Where Is the Windows MUICache Registry Key?
Windows MUICache key caching executable display names with execution traces.
Last updated
Windows caches friendly names of executed programs in MUICache, recording which binaries ran under each user with their company and description strings. Entries linger long after files delete.
Timelines use it as supporting execution evidence alongside Shimcache and prefetch. Export the hive offline since live keys stay busy.
Where Windows stores this, by platform
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Values map executable paths to cached display names from first execution. Entries survive file deletion, which helps find renamed malware. Parse from an offline hive export; the live key locks under a running user.
Frequently asked questions
What does MUICache prove?
That a binary executed under the user account at least once. It keeps no timestamps, so pair it with prefetch for timing.
Can I clear MUICache?
Yes by deleting values with Explorer closed, but gaps in forensics timelines look worse than the entries. Leave it on investigated machines.
Notice an outdated path? Let us know.