What is ShimCache (AppCompatCache)? (glossary)
ShimCache (also called AppCompatCache) is a kernel-maintained
binary cache in the SYSTEM registry hive that records up to
1024 PE binaries the Windows loader has touched, with the
file path, a modification timestamp, and an execution flag.
It is older than Amcache, smaller than Amcache, and answers a different but overlapping question. Confusing the two produces wrong findings.
ShimCache vs Amcache#
| ShimCache | Amcache | |
|---|---|---|
| Storage | SYSTEM hive, binary value |
Amcache.hve |
| Maintainer | Kernel loader | User-mode scheduled task |
| Max entries | 1024 | Effectively unbounded |
| Records hash? | No | Yes (SHA-1) |
| Records publisher / version? | No | Yes |
Records ProgramId? |
No | Yes |
| Fresh on live system? | No (need shutdown) | Yes |
| Available pre-Windows 8 | Yes | No (Amcache is Win 8+) |
| Updated by | Loader touches | Appraiser scans |
For full coverage, see Amcache vs ShimCache.
When ShimCache wins#
- Kernel-touch evidence. ShimCache records loader touches more aggressively than Amcache records presence.
- Memory-only acquisitions. Volatility's
shimcachememplugin extracts ShimCache cleanly from RAM. - Hardened hosts with appraiser disabled. ShimCache is maintained by the kernel; it persists even when the appraiser is off.
- Pre-Windows 10 1709. The modern Amcache schema only landed in 1709; ShimCache has been there since Windows XP.
When Amcache wins#
- Hashes for VirusTotal. ShimCache has no hash. Amcache has SHA-1.
- Cross-host hunts. ShimCache has no ProgramId, no hash, just paths.
- Driver / device evidence. ShimCache is PE-only. Amcache has separate driver and device schemas.
- Long-window retention. ShimCache rolls over at 1024 entries; Amcache holds thousands.
For the broader execution-evidence comparison, see Amcache vs Prefetch.
Related terms#
- Amcache.hve — the modern inventory artefact.
- Prefetch — the execution-evidence artefact.
- InventoryApplicationFile — the Amcache equivalent to ShimCache's main blob.
Related posts
- Amcache vs ShimCache: when each artefact wins
ShimCache and Amcache both record binaries that touched a Windows host. They are different mechanisms with different limits — here is when to use each, and what their overlap actually proves.
- What's the difference between Amcache and AppCompatCache?
Amcache is a richer, appraiser-maintained registry hive with hashes and metadata. AppCompatCache (ShimCache) is a smaller, loader-maintained registry blob with paths and timestamps only.
- What is SRUM (SRUDB.dat)? (glossary)
SRUM is the Windows System Resource Usage Monitor — an ESE database recording per-application CPU, network, and I/O usage in hour buckets over 30-60 days.
- What is Amcache ProgramId? (glossary)
ProgramId is the 44-character application-identity hash Amcache assigns to each logical application. The same ProgramId on different hosts means the same application install.