Execution
MUICache
MUICache cheat sheet: UsrClass.dat and NTUSER.DAT locations, FriendlyAppName and ApplicationCompany values, what they prove and their timestamp limits.
- Location
- UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
- Proves
- A user's shell resolved an executable's display name, usually because it ran
- Timestamps
- Only the MuiCache key LastWrite as FILETIME, UTC; individual entries carry no time
- Retention
- Entries accumulate for the life of the profile with no documented limit and survive deletion of the executable
- Access
- UsrClass.dat locked while the user is logged on: reg query works live, otherwise raw NTFS (KAPE) or VSS
- Evidence of
- Execution
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesUser
- Velociraptor
- Windows.Triage.Targets:RegistryHivesUser
Tools
Compare all toolsWhat it is
The MUI (Multilingual User Interface) cache stores the display name of executables so the shell does not have to read each file's version resources again. When a program is started through the shell, Windows reads its FileDescription (and, on newer versions, CompanyName) and caches it in the user's registry. The result is a per-user list of executables with their friendly names, which often survives after the program has been deleted.
Location
| Windows version | Hive | Key |
|---|---|---|
| XP | NTUSER.DAT | Software\Microsoft\Windows\ShellNoRoam\MUICache |
| Vista / 7 / 8 / 10 / 11 | UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
On a live system the Vista+ key is visible as HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache.
What it proves
- The user whose hive holds the key had the shell load display information for the executable. In practice this happens mostly when the program is executed, so MUICache is commonly used as supporting evidence of execution attributed to a user.
- It keeps the full path, which exposes tools run from USB drives, temp folders or network shares.
- It is not conclusive on its own: other shell operations that need the display name can also create entries, and it records no count or time per entry.
Key fields
| Value name | Data |
|---|---|
<full path>.FriendlyAppName | FileDescription from the PE version resource (Windows 7 and later) |
<full path>.ApplicationCompany | CompanyName from the PE version resource (Windows 7 and later) |
<full path> | Friendly name (XP / Vista style) |
LangID | Language bookkeeping value, not a program |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
MuiCache key LastWrite | Any value is added or changed | FILETIME, UTC | Only dates the most recent addition; individual entries have no time |
Retention and clearing
- Entries accumulate for the life of the profile; there is no documented size limit.
- Some cleaners delete the key. Deleted values can remain recoverable from free space in the hive, and older copies exist in shadow copies of
UsrClass.dat. - Renaming or deleting the executable does not remove its entry, so MUICache can preserve names of tools that are long gone.
Collection
- KAPE target:
RegistryHivesUser(collectsUsrClass.datandNTUSER.DATwith logs) - Velociraptor (
Windows.Triage.Targets):RegistryHivesUser - Built-in (current user):
reg query "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache"
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): browse or batch-export the key.
- RegRipper:
muicacheplugin. - ExecutedProgramsList (NirSoft): combines MUICache with other execution sources on a live system.
Investigation tips
- The friendly name is read from the file itself: a binary named
svchost.exewith aFriendlyAppNameof an archiver or a remote-access tool reveals renaming. - An empty or odd
ApplicationCompanynext to a system-looking name is a quick triage flag. - Build a per-user list of unusual paths, then confirm execution and time with UserAssist, BAM/DAM or Prefetch.
- If the binary is gone, pivot to Amcache (SHA-1) and ShimCache using the same path.
Related artifacts
- UserAssistUserAssist cheat sheet: NTUSER.DAT GUID keys, ROT13 value names, run count, focus time and last run FILETIME for programs a user launched from Explorer.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- ShimCache (AppCompatCache)ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
- Amcache.hveAmcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
- PE files (Windows executables)PE file triage cheat sheet: hashes, imphash and Rich header, compile timestamp caveats, sections and entropy, version info, signatures, PDB paths and tools.
Glossary terms
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.
- UsrClass.datThe second per-user registry hive, mapped to HKCU\Software\Classes and holding ShellBags, MUICache and per-user COM registrations.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.