AppCompatCache

49

Artifacts

Path/s
XP: SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatibility
Win7/8/10: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
Operating System
Windows
Artifact Category
  • Applications
  • Registry
"As background, the Application Compatibility Cache is used by the Windows operating system to help identify application compatibility issues with the goal of trying to resolve them, so legacy applications can run on the newer version of the operating system. A search through the registry will show this data is spread across a number of hives, including the user, system and software hives. The Windows operating system looks at the combination of data collected, and/or set by the user, to determine which applications require shims to be used for compatibility purposes. "  https://tzworks.net/prototype_page.php?proto_id=29

Johnny AppCompatCache
https://digital-forensics.sans.org/summit-archives/DFIR_Summit/Johnny-AppCompatCache-the-Ring-of-Malware-Brice-Daniels-and-Mary-Singh.pdf

Amcache and Shimcache in forensic analysis
https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/

AppCompatCache changes in Windows 10
https://binaryforay.blogspot.com/2015/04/appcompatcache-changes-in-windows-10.html

User comments

There are no user comments for this listing.