AmCache

A Registry Hive that provides a wealth of info about programs executed on windows system:

• File name and path
• SHA1 hash
• First execution time Located at: C:\Windows\AppCompat\Programs\Amcache.hve

AmCache Parser

https://github.com/EricZimmerman/AmcacheParser