AmcacheParser

AmcacheParser.exe -f Amcache.hve --csv <out>

Parse the Amcache.hve with AmcacheParser, obtaining the inventory of programs executed and installed on the system.

Run it when you need to know which programs were executed on the system: the Amcache.hve (the system's database) records the executables that were launched — with their path, hash, size, and first execution. It's the go-to execution artifact when prefetch is disabled or rotated: the attacker's payload, tools, and installers show up in the Amcache. In IR, Amcache answers 'what binaries were executed on this system?' with the list of programs — the payload in Temp, the dumping tool, the ransomware installer.

Don't use it as a complete execution log: Amcache covers executables that go through the mechanism that feeds it — binaries loaded in memory or scripts (PowerShell, cmd) don't always show up. Amcache retention is limited (it gets pruned over time): old events are lost. And watch out for performance and parsing: the Amcache.hve in use is copied first (KAPE); locked files give errors. For timeline correlation, Amcache timestamps are cross-referenced with MFT and prefetch — discrepancies reveal timestamp manipulation.