Posts tagged "shimcache"

• What is ShimCache (AppCompatCache)? (glossary)

  ShimCache is a kernel-maintained cache in the SYSTEM registry hive recording up to 1024 binaries the Windows loader has touched. Different from Amcache.

  2026-05-24

• Amcache vs ShimCache: when each artefact wins

  ShimCache and Amcache both record binaries that touched a Windows host. They are different mechanisms with different limits — here is when to use each, and what their overlap actually proves.

  2026-05-24

• What's the difference between Amcache and AppCompatCache?

  Amcache is a richer, appraiser-maintained registry hive with hashes and metadata. AppCompatCache (ShimCache) is a smaller, loader-maintained registry blob with paths and timestamps only.

  2026-05-24