..
    generated, remove this comment to keep this file

``amcache``
===========

.. code-block:: console

    $ target-query <path/to/target> -f amcache


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``dissect.target.plugins.os.windows.amcache.AmcachePlugin``
    * - Output
      - ``records``

**Module documentation**

Appcompat plugin for amcache.hve.

Supported registry keys for old version of Amcache:
    * File
    * Programs

Supported registry keys for new version of Amcache:
    * InventoryDriverBinary
    * InventoryDeviceContainer
    * InventoryApplication
    * InventoryApplicationFile
    * InventoryApplicationShortcut

References:
    - https://binaryforay.blogspot.com/2015/04/appcompatcache-changes-in-windows-10.html
    - https://cyber.gouv.fr/sites/default/files/2019/01/anssi-coriin_2019-analysis_amcache.pdf
    - https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/

**Function documentation**


This is a namespace plugin. This means that by running this plugin, it will automatically run
all other plugins under this namespace:

- :doc:`/plugins/amcache.applaunches`
- :doc:`/plugins/amcache.application_files`
- :doc:`/plugins/amcache.applications`
- :doc:`/plugins/amcache.device_containers`
- :doc:`/plugins/amcache.drivers`
- :doc:`/plugins/amcache.files`
- :doc:`/plugins/amcache.general`
- :doc:`/plugins/amcache.programs`
- :doc:`/plugins/amcache.shortcuts`