> For the complete documentation index, see [llms.txt](https://mahmoud-shaker.gitbook.io/dfir-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mahmoud-shaker.gitbook.io/dfir-notes/mui-cache.md).

# MUI Cache

### **Overview:**

* **Purpose**: Stores display names of applications for the Windows user interface.
* **Registry Location**:
  * `HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache`
* **Data Stored**:
  * Application paths and user-friendly names.

### **Benefits for DFIR:**

* **User Intent**: Helps identify applications a user interacted with.
* **Verification of Execution**: Provides indirect evidence of application usage
* **Executable Names and Paths:** Stores the names and paths of recently accessed executable files, helping to track program usage.
* **Localization:** Provides localized names for programs, useful in environments with multiple languages.
* **Timestamp Information:** Can sometimes offer insights into when a program was last accessed.

### **How It Works:**

* Updates when new applications are executed and their display names are registered.

### **Tools:**

* **Registry Explorer**: Enables analysis of the MUI cache for patterns.
* **Regripper**: Automates MUI cache extraction and parsing

for example : 

<figure><img src="/files/HTxC4vEgqYtgtu9HRas0" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/5ShqR02E1ms90P8zFdoA" alt=""><figcaption></figcaption></figure>