not prove the file ran, because Windows also records files it finds when it scans installed programs. The key's last write time is when the entry was written, not a run time, and the SHA-1 covers only the first 30 MB of a file.
Where It Lives
Amcache lives in Amcache.hve, a hive file of its own that is not part of the live Registry tree regedit shows. It has no path on a running machine, so collect the file and open it offline. The line under the path is where the hive file sits on disk.
Amcache.hve\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Windows recorded procdump64 |
| Drop the four leading zeros and this is the file's SHA-1. Search it in threat intelligence and EDR process data, even with the stick long gone. |
| This is the compile time from the file's header, stored in US date order, so it reads 2 Oct 2026 11:04. A known tool built that recently is unusual, so compare it with the vendor's own release. |
How to Read It
Open Root\InventoryApplicationFile, where each subkey is one file with values such as LowerCaseLongPath and FileId. FileId is the SHA-1 with four leading zeros, so drop them before you look it up. Treat the subkey's last write time as when Windows recorded the file, not when it ran.
- When Windows Writes It
- Windows writes it when it inventories programs, at install, after programs run and during scheduled compatibility scans.
- Which Windows Versions
- Windows 7 to 11 keep it. Newer builds use InventoryApplicationFile in place of the older Root\File.
- Tools That Parse It
- AmcacheParser, Registry Explorer, RegRipper (amcache)
Hunt It
Amcache is a hive file that no event log copies, so the live tools match its SHA-1 against process creation records to show whether the file really ran. Velociraptor reads Amcache.hve in place on each endpoint, so the hashes come back without collecting the file.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, and matches the hash to real process starts. Drop the device line to search every device. Defender does not read Amcache.
// Did the Amcache SHA-1 run? Search process starts for the hashDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Amcache shows.
- ShimCacheIt confirms the file sat at that path from a separate record, with its modified time.
- BAMIt shows the program ran, which user ran it and when, where Amcache shows only that the file was there.
- Prefetch FilesNot in the RegistryThey show the program ran, and when, which an Amcache entry alone does not prove.
Sources
The facts on this page come from these public pages, which say more on each point.