Posts tagged "sha1"

• Amcache FileId explained: the SHA-1 hash format Windows stores

  A deep dive on Amcache's FileId field — why it starts with 0000, why it's a SHA-1 of the first 31 MiB, how to use it for VirusTotal lookups, and the traps that mislead analysts.

  2026-05-24