Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

PCA (Program Compatibility Assistant)

The Program Compatibility Assistant (PCA) is a Windows service (PcaSvc) that monitors launched applications and detects compatibility issues with legacy software. PCA has existed since Windows Vista, but starting with Windows 11 version 22H2, the service writes execution data to plain-text files on disk. These files provide direct evidence of program execution with full file paths and UTC timestamps, making PCA one of the most straightforward execution artifacts available on modern Windows systems.

Windows 11 22H2+ only. The text-based PCA artifacts described on this page do not exist on Windows 10 or earlier Windows 11 builds. If you are investigating a system running anything older, this artifact will not be present.

Location

C:\Windows\appcompat\pca\PcaAppLaunchDic.txt
C:\Windows\appcompat\pca\PcaGeneralDb0.txt
C:\Windows\appcompat\pca\PcaGeneralDb1.txt

The PCA service must be running for these files to be populated. Verify with:

sc query pcasvc

If the service is stopped or disabled, no new entries will be written.

PcaAppLaunchDic.txt

This is the most forensically useful file. It is an ANSI-encoded (CP-1252) text file with Windows line endings (CRLF). Each line maps an executable's file path to its last execution time, separated by a pipe character:

executable_path|YYYY-MM-DD HH:MM:SS.fff

Example entries:

%systemroot%\folder\malware.exe|2025-11-15 09:42:11.000
%userprofile%\downloads\setup.exe|2025-11-14 14:33:07.123

Key characteristics:

  • Timestamps are UTC.

  • Paths are normalized: drive letter prefixes are removed, and some path components are replaced with environment variables (%systemroot%, %userprofile%, etc.). System-wide environment variables can be resolved, but user-specific variables require knowing which user profile was involved.

  • Paths are lowercased.

  • One entry per executable. If the same executable runs multiple times, only the most recent execution timestamp is retained.

  • Any executable format can appear here, including .exe, .scr, .msi, and others.

  • Entries persist after file deletion. Even if the original executable is removed from disk, the PCA entry remains. This is useful for detecting cleaned-up malware or deleted attacker tools.

PcaGeneralDb0.txt and PcaGeneralDb1.txt

These companion files store additional detail about application compatibility events, including runtime duration, run status, executable path, and a ProgramId value that can be correlated with Amcache entries.

The two files operate on a rotation system:

  1. PcaGeneralDb0.txt starts as the primary (active) file.

  2. New records are written to the primary file until it reaches 2 MB.

  3. When the primary file hits 2 MB, the secondary file is cleared and becomes the new primary.

  4. This cycle repeats, meaning between 2 and 4 MB of historical data is available at any given time.

The ProgramId field in these files matches the ProgramId value in Amcache InventoryApplicationFile entries, allowing you to link PCA execution evidence directly to Amcache metadata (SHA1 hash, publisher, version info).

What PCA Tracks

PCA primarily tracks GUI-based program execution. This includes:

  • Executables launched by double-clicking in Explorer.

  • Programs run from local folders, removable media, and network shares.

  • CLI programs launched from the GUI (e.g., running cmd.exe or powershell.exe by double-clicking).

What PCA Does NOT Track

  • Programs launched purely from the command line (e.g., typing a command in an existing cmd.exe or PowerShell session).

  • Services starting automatically.

  • Scheduled task executions (unless they involve GUI interaction).

  • Background processes spawned by other applications.

This scope is similar to UserAssist in that it focuses on GUI-driven execution. For command-line and background process evidence, use BAM/DAM, Prefetch, or event logs.

Why PCA Matters for DFIR

It survives common anti-forensic cleanup. Most attacker cleanup playbooks target well-known artifacts like Prefetch, LNK files, and recent items. PCA files are less widely known and are often left behind simply because the attacker doesn't know they exist. A C:\Windows\appcompat\pca\ directory sitting untouched while Prefetch has been wiped is a strong lead.

It fills gaps when other artifacts are inconclusive. Prefetch can be noisy on busy systems with retention limits. ShimCache can't prove execution on Windows 10/11. Amcache doesn't prove execution on its own. PCA provides a clear, timestamped record of execution that can resolve ambiguity when other artifacts are equivocal.

Plain text, easy to parse. No binary format, no special tools required. You can read PcaAppLaunchDic.txt with type, cat, or any text editor. This makes it useful for quick triage.

Analyzing PCA

Quick Triage (Live System)

Parsing PcaAppLaunchDic.txt

Since the format is simple pipe-delimited text, it can be parsed with PowerShell, Python, or any scripting language:

What to Look For

  • Executables in temp directories, Downloads folders, Recycle Bin paths, or C:\PerfLogs.

  • Known attacker tool names: mimikatz, psexec, procdump, rubeus, sharphound, lazagne.

  • Executables with suspicious names or paths that no longer exist on disk (deleted after execution).

  • Timestamps that align with known intrusion timeframes.

  • Entries for executables launched from removable media or network shares, visible via UNC-style or drive-letter paths.

Correlating with Amcache

To link PCA entries with Amcache metadata:

  1. Parse PcaGeneralDb0.txt (or Db1) and extract the ProgramId for entries of interest.

  2. Parse Amcache.hve with AmcacheParser.

  3. Match the ProgramId from PCA against the ProgramId field in InventoryApplicationFile entries.

  4. The matched Amcache entry provides the SHA1 hash, publisher, version, binary type, and full path, giving you a complete picture of the executed file.

Artifact Correlation

  • Amcache: ProgramId correlation (see above). Amcache provides file hashes that PCA does not.

  • Prefetch: Corroborate PCA execution timestamps with Prefetch run times. If both agree, execution confidence is very high.

  • ShimCache: Confirms file presence at the recorded path. Adds the file's $SI last modified timestamp.

  • UserAssist: Both track GUI-based execution. UserAssist adds run count and focus time data.

  • BAM/DAM: Provides user-SID-attributed execution timestamps for background processes that PCA may miss.

  • Zone.Identifier: If the executed file was downloaded, the Zone.Identifier ADS may reveal where it came from.

  • Event Logs: Sysmon Event ID 1 or Security Event ID 4688 provide command-line arguments and parent process information that PCA does not capture.

Tools

  • Velociraptor: Has dedicated PCA artifacts for collecting and parsing PCA files across endpoints at scale.

  • KAPE: Targets for collecting PCA files from the appcompat\pca directory.

  • Any text editor or CLI tool: The files are plain text. type, cat, grep, findstr, or PowerShell can parse them directly without special tooling.

  • Timeline Explorer (Eric Zimmerman): Import parsed CSV output for filtering and timeline analysis.

Anti-Forensics Considerations

  • File deletion: An attacker with admin or SYSTEM privileges could delete the PCA files from C:\Windows\appcompat\pca\. This would be unusual and suspicious behavior.

  • Service disabling: Stopping or disabling the PcaSvc service prevents new entries from being written. Check the service state during triage.

  • PcaGeneralDb rotation: Because the GeneralDb files rotate at 2 MB, older entries are naturally lost over time. On a busy system, historical data in these files may only cover a limited time window.

  • PcaAppLaunchDic.txt overwrite: Since only the most recent execution timestamp per executable is retained, repeated execution of a legitimate program at the same path overwrites the timestamp of a previous malicious execution at that path. However, this requires the attacker to know the exact path of a previous entry.

  • VSS recovery: Previous versions of the PCA files may be recoverable from Volume Shadow Copies.

References

Previous.lnk FilesNextPersistence

Last updated