amcache csv · prefetch csv · cross-reference gaps · selective deletion · timestamp conflicts · sha1 threat intel · runs locally
sources
drop amcache csv · prefetch csv
or click
IN_AMCACHE_NOT_PREFETCH = prefetch selectively deleted · IN_PREFETCH_NOT_AMCACHE = amcache cleared or network/removable execution
drop amcache csv (AmcacheParser) · prefetch csv (PECmd or listing)