dissect.target.plugins.os.windows.regf.muicache#

Module Contents#

Classes#

MuiCachePlugin

Plugin that iterates various MUIcache locations.

Attributes#

MuiCacheRecord

dissect.target.plugins.os.windows.regf.muicache.MuiCacheRecord#
class dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin(target: dissect.target.Target)#

Bases: dissect.target.plugin.Plugin

Plugin that iterates various MUIcache locations.

KEYS = ['HKCU\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\MuiCache',...#
FIELD_NAMES = ('FriendlyAppName', 'ApplicationCompany')#
check_compatible() → bool#

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

muicache() → MuiCacheRecord#

Iterate various MUIcache key locations.

The MUIcache registry key stores information about executed GUI-based programs. The key is part of the Multilingual User Interface service in Windows. MUIcache references the file description contained within the executable’s resource section and populates that value.

References

Yields MuiCacheRecords with fields:

hostname (string): The target hostname. domain (string): The target domain. index (varint): The index of the entry. name (string): The value name. value (string): The value. path (path): The executable path.