thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Amcache

A Windows registry hive (Amcache.hve) that records information about executables present or run on the system, including SHA-1 hashes.

Definition

Amcache stores file paths, SHA-1 hashes, publisher data and timestamps for programs, helping identify malware even after deletion. Along with ShimCache (AppCompatCache), it supports evidence of program presence and execution, though interpretation varies by Windows version.

Example

Finding the SHA-1 of a deleted attacker tool in Amcache and matching it on VirusTotal.

Exam tip

Amcache provides hashes; ShimCache provides paths and order but not reliable execution proof.

Related terms