ShimCache (AppCompatCache)

What it is

The Application Compatibility Cache, usually called ShimCache, is kept by the Windows compatibility engine to decide quickly whether an executable needs a compatibility shim. Each entry records a file path and that file's last-modification time. The cache lives in kernel memory and is serialized into the SYSTEM hive, which makes it a long-lived record of executables the system has encountered, including files that no longer exist.

Location

On a live system the path starts with HKLM\SYSTEM\CurrentControlSet; in an offline hive read the Select key to find which ControlSet00x was current (see control set). Every control set can hold its own copy.

What it proves

• Presence: a file existed at that path, with that modification time, when the compatibility engine evaluated it.
• Execution, version-dependent: on Windows 7 and 8 an entry carries a flag set when the process was actually created, so parsers can show "Executed". On Windows 10 and 11 no such flag is exposed by the common parsers, and entries are also added when Explorer merely displays or inspects executables. Treat an entry as "seen", not "run", unless another artifact confirms execution.
• Order: entries are stored most recent first, so relative position gives a rough sequence even when no execution time exists.
• It does not record the user, the run count or the execution time.

Key fields

Timestamps

Retention and clearing

• The cache is written to the registry at shutdown or reboot. On a system that has not restarted since the incident, the newest entries exist only in memory: acquire RAM (or hiberfil.sys) to get them.
• When the limit is reached the oldest entries are evicted.
• Modifying a file (new mtime) updates its entry and moves it to the top.
• A cleared or truncated cache with recent LastWrite is suspicious; compare control sets and shadow copies of the SYSTEM hive.

Collection

• KAPE target: RegistryHivesSystem (SYSTEM with transaction logs)
• Velociraptor (Windows.Triage.Targets): RegistryHivesSystem
• Built-in (administrator):

reg save HKLM\SYSTEM E:\case\SYSTEM.hiv

reg save exports the live hive, which still contains only the last flushed cache.

Parsing tools

• AppCompatCacheParser (Eric Zimmerman): AppCompatCacheParser.exe -f SYSTEM --csv E:\out. All control sets are extracted by default (-c selects one); without -f it reads the live registry; --nl ignores transaction logs.
• ShimCacheParser (Mandiant, open source): parses hives, exported .reg files and memory output.
• RegRipper: appcompatcache plugin.
• Velociraptor: Windows.Registry.AppCompatCache on live endpoints.
• Volatility: the shimcache plugins read the in-memory cache that has not been flushed yet.

Investigation tips

• Search for tools and payloads in user-writable locations and for known attacker file names; ShimCache often keeps them long after the files and their Prefetch are gone.
• Use the position of a known-good executable with a known run time to bracket when a suspicious neighbour entry was added.
• A last-modified time older than the file's creation on disk, or an unusual round value, can indicate timestomping.
• Always confirm execution on Windows 10/11 with Amcache, BAM/DAM, Prefetch or process-creation events.
• Parse every ControlSet00x and shadow-copy SYSTEM hive: older copies can contain entries evicted from the current cache.