11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist

11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist

Quick Answer: Proving program execution—rather than mere file presence—is critical in malware investigations and incident response. Windows records execution across multiple complementary artifacts: Prefetch files (C:\Windows\Prefetch\*.pf) record run count, up to 8 last execution timestamps (in Windows 10/11 versions 30/31, compressed with MAM LZ77), and all loaded DLLs within the first 10 seconds. Shimcache (AppCompatCache) in the SYSTEM hive tracks up to 1,024 binaries and their $STANDARD_INFORMATION Last Modified timestamps; it resides in csrss.exe memory during runtime and only flushes to disk upon clean shutdown. Amcache.hve provides the SHA-1 file hash of executed binaries and PE header compile dates, persisting even if the binary was deleted. Finally, UserAssist (NTUSER.DAT) captures GUI executions obfuscated via ROT13, while BAM/DAM (SYSTEM\...\Services\bam) provides kernel-level execution timestamps mapped directly to the executing User SID.

---

Windows Program Execution Artifact Matrix

When investigating an intrusion, determining whether a malicious binary, script, or dual-use tool (e.g., mimikatz.exe, psexec.exe, powershell.exe) actually executed is essential. Windows implements multiple subsystems that record execution data for memory management, application compatibility, and system optimization:

+---------------------------------------------------------------------------------------------------------+
|                                 WINDOWS EXECUTION ARTIFACT COMPARISON                                   |
+---------------------------------------------------------------------------------------------------------+
| Artifact        | Storage Location                    | Exec Timestamps  | Hash Recorded? | User Attributed?    |
|-----------------|-------------------------------------|------------------|----------------|---------------------|
| **Prefetch**    | C:\Windows\Prefetch\*.pf            | Up to 8 (Win10+) | No (CRC-32 Path)| No (System-wide)   |
| **Shimcache**   | SYSTEM hive (AppCompatCache)        | File Mod Time    | No             | No (System-wide)    |
| **Amcache**     | C:\Windows\appcompat\Programs\...   | First Exec/Install| SHA-1 Hash     | No (System-wide)    |
| **UserAssist**  | NTUSER.DAT (Explorer\UserAssist)    | 1 Last Execution | No             | Yes (Specific User) |
| **BAM / DAM**   | SYSTEM hive (Services\bam\State...)  | 1 Last Execution | No             | Yes (User SID)      |
+---------------------------------------------------------------------------------------------------------+

---

Prefetch Forensics: SuperFetch, Formatting & Compression

The Windows Cache Manager and Task Scheduler monitor program launches through the SuperFetch (renamed SysMain in Windows 10) service. The primary architectural objective of Prefetching is to minimize disk latency by loading contiguous memory pages into RAM during the first 10 seconds of application execution.

Enablement and Configuration

Prefetch behavior is governed by the SYSTEM registry hive: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher

• 0 = Disabled (often set by default on Windows Server platforms to reduce I/O).
• 1 = Application prefetching enabled (user programs only).
• 2 = Boot prefetching enabled (boot processes only).
• 3 = Both Application and Boot prefetching enabled (standard default on Windows client operating systems).

File Naming Convention & Path Hashing

Prefetch files reside in %SystemRoot%\Prefetch\ (typically C:\Windows\Prefetch\) and adhere to the strict naming convention: [EXECUTABLE_NAME]-[CRC32_HASH].pf

Example: CMD.EXE-4A81B364.pf
         MIMIKATZ.EXE-B7A1C92E.pf
         SVCHOST.EXE-36A4F98E.pf

• The name is constructed from the first 29 characters of the executable filename followed by an 8-character hexadecimal string.
• The 8-character string is a CRC-32-based hash of the complete Unicode file path from which the binary was launched.
• If the binary is launched with specific command-line switches (specifically /prefetch:1 through /prefetch:8), the switch parameter is factored into the hash algorithm. This is why multiple svchost.exe or dllhost.exe Prefetch files exist simultaneously on disk.
• Forensic Utility: If CALC.EXE-A1B2C3D4.pf and CALC.EXE-E5F60718.pf both exist, the calculator executable was launched from two distinct directory paths (e.g., C:\Windows\System32\ versus a suspicious staging directory like C:\Users\Public\).

Version Progression and Header Formats

The binary layout of .pf files has evolved across Windows releases:

• Version 17: Windows XP and Windows Server 2003 (stores 1 execution timestamp).
• Version 23: Windows Vista and Windows 7 (stores 1 execution timestamp).
• Version 26: Windows 8 and Windows 8.1 (stores 8 execution timestamps in a circular array).
• Version 30: Windows 10 (Builds 1507, 1511) - incorporates MAM LZ77 compression; stores 8 timestamps.
• Version 31: Windows 10 (Build 1607+) and Windows 11 - incorporates MAM LZ77 compression; stores 8 timestamps.

