analyzing-windows-amcache-artifacts
CommunityExtract Amcache forensics artifacts.
Data & Analytics#windows-forensics#timeline-analysis#amcache#program-execution#forensics-parsing#registry-hive#sha1-correlation
AuthorAxxxxxxaaann
Version1.0.0
Installs0
System Documentation
What problem does it solve?
This skill helps investigators reconstruct program execution, installation history, and driver activity from the Windows Amcache.hve registry data to support DFIR investigations.
Core Features & Use Cases
- Parse the Amcache.hve hive to collect file entries, program metadata, and device/driver information using AmcacheParser and Timeline Explorer.
- Correlate SHA-1 hashes with threat intelligence sources to identify known-bad or unknown binaries.
- Build a comprehensive timeline of application execution, installation, and driver loading across systems for incident response validation.
Quick Start
Run Amcache.hve analysis on the mounted hive to output parsed file, program, and driver data for timeline reconstruction.
Dependency Matrix
Required Modules
regipy
Components
scripts
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: analyzing-windows-amcache-artifacts Download link: https://github.com/Axxxxxxaaann/KAIRI-Skills/archive/main.zip#analyzing-windows-amcache-artifacts Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.