ShimCache parser

All, we posted a new tool on our website for parsing the Windows 'ShimCache' artifacts and updated others to handle this artifact as well. The new tool is cross platform and free for personal use.

The new tool is called Window AppCompatibility Cache Utility (or wacu for short), and it can be downloaded here - https://tzworks.net/prototype_page.php?proto_id=29. It is a command line tool that targets the AppCompatCache subkey in the Windows registry system hive. This artifact is useful when analyzing the initial installation of malware on a system since it records which apps were run along with the respective modification date of the application.

Other tools that were updated to include parsing this artifact include yaru (https://tzworks.net/prototype_page.php?proto_id=3) and cafae (https://tzworks.net/prototype_page.php?proto_id=19).

Give them a try!