dissect.target.plugins.os.windows.amcache
¶
Module Contents¶
Classes¶
Appcompat plugin for amcache.hve. |
Functions¶
Attributes¶
- dissect.target.plugins.os.windows.amcache.AMCACHE_FILE_KEYS¶
- dissect.target.plugins.os.windows.amcache.AMCACHE_PROGRAM_KEYS¶
- dissect.target.plugins.os.windows.amcache.ShortcutAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.FileAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.ProgramsAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.ApplicationAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.ApplicationFileAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.BinaryAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.ContainerAppcompatRecord¶
- dissect.target.plugins.os.windows.amcache.AppLaunchAppcompatRecord¶
- class dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin¶
- __namespace__ = 'amcache'¶
- parse_file()¶
- parse_programs()¶
- programs()¶
Return Programs records from Amcache hive.
- files()¶
Return File records from Amcache hive.
- class dissect.target.plugins.os.windows.amcache.AmcachePlugin(target)¶
Bases:
AmcachePluginOldMixin
,dissect.target.plugin.Plugin
Appcompat plugin for amcache.hve.
Supported registry keys:
for old version of Amcache: * File * Programs
for new version of Amcache: • InventoryDriverBinary • InventoryDeviceContainer • InventoryApplication • InventoryApplicationFile * InventoryApplicationShortcut
References
https://binaryforay.blogspot.com/2015/04/appcompatcache-changes-in-windows-10.html https://www.ssi.gouv.fr/uploads/2019/01/anssi-coriin_2019-analysis_amcache.pdf https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/
- __namespace__ = 'amcache'¶
Defines the plugin namespace.
- amcache¶
- amcache_applaunch = False¶
- fpath¶
- check_compatible() None ¶
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- read_key_subkeys(key)¶
- parse_inventory_application()¶
Parse RootInventoryApplication registry key subkeys.
References
- parse_inventory_application_file()¶
Parse RootInventoryApplicationFile registry key subkeys.
References
- parse_inventory_driver_binary()¶
- parse_inventory_application_shortcut()¶
- parse_inventory_device_container()¶
- applications()¶
Return InventoryApplication records from Amcache hive.
Amcache is a registry hive that stores information about executed programs. The InventoryApplication key holds all application objects that are in cache.
References
- application_files()¶
Return InventoryApplicationFile records from Amcache hive.
Amcache is a registry hive that stores information about executed programs. The InventoryApplicationFile key holds the application files that are in cache.
References
- drivers()¶
Return InventoryDriverBinary records from Amcache hive.
Amcache is a registry hive that stores information about executed programs. The InventoryDriverBinary key holds the driver binaries that are in cache.
References
- shortcuts()¶
Return InventoryApplicationShortcut records from Amcache hive.
Amcache is a registry hive that stores information about executed programs. The InventoryApplicationShortcut field holds the shortcuts that are in cache. The key values contain information about the target of the lnk file.
References
- device_containers()¶
Return InventoryDeviceContainer records from Amcache hive.
Amcache is a registry hive that stores information about executed programs. The InventoryDeviceContainer key holds the device containers that are in cache. Example devices are bluetooth, printers, audio, etc.
References
- applaunches()¶
Return AppLaunchAppcompatRecord records from Amcache applaunch files (Windows 11 22H2 or later).
- TODO: Research C:WindowsappcompatpcaPcaGeneralDb0.txt and
C:WindowsappcompatpcaPcaGeneralDb1.txt files.
References
- dissect.target.plugins.os.windows.amcache.parse_win_datetime(value: str)¶
- dissect.target.plugins.os.windows.amcache.parse_win_timestamp(value: str)¶