SOFTWARE Hive Viewer
The SOFTWARE hive holds machine-wide Windows configuration — installed programs, network history, scheduled tasks, and a large slice of the persistence surface. This online SOFTWARE hive viewer reads it in your browser, free, with nothing to install and nothing uploaded.
Open the explorer and drop the SOFTWARE hive in — load SYSTEM and NTUSER.DAT alongside it to correlate across the machine.
What you can read from the SOFTWARE hive
- Installed software — the Uninstall keys, with versions and install dates.
- Network history — every network the machine joined, with first/last connect.
- Persistence — machine Run keys, scheduled tasks (TaskCache), Winlogon, AppInit DLLs.
- User mapping — ProfileList, tying SIDs to usernames.
Dig into the detail with the deep-dives on installed software, NetworkList, scheduled tasks and Winlogon.
Frequently asked questions
- How do I open the SOFTWARE hive?
- Acquire it from C:\Windows\System32\config\SOFTWARE (from an image or offline disk — it is locked on a live system), then drop it into the viewer. It is parsed locally in your browser.
- What does the SOFTWARE hive contain?
- Machine-wide configuration: installed programs (Uninstall keys), network profiles, scheduled tasks (TaskCache), Winlogon settings, machine Run keys, and user-profile mappings (ProfileList) — much of the system's persistence surface.
- Where is the SOFTWARE hive located?
- C:\Windows\System32\config\SOFTWARE, with its .LOG1/.LOG2 transaction logs alongside it — grab those too so you read the current state.
- Is the hive uploaded anywhere?
- No. The SOFTWARE hive is parsed entirely client-side via WebAssembly and never leaves your machine.