@Phillmoore@infosec.exchange The PE itself didn’t have an OriginalFileName, so Amcache sometimes would populate the value from somewhere else. 🤦‍♂️