Windows registry artifactAppCompatCache
AKA ShimCache, data is only written to this value at reboot by winlogon.exe
- Program Execution
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMAppCompatCacheControlSet00*\Control\Session Manager\AppCompatCacheAKA ShimCache, data is only written to this value at reboot by winlogon.exe
References
8 links
- github.comAppCompatCache plugin(opens in new tab)
- medium.com/@bromiley/windows-wednesday-shim-cache-1997ba8b13e7(opens in new tab)
- youtube.com/watch?v=ZKlyu-HOvxY(opens in new tab)
- fireeye.com/blog/threat-research/2015/06/caching_out_the_val.html(opens in new tab)
- andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/(opens in new tab)
- sans.org/blog/mass-triage-part-4-processing-returned-files-appcache-shimcache/(opens in new tab)
- countuponsecurity.com/tag/shimcache/(opens in new tab)
- techcommunity.microsoft.com/t5/ask-the-performance-team/demystifying-shims-or-using-the-app-compat-toolkit-to-make-your/ba-p/374947(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)