In an approach for detecting one or more applications in a VM, one or more processors establish a time duration. One or more processors detect two or more files, each file in the two or more files having a time stamp time that differs from a last modified time stamp time of at least one other file in the two or more files by no more than the time duration. One or more processors record an identifier for each file of the two or more files, a location, a name, and a last modified time stamp time of each file of the two or more files. One or more processors map the two or more files to an application installed on the VM.