C++ ShimCache (AppCompatCache) parser for execution artifact forensics
-
Updated
Feb 20, 2026 - C++
#
shimcache
Here are 4 public repositories matching this topic...
X-Ways Forensics Community Edition
incident-response prefetch dfir digital-forensics computer-forensics carving file-carving registry-analysis xtensions amcache forensic-tools windows-forensics xwf file-signatures x-tensions windows-artifacts x-ways-forensics xways python-forensics shimcache
-
Updated
Dec 10, 2025
Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks correlation. 20+ modules mapped to MITRE ATT&CK.
windows csharp dotnet persistence incident-response prefetch forensics dfir threat-hunting forensic-analysis blue-team mitre-attack artifact-collection shimcache
-
Updated
Jul 24, 2026 - C#
Windows AppCompatCache (ShimCache) forensic analyzer — reads the AppCompatCache value from a SYSTEM hive and r
-
Updated
Jul 27, 2026 - Rust
Improve this page
Add a description, image, and links to the shimcache topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the shimcache topic, visit your repo's landing page and select "manage topics."