C++ ShimCache (AppCompatCache) parser for execution artifact forensics
-
Updated
Feb 20, 2026 - C++
#
shimcache
Here are 4 public repositories matching this topic...
Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks correlation. 20+ modules mapped to MITRE ATT&CK.
windows csharp dotnet persistence incident-response prefetch forensics dfir threat-hunting forensic-analysis blue-team mitre-attack artifact-collection shimcache
-
Updated
Jul 24, 2026 - C#
X-Ways Forensics Community Edition
incident-response prefetch dfir digital-forensics computer-forensics carving file-carving registry-analysis xtensions amcache forensic-tools windows-forensics xwf file-signatures x-tensions windows-artifacts x-ways-forensics xways python-forensics shimcache
-
Updated
Dec 10, 2025
Windows AppCompatCache (ShimCache) forensic analyzer — reads the AppCompatCache value from a SYSTEM hive and r
-
Updated
Aug 20, 2026 - Rust
Add this topic to your repo
To associate your repository with the shimcache topic, visit your repo's landing page and select "manage topics."