Forensic journey: hunting evil within AmCache

AmCache, formally known as Application Activity Cache, is a Windows forensic artefact that helps identify the execution of both benign and malicious software on a machine. It stores metadata for executables in Amcache[.]hve, which sits under C:\Windows\AppCompat\Programs, and records file paths, publisher data, compilation timestamps, file sizes and SHA-1 hashes.

The article notes that AmCache computes the SHA-1 hash only over the first 31,457,280 bytes of each executable, meaning the stored hash may not reflect the full file for larger binaries, and that AmCache is not a true execution log but rather records presence and certain execution-related data. Key AmCache entries include InventoryApplicationFile, InventoryApplication, InventoryDriverBinary and InventoryApplicationShortcut, with LastScanTime in InventoryApplication stored in Windows FileTime format.

A new tool, AmCache-EvilHunter, is introduced to parse Amcache[.]hve, extract IOCs and query threat intelligence feeds such as OpenTIP and VirusTotal to speed up threat detection. The article illustrates practical use cases, such as finding a deleted tool or spotting remote access software, and emphasises cross-referencing AmCache data with other artefacts to build accurate timelines.