MAM LZ77 Compression Mechanics

Prefetch files on Windows 10 and Windows 11 are compressed using a proprietary variant of the LZ77 compression algorithm.

• When viewing raw bytes in a hex editor, a compressed .pf file begins with the ASCII magic header bytes: 0x4D 0x41 0x4D 0x04 (MAM\x04).
• Following the 4-byte signature is a 4-byte uncompressed file size field followed by the raw LZ77-compressed data streams.
• Forensic parsing utilities (e.g., Eric Zimmerman's PECmd) automatically decompress the MAM stream in memory before parsing the underlying Version 30/31 binary structure.

Evidentiary Values Extracted from Prefetch

When fully parsed, a Prefetch file reveals four critical forensic dimensions:

1. Run Count: Total number of times the executable has been run on that system.
2. Execution Timestamps (Up to 8): Windows 10/11 maintains an array of the last 8 execution dates and times (in 64-bit UTC FILETIME). The most recent execution corresponds to index 0.
3. Volume Information: Serial number, volume creation date, and directory path of the storage volume hosting the executable.
4. Loaded File and Directory Dependencies: An exhaustive list of every dynamic-link library (.dll), configuration file, icon, and directory accessed by the executable during its first 10 seconds of runtime.

# Example PECmd Analysis Command Line
PECmd.exe -f "C:\Windows\Prefetch\CMD.EXE-4A81B364.pf" --json "C:\forensic_temp\"

[!TIP] Dependency listing is invaluable when investigating "Living off the Land" (LotL) attacks. If an attacker uses rundll32.exe, parsing RUNDLL32.EXE-[HASH].pf reveals the exact malicious DLL loaded from the file dependency block, exposing malware that would otherwise blend into native Windows processes.

---

Shimcache (AppCompatCache) Forensics

The Application Compatibility Cache (Shimcache), internally designated as AppCompatCache, is part of the Microsoft Windows Application Compatibility infrastructure. Microsoft introduced shimming to allow older legacy applications to execute on newer Windows kernels without code refactoring.

Location and Volatile Architecture

• Registry Key: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache (or SYSTEM\CurrentControlSet\Control\Session Manager\Environment on older systems).
• The In-Memory Caching Dilemma: During normal operating system execution, the active Shimcache is held exclusively in the volatile memory space of the Client/Server Runtime Subsystem (csrss.exe).
  • Updates are not written to the SYSTEM registry hive in real time.
  • The in-memory cache is committed and flushed to the SYSTEM hive on disk only upon a clean system reboot or controlled shutdown.
  • Forensic Implication: If an investigator seizes a live machine and immediately pulls the power cord (hard shutdown), all executions that occurred during that active session will be absent from the on-disk SYSTEM hive. In such cases, Shimcache must be extracted from volatile RAM dumps using tools like Volatility (vol.py -f mem.raw windows.shimcache).

Binary Format & Timestamp Characteristics

Shimcache records up to 1,024 entries on modern Windows endpoints. For each binary, it tracks:

• Full Path: Absolute file system path to the executable.
• File Size: Size of the file in bytes.
• $STANDARD_INFORMATION Last Modified Timestamp:

  [!IMPORTANT] A common forensic mistake is assuming the timestamp in Shimcache represents the execution time. It does not. The timestamp recorded in Shimcache is the $STANDARD_INFORMATION Last Modified timestamp of the target executable at the moment it was examined by the AppCompat engine.

• Execution Flag:
  • In Windows 7, a discrete 1-byte flag (0x01 = Executed, 0x00 = Not executed/Cataloged) proved execution.
  • In Windows 8, 10, and 11, the execution flag was removed. However, research proves that in Windows 10/11, entries are placed in Shimcache only when an execution attempt occurs. The entries are ordered chronologically from top to bottom (most recent at the top), providing an execution timeline sequence.

# Example AppCompatCacheParser Command Line
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Export" --dt "yyyy-MM-dd HH:mm:ss"

---

Amcache (Amcache.hve) Forensics: The Cryptographic Hash Repository

Windows 8 introduced Amcache.hve as the architectural successor to RecentFileCache.bcf. It is one of the most powerful execution artifacts available because it captures cryptographic file hashes of executed programs.

File Location & Hive Format

Amcache.hve is located in %SystemRoot%\appcompat\Programs\Amcache.hve.

• Structurally, Amcache.hve is a standard Windows Registry hive. It can be opened with hive viewers or parsed using automated forensic tools.
• It has companion transaction logs: Amcache.hve.LOG1 and Amcache.hve.LOG2, which must be merged for complete analysis.

