amcache-forensic

Windows Amcache.hve forensic analyzer — reports inventoried executables (path, SHA-1, publisher) and devices with graded findings (unsigned binary in a system path, execution from a staging directory), plus the amcache4n6 CLI.