ShimCache Parser v1.0.0

ShimCache Parser v1.0.0

Initial release of ShimCache Parser, a forensic command-line tool for extracting and enriching Windows 10/11 AppCompatCache (ShimCache) entries from the live registry or an offline SYSTEM hive.

What's included:

• Full ShimCache parsing with support for all ControlSets
• Enriched CSV output with 11 columns: ControlSet, CacheEntryPosition, Path, LastModified, Executed, Signature, FileSize, CreationTime, LastAccessTime, PECompileTime, SHA256, OriginalFilename
• Authenticode signature verification (Signed / Unsigned / FileNotFound)
• PE COFF TimeDateStamp extraction for compile-time anomaly detection
• Full-file SHA-256 hashing for threat-intel and VirusTotal pivoting
• OriginalFilename extraction from PE Version Info for renamed-malware detection
• Offline hive support via RegLoadKey
• --nosig flag for fast offline analysis without file enrichment
• UTF-8 CSV output with BOM for clean Excel compatibility

Supported platforms: Windows 10, Windows 11
Architecture: x64
Requirements: Administrator privileges