muicache

$ target-query <path/to/target> -f muicache

Details

Module	os.windows.regf.muicache.MuiCachePlugin
Output	records

Module documentation

Plugin that iterates various MUIcache locations.

Function documentation

Iterate various MUIcache key locations.

The MUIcache registry key stores information about executed GUI-based programs. The key is part of the Multilingual User Interface service in Windows. MUIcache references the file description contained within the executable’s resource section and populates that value.

References:

• https://www.magnetforensics.com/blog/forensic-analysis-of-muicache-files-in-windows/

• https://forensafe.com/blogs/muicache.html

Yields MuiCacheRecords with fields:

hostname (string): The target hostname. domain (string): The target domain. index (varint): The index of the entry. name (string): The value name. value (string): The value. path (path): The executable path.