Forensic Significance: SHA-1 Hashing

When a binary executes, Windows inspects the executable to determine if application shims are required. As part of this process, the OS calculates and stores the SHA-1 cryptographic hash of the first 30 MB of the binary.

Amcache.hve (Root)
  └── Root
      └── File\<Volume GUID>\<File Reference ID>
            ├── 100 : Target Executable Full Path
            ├── 101 : SHA-1 Hash (Prefixed with 0000)
            ├── 102 : File Size
            ├── f   : PE Compile TimeDateStamp
            └── 15  : First Execution / Installation Timestamp

Crucial Metadata Extracted from Amcache

• SHA-1 Hash: Enables immediate, retrospective threat intelligence queries against VirusTotal, MalwareBazaar, and internal SIEMs, even if the adversary wiped the malicious binary from the hard drive.
• PE Header Compile Timestamp (TimeDateStamp): Reveals when the binary was compiled by the developer, assisting in campaign attribution and identifying stomped/manipulated headers.
• Full File Path & Drive Association: Proves where the malware was staged.
• Application Metadata: Product name, internal company name, file version, and file description extracted from the binary's version information resource block.

# Parsing Amcache with Eric Zimmerman's AmcacheParser
AmcacheParser.exe -f "C:\Windows\appcompat\Programs\Amcache.hve" --csv "C:\Cases\Amcache_Output"

---

UserAssist Forensics: Interactive GUI Executions

While Prefetch, Shimcache, and Amcache provide system-wide execution tracking, UserAssist links program execution directly to a specific interactive user account.

Registry Keys & ROT13 Encryption

UserAssist keys reside within each user's profile hive: %UserProfile%\NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

Microsoft utilizes the ROT13 Caesar substitution cipher (rotating characters by 13 positions) to obfuscate subkey value names. For example, P:\Jvaqbjf\flfgrz32\pzq.rkr translates to C:\Windows\system32\cmd.exe.

+-------------------------------------------------------------------------+
|                        USERASSIST GUID IDENTIFIERS                      |
+-------------------------------------------------------------------------+
| GUID                                  | Scope of Artifact Tracked       |
|---------------------------------------|---------------------------------|
| {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}| Executable Applications (.exe)  |
| {F4E57C4B-2038-45F0-AE0E-A58D0F716EBF}| Shortcuts (.lnk) & UWP Apps     |
+-------------------------------------------------------------------------+

The UserAssist Binary Data Structure (72 Bytes in Win 7/10/11)

The binary value associated with each ROT13-encoded application name contains 72 bytes of rich behavioral telemetry:

+-------------------------------------------------------------------------+
|                  USERASSIST BINARY DATA STRUCTURE (72 BYTES)            |
+-------------------------------------------------------------------------+
| Offset      | Data Type | Forensic Metric Tracked                       |
|-------------|-----------|-----------------------------------------------|
| 0x04 - 0x07 | 32-bit int| Total Execution (Run) Count                   |
| 0x08 - 0x0B | 32-bit int| Application Focus Count (Number of times user |
|             |           | brought the window to the foreground)         |
| 0x0C - 0x0F | 32-bit int| Total Focus Time (Active interactive duration |
|             |           | in milliseconds)                              |
| 0x3C - 0x43 | 64-bit int| Last Execution Timestamp (Windows FILETIME)   |
+-------------------------------------------------------------------------+

Investigative Value and Constraints

• GUI Execution Specificity: UserAssist tracks executions initiated through the Windows Explorer Graphical User Interface (e.g., double-clicking a desktop icon, launching from the Start Menu, or running via File Explorer).
• Limitation: Executions spawned purely from the command line (CLI), batch scripts, PowerShell sessions, or scheduled tasks/services do not generate UserAssist entries.

---

BAM & DAM (Background & Desktop Activity Moderator)

Introduced in Windows 10 Fall Creators Update (Version 1709), the Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) are kernel-mode drivers (bam.sys, dam.sys) deployed to optimize battery and process utilization.

Registry Key Paths

• SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<User_SID>
• SYSTEM\CurrentControlSet\Services\dam\State\UserSettings\<User_SID>

Forensic Utility

• Each entry under the user's SID subkey represents an executable with its full file path.
• The registry value data contains a single 64-bit Windows FILETIME timestamp representing the exact date and time the executable was last run.
• Attribution Advantage: BAM/DAM records executions at the kernel level and maps the execution directly to the executing user's Security Identifier (SID), successfully bridging the gap between system-wide artifacts (Prefetch/Shimcache) and user attribution.