What is Shimcache (AppCompatCache)? (glossary)
Shimcache (also called AppCompatCache) is the kernel-maintained cache that records up to 1024 PE binaries the Windows loader has touched, with file path, modification timestamp, and an execution flag. It lives as a single binary value inside the SYSTEM hive. Older than Amcache. Smaller. Sparser. Constantly confused with Amcache, and the confusion produces wrong findings.
The headline distinctions: Shimcache is shorter, hashless, kernel-maintained, and flushed on shutdown. Amcache is longer, hash-bearing, user-mode-maintained, and written continuously.
Shimcache vs Amcache#
| Shimcache | Amcache | |
|---|---|---|
| Storage | SYSTEM hive, single binary value | Standalone Amcache.hve |
| Maintainer | Kernel loader | User-mode scheduled task (appraiser) |
| Max entries | 1024 (LRU) | Effectively unbounded |
| Hash | None | SHA-1 of first 31 MiB |
| Publisher / version | None | Yes |
ProgramId |
None | Yes |
| Fresh on live system | No (need shutdown or memory) | Yes |
| Available pre-Win-8 | Yes (since XP) | No |
| Cadence on Server | Active | Often very slow |
For full coverage, see Amcache vs Shimcache.
When Shimcache wins#
- "Did the loader touch this binary?" Shimcache's whole job.
- Memory-only acquisitions. Volatility's
shimcachememextracts cleanly from a RAM dump. - Pre-Win-10-1709 hosts where the modern Amcache schema isn't there yet.
- Hardened hosts with the appraiser disabled. Shimcache is kernel-maintained; the appraiser being off doesn't affect it.
When Amcache wins#
- Hashes for VirusTotal. Shimcache can't help.
- Cross-host hunts. Shimcache has no hash and no
ProgramId, only paths. - Driver and device evidence. Shimcache is userspace PE only.
- Triage on a live system. Amcache is current on disk; Shimcache is stale until reboot.
Use both#
Always. They corroborate each other:
- In both: strong "present and touched by loader" finding.
- Shimcache only: loader touched it but the appraiser hasn't gotten to it, or the appraiser is off.
- Amcache only: present but the loader hasn't touched it in the current 1024-entry window, or Shimcache rolled over.
Related terms#
Related posts
- What's the difference between Amcache and AppCompatCache?
Amcache is rich, appraiser-maintained, with hashes. AppCompatCache (Shimcache) is sparse, kernel-maintained, with paths and a modify timestamp. Use both. The gaps between them are information.
- What is SRUM (SRUDB.dat)? (glossary)
SRUM is the ESE database Windows uses to track per-application resource usage by hour over 30-60 days. The only Windows artefact with per-app network-byte totals. Critical for exfil.
- What is Amcache ProgramId? (glossary)
ProgramId is the 44-character application-identity hash Amcache stores. Stable across hosts for the same install. Catches re-compiles and renames where Hash misses.
- What is Windows Prefetch? (glossary)
Windows Prefetch is the directory of .pf files that proves execution. Up to 8-10 run times per binary plus the files loaded in the first ten seconds. The strongest Windows execution evidence.