Shimcache

Cached executable paths from SYSTEM hives. File modification time is not execution time. The execution indicator is reported by the parser and depends on the Windows version; a cache entry alone does not establish execution.