"As background, the Application Compatibility Cache is used by the Windows operating system to help identify application compatibility issues with the goal of trying to resolve them, so legacy applications can run on the newer version of the operating system. A search through the registry will show this data is spread across a number of hives, including the user, system and software hives. The Windows operating system looks at the combination of data collected, and/or set by the user, to determine which applications require shims to be used for compatibility purposes. " https://tzworks.net/prototype_page.php?proto_id=29
Johnny AppCompatCache
https://digital-forensics.sans.org/summit-archives/DFIR_Summit/Johnny-AppCompatCache-the-Ring-of-Malware-Brice-Daniels-and-Mary-Singh.pdf
Amcache and Shimcache in forensic analysis
https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/
AppCompatCache changes in Windows 10
https://binaryforay.blogspot.com/2015/04/appcompatcache-changes-in-windows-10.html
Johnny AppCompatCache
https://digital-forensics.sans.org/summit-archives/DFIR_Summit/Johnny-AppCompatCache-the-Ring-of-Malware-Brice-Daniels-and-Mary-Singh.pdf
Amcache and Shimcache in forensic analysis
https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/
AppCompatCache changes in Windows 10
https://binaryforay.blogspot.com/2015/04/appcompatcache-changes-in-windows-10.html
