AmCache-EvilHunter: Automating Evidence of Execution Extraction from the Amcache.hve Artifact - Souza, Cristian H. M.; Chavarro, Eduardo O.; Batista, Daniel M. (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
Digital Forensics and Incident Response (DFIR) investigations frequently rely on native Windows artifacts to identify evidence of execution, reconstruct attacker activity, and generate indicators of compromise. Among these artifacts, Amcache.hve is especially valuable because it stores metadata about executables, installed applications, drivers, and shortcuts (such as file paths, timestamps, publisher information, and SHA-1 hashes). However, manually inspecting Amcache data can be time-consuming during incident response, especially when analysts need to filter large numbers of records and quickly verify suspicious hashes against threat intelligence sources. This paper presents AmCache-EvilHunter, an open-source command-line tool that parses Windows Amcache.hve registry hives, extracts relevant execution-related metadata, identifies suspicious executable names, filters records, and integrates Kaspersky OpenTIP and VirusTotal lookups. The tool was designed to reduce repetitive analysis tasks and support faster triage during real-world investigations.