2026-04-25 23:16 UTC
While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to.
We didn't figure out why this happens, but Velociraptor is the perfect tool for digging in deeper
https://thinkdfir.com/2026/04/25/trust-but-verify-amcaches-originalfilename-field-isnt-always-accurate/ #DFIR
Replies (1)
-
@Ichinin@infosec.exchange 2026-04-26 04:34
@Phillmoore@infosec.exchange The PE itself didn’t have an OriginalFileName, so Amcache sometimes would populate the value from somewhere else. 🤦♂️