Services and Applications

Shows Windows Activities Cache application activity, operation times, status, payloads, and provenance.

Shows Amcache driver names, paths, hashes, versions, vendors, sizes, compilation times, and registry metadata.

Lists driver hashes, names, versions, vendors, sizes, and compilation metadata from Amcache XML reports.

Shows Amcache executable file paths, hashes, sizes, versions, vendors, timestamps, programs, and registry metadata.

Lists Internet Explorer add-on identifiers, names, types, and publishers from Amcache XML reports.

Lists installed software, installation times, hashes, versions, vendors, and file metadata from Amcache XML reports.

Shows Amcache installed programs with names, versions, publishers, install dates, paths, and MSI identifiers.

Lists installed programs and executable hashes, paths, versions, vendors, and run evidence from AEINV_PREVIOUS.

Lists installed programs and executable hashes, paths, versions, vendors, and run evidence from FullCompatReport.

Lists installed programs and executable hashes, paths, versions, vendors, and run evidence from AEINV WER reports.

Shows AppCompatCache executable paths, file modification times, cache flags, and registry metadata.

Shows BAM and DAM executable execution evidence with user SIDs, run times, paths, and registry metadata.

Shows DLLs loaded by running processes with process IDs, command lines, module paths, base addresses, and sizes.

Shows per-user MUI cache executable paths and display descriptions with registry ownership and timestamps.

Shows Windows Prefetch execution evidence with executable names, run counts, last-run times, loaded files, and volumes.

Shows ORC process records with names, paths, command lines, IDs, parent IDs, sessions, and timestamps.

Shows ORC process records with identity, ancestry, command lines, users, timestamps, resource use, and status.

Shows Windows RecentApps launch counts and access times plus recently used file paths and arguments.

Shows commands entered in the Windows Run dialog with MRU order, user ownership, and registry timestamps.

Shows installed application-compatibility shim databases with GUIDs, target paths, install times, and registry metadata.

Shows per-application focus, input, audio, network, and duration statistics recorded by Windows SRUM.

Shows per-application CPU, I/O, foreground, and background resource usage over time from Windows SRUM.

Preserves opaque per-application SRUM energy-estimation records with application, user, and timestamp context.

Shows Windows Server SRUM processor time with application, user, and timestamp context.

Shows Subject Interface Packages with GUIDs, names, DLL paths, entry points, owners, and registry timestamps.

Shows per-user program execution counts, focus metrics, launch types, last-run times, and registry provenance.