"Amcache and Shimcache can provide a timeline of which program was executed and when it was first run and last modified
In addition, these artifacts provide program information regarding the file path, size, and hash depending on the OS version." - Andrea Fortuna
Windows 10 Creators update vs shimcache parsers: Fight!! - Eric Zimmerman
Amcache and Shimcache in forensic analysis - Andrea Fortuna
Get exclusive access to online courses and content through Patreon !