Amcache.hve.

A Windows registry hive that records detailed metadata about every executable that has run or been present on a system, including SHA-1 hashes, providing strong execution evidence on modern Windows. It belongs to the Forensics & IR category of cybersecurity.

A Windows registry hive that records detailed metadata about every executable that has run or been present on a system, including SHA-1 hashes, providing strong execution evidence on modern Windows.

Amcache.hve, located in C:\Windows\AppCompat\Programs\, is a registry hive populated by the Application Experience service. It stores rich metadata about executables, drivers, and installed programs, including full path, file size, PE compile time, last-modified time, publisher, and a SHA-1 hash of the first 31 MB of the binary. On Windows 8 and later, Amcache effectively superseded Shimcache as the primary program-execution artifact because it captures samples even when they were merely scanned, not necessarily launched. Investigators use AmcacheParser (Eric Zimmerman) to extract InventoryApplicationFile entries, then hash-match against threat intelligence to identify malware that has long since been deleted.

Defences for Amcache.hve typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Amcache, AppCompat Amcache.