tl;dr

• Digging into windows registry to find process run counts.
• Extracting and parsing AmCache to find the hash of process images