MUICache

Programs this user ran, by full path, with the name and company from their version info.

Use it to prove a program ran in a user's session, by its full path, even after the file was deleted.

UsrClass.dat
Program Execution

What It Is

MUICache is a cache Explorer keeps for each user of the friendly name and company of the programs they have run, so it can show those names without reading each file again. So each program that ran in this user's session leaves a record here, by its full path, even after the file has been deleted. It holds no times, so it tells you a program ran at some point, not when. It lives in the user's UsrClass.dat.

What It Proves

A program at that path ran in this user's session at some point, even if it has since been deleted. The data is the description and company the file claims for itself.

What It Does Not Prove

No run times or counts are kept, and the one key last write time dates only the newest change. Not every launch adds an entry, so a missing program proves nothing.

Where It Lives

MUICache lives in the UsrClass.dat hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in MUICache, each with what it tells you
Registry Value	What It Tells You
`C:\Users\alice\AppData\Roaming\odupd.exe.FriendlyAppName` `REG_SZMicrosoft OneDrive`	odupd.exe in AppData\Roaming ran in alice's session and calls itself Microsoft OneDrive. The real OneDrive is not installed there, so hash this file.
`C:\Users\alice\AppData\Roaming\odupd.exe.ApplicationCompany` `REG_SZMicrosoft Corporation`	The file claims Microsoft Corporation as its maker, but any file can claim that. Check its signature and hash before trusting the name.
`E:\tools\procdump64.exe.FriendlyAppName` `REG_SZSysinternals process dump utility`	procdump64.exe ran from the USB stick that was drive E in alice's session, though the stick has gone. No time is kept here, so the Sysinternals key and Prefetch can date it.

How to Read It

Each value name is a program's full path ending in .FriendlyAppName or .ApplicationCompany. The data is the description and company from the file's version information, which any file can claim for itself. Compare the claimed name with the path, because a Microsoft name on a file in AppData or Temp is a lead. There are no run times, so date activity from other artefacts such as Prefetch or the Sysinternals key.

When Windows Writes It: When this user starts a program whose name the shell has not cached yet.
Which Windows Versions: Windows XP to 11 keep it. It lives in NTUSER.DAT on XP and in UsrClass.dat from Vista.
Tools That Parse It: Registry Explorer, RECmd, RegRipper (muicache)

Hunt It

What MUICache records, that a program ran, is not written to any event log, so parse the hive, or read it live with Velociraptor. Process creation records show the same program running with a time, which MUICache cannot.

Sees Related ActivityDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, which keeps the same version info with times. Expect per-user installs such as OneDrive and VS Code, so anything else is worth a look. Defender does not read MUICache.

KQLDefender XDR, Advanced hunting

// Programs in user folders whose version info claims Microsoft, with run timesDeviceProcessEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where FolderPath contains @"\AppData\" and ProcessVersionInfoCompanyName has "Microsoft"| project Timestamp, AccountName, FolderPath, ProcessVersionInfoFileDescription, ProcessVersionInfoCompanyName, SHA1

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what MUICache shows.

UserAssistGives a run count and last run time for programs started from the shell.
AmcacheGives the program's SHA-1, to check the file behind the name it claims.
Prefetch FilesNot in the RegistryDates when the program ran, which MUICache does not record.

Sources

The facts on this page come from these public pages, which say more on each point.