> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/resources-1/windows-logs-automation/amcache.hve.md).

# amcache.hve

## Description

Tool used: **AmcacheParser**

{% embed url="<https://f001.backblazeb2.com/file/EricZimmermanTools/net6/AmcacheParser.zip>" %}

The **Amcache.hve** file is essentially a registry hive that logs details about applications that have been executed on a system. It is typically found at `C:\Windows\AppCompat\Programas\Amcache.hve`.

This file is notable for storing records of recently executed processes, including the paths to the executable files and their SHA1 hashes. This information is invaluable for tracking the activity of applications on a system.

To extract and analyze the data from **Amcache.hve**, the [**AmcacheParser**](https://github.com/EricZimmerman/AmcacheParser) tool can be used. The following command is an example of how to use AmcacheParser to parse the contents of the **Amcache.hve** file and output the results in CSV format:

```
AmcacheParser.exe -f C:\Users\genericUser\Desktop\Amcache.hve --csv temp
```

Among the generated CSV files, the `Amcache_Unassociated file entries` is particularly noteworthy due to the rich information it provides about unassociated file entries.

The most interesting CVS file generated is the `Amcache_Unassociated file entries`.

## Results

Processed files were generated in the temp folder.

<figure><img src="https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWd-VcvRHVgUtkahm85%2Fuploads%2FPhPxCwusT8RN4W2gT7BD%2Fimage.png?alt=media&amp;token=9cbfec28-5d86-4a79-8377-3ca6f51415a0" alt=""><figcaption></figcaption></figure>

Now, import these files into the Timeline Explorer.

After that, perform a recursive "find" or sort the artifacts by date or other.

<figure><img src="https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWd-VcvRHVgUtkahm85%2Fuploads%2FmSx40F2EsIVWiYAa3X3G%2Fimage.png?alt=media&amp;token=d2a10a71-a1c8-49f1-bca4-b3a9e2042612" alt=""><figcaption></figcaption></figure>

Thats it! :sushi:

## Reference

{% embed url="<https://book.hacktricks.xyz/generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics#amcache>" %}