ShimCache (AppCompatCache)

Executables Windows checked for compatibility, with full path and file modified time.

Use it to show a file was on the system at that path, even after it was deleted, and when it was last changed.

SYSTEM
Program Execution

What It Is

ShimCache, also called AppCompatCache, is a list Windows keeps of executable files it has checked for compatibility with the running version of Windows. Each record holds the file's full path and its last modified time, and the list is in order, newest first. It is useful because it keeps a file's path even after the file has been deleted. It sits in the SYSTEM hive as one large binary value.

What It Proves

A file existed at that path, with that modified time, before the cache was last written. Its place in the list gives the order, newest first.

What It Does Not Prove

Being listed does not prove the file ran, and the time is the file's modified time, not a run time. Windows writes the cache to the hive only at shutdown, so the newest entries on a running machine are still in memory.

Where It Lives

ShimCache (AppCompatCache) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in ShimCache (AppCompatCache), each with what it tells you
Registry Value	What It Tells You
`AppCompatCache, entry 3` `REG_BINARYE:\tools\procdump64.exe`	procdump64.exe sat on the USB stick that was drive E when Windows cached it, with the executed flag set. The flag is a hint, not proof, so look for its Prefetch file.
`AppCompatCache, entry 9` `REG_BINARYC:\Windows\Temp\updsvc64.exe`	updsvc64.exe was in C:\Windows\Temp, last changed 12 Oct 2026 10:06 UTC, and it is the new service's binary. If the file is gone, Amcache may still hold its SHA-1.
`AppCompatCache, entry 10` `REG_BINARYC:\Users\alice\Downloads\psexec.exe`	psexec.exe was on disk in alice's Downloads, last changed 9 Oct 2026 14:02 UTC. Check Prefetch and BAM to see whether it ran.

How to Read It

Parse the single AppCompatCache value with a tool, because it is one block of a header followed by one record per file, newest first. Read each record's path and modified time. On Windows 10 and 11 an executed flag of 1 is a hint that the file ran, not proof. Compare the list with ShutdownTime, because the cache in the hive dates from that shutdown.

When Windows Writes It: Windows keeps it in memory while it runs and writes it to the hive at shutdown or restart.
Which Windows Versions: Windows XP to 11 keep it. The layout changes with the version, and since Windows 7 it holds up to 1024 entries.
Tools That Parse It: AppCompatCacheParser, Registry Explorer, RegRipper (appcompatcache)

Hunt It

ShimCache is a Registry value that is not in any event log, so the live tools can only test a cached path for a real start in process creation records. A hit there proves the file ran, and no hit does not rule it out. Velociraptor parses the cache from the live key on each endpoint.

Sees Related ActivityDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. A hit proves the cached path ran, and no hit does not rule it out, because the run may be older than your retention. The cache itself is not in Defender data.

KQLDefender XDR, Advanced hunting

// Did a path from ShimCache actually run? Look for process startsDeviceProcessEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where FileName =~ "psexec.exe" and FolderPath startswith @"C:\Users\alice\Downloads"| project Timestamp, AccountName, FolderPath, ProcessCommandLine, SHA1

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what ShimCache (AppCompatCache) shows.

AmcacheIt adds the file's SHA-1 and publisher, so you can check the file even after it has gone.
Last Shutdown TimeIt dates when this cache was written, so every entry was on disk before then.
Prefetch FilesNot in the RegistryThey show whether the file actually ran, which ShimCache cannot prove.

Sources

The facts on this page come from these public pages, which say more on each point.