Skip to content
No uploadAmcache.hve, parsed on your machine

Amcache Parser: every program Windows ever inventoried

Online Amcache parser for Windows Amcache.hve registry hives. Runs entirely in your browser via WebAssembly — nothing is uploaded.

  • Rust → WebAssembly
  • Files never leave the browser
  • ZIP & KAPE collections
  • CSV / JSON export

Looking for Eric Zimmerman's AmcacheParser CLI? Read the complete guide →

Drop Amcache.hve here or click to choose a fileAmcache.hve · folder · ZIP collectionSample: a synthetic Amcache.hve from a fictional intrusion (host FIN-WKS-07). No real data. Tip: open m64.exe and centre the time range on it (±5 min) to isolate the intrusion.

100% client-side. The file is read in memory and never sent to a server.

How to get your data

Full collection guide →
  1. CollectRun one command below
  2. DropThe file, folder or ZIP here
  3. Stay privateNothing leaves your browser
recommended

Live Windows 8+ host · PowerShell run as administrator · nothing to install (built-in esentutl)

PowerShell (Admin): hive + logs via a shadow copy
$d = "C:\triage\amcache-$(Get-Date -Format yyyyMMdd-HHmmss)"
New-Item -ItemType Directory -Force -Path $d | Out-Null
foreach ($f in 'Amcache.hve','Amcache.hve.LOG1','Amcache.hve.LOG2') {
  esentutl.exe /y /vss "C:\Windows\AppCompat\Programs\$f" /d "$d\$f"
}
Invoke-Item $d

Copies Amcache.hve, .LOG1 and .LOG2 through a Volume Shadow Copy (the live file is locked) into a new C:\triage\amcache-… folder, then opens it in Explorer. Drag that folder, or just Amcache.hve, onto the drop zone.

Gotchas

  • Run as administrator. A plain copy or Explorer copy of the live hive fails (file in use) or yields an empty or all-zero file, which the drop zone reports as “All zeros”. Use the shadow-copy command or a triage tool.
  • .LOG1 / .LOG2 are recognized but not replayed here. If the hive is dirty, the newest entries may be missing: replay the logs first (rla.exe, Registry Explorer), then drop the hive.
  • Windows 7 / Server 2008 R2 has no Amcache.hve: RecentFileCache.bcf is a different format, not parsed here.
Built for triage

From hive to answer in one drop

Amcache records what landed on a Windows host: path, size, publisher, PE link date and a SHA-1 for each executable. The parser turns it into something you can hunt through.

  • SHA-1 pivots

    Every file entry's FileId is decoded to a clean SHA-1 with one-click VirusTotal and MalwareBazaar lookups.

  • File ↔ program correlation

    InventoryApplicationFile is joined to InventoryApplication through ProgramId, so orphaned executables stand out as “unassociated”.

  • Risk hints

    Unsigned PEs, executables under Temp, AppData, ProgramData or Users\Public and unsigned drivers are flagged for a first pass.

  • Timeline view

    Sort any category by key last-write time to rebuild when software arrived, next to link dates and install dates.

  • Triage collections

    Drop a KAPE or Velociraptor ZIP, or a whole folder: the Amcache hives inside are found for you, and anything skipped is explained.

  • Saved sessions

    Your analysis is auto-saved in this browser (IndexedDB). Name sessions, reopen them later — still nothing leaves the machine.

What's inside

The categories Amcache keeps

  1. InventoryApplicationFileExecutables seen on disk: full path, SHA-1, size, publisher, version, PE link date.
  2. InventoryApplicationInstalled programs: name, publisher, version, install date, uninstall string.
  3. InventoryDriverBinaryKernel drivers with signing status, hash and timestamps — useful for BYOVD hunts.
  4. InventoryDevicePnpPlug-and-play devices, including USB storage that was connected to the host.
  5. InventoryApplicationShortcutStart-menu shortcuts that point to installed programs.
  6. File / Programs (Windows 8)The legacy schema of early Amcache versions, parsed with the same pivots.
How it works

Three steps, zero uploads

  1. 01

    Collect

    Copy Amcache.hve with its .LOG files (KAPE, Velociraptor, FTK Imager or a VSS copy).

  2. 02

    Drop

    Drop the hive, a folder or a ZIP collection. The WebAssembly parser runs in a worker, in memory.

  3. 03

    Hunt

    Filter, sort, pivot on hashes, then export CSV or JSON for your timeline.

Related tools

Artifacts that answer the next question in the same case.

Questions analysts ask

Does Amcache prove a program was executed?

Not on its own. Since Windows 10 Amcache is an inventory: it proves a file was present and scanned. Corroborate execution with Prefetch, ShimCache, SRUM or event logs.

Is my Amcache.hve uploaded anywhere?

No. The file is read by a WebAssembly parser inside your browser tab. Saved sessions are stored in your browser's IndexedDB and never sent to a server.

Can I drop a KAPE or Velociraptor collection?

Yes. Drop the ZIP or the extracted folder: every Amcache.hve inside is parsed, and other files are listed with the reason they were skipped.

What about the .LOG1 / .LOG2 files?

They are recognized but not replayed. If the hive is dirty, replay the transaction logs first (for example with rla.exe) or the newest entries may be missing.

How does this compare to Eric Zimmerman's AmcacheParser?

The columns follow AmcacheParser's CSV output, so exports line up with existing workflows. This tool adds in-browser filtering, risk hints and hash pivots without installing anything.

Open your Amcache.hve now

No account, no install, no upload.

Drop a hive