MUI stands for Multilingual User Interface. It is a technology that allows Windows systems to have a single application localized for multiple languages. Developers create an .MUI file for each language supported by the application and these files enable the user to switch the language. The MUI files generate the MUICache key in the registry. MUICache key contains information about the files that are executed on the system which the operating system extracts when a new application is used.
MUICache artifact can provide useful information regarding applications and tools installed and run via a user account. This artifact may also provide an indication of malicious activities on the system; as the information within the MUICache key is maintained even if the malicious actor has deleted the applications from the device. In addition, if the values for an app were deleted from the key, they will reappear again the next time the user runs that application.
The path to the MuiCache key differs between Windows operating systems. On Windows 2000, Windows XP, Windows
Server 2003, the key is located within the NTUSER.dat hive at:
Starting from Windows Vista, the key is located in the USRCLASS.dat hive in the following location:
As demonstrated in the screenshot below, MuiCache key contains multiple values. For each value, the Name
field contains the path to the file executed and the Data field contains information about the executed file such
as the name of the application.
This section discusses how to use ArtiFast Windows to analyze MUICache artifact from Windows
machines and what kind of digital forensics insight we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifacts Selection phase, you can select MUICache artifact:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View”, with indexing, filtering, and searching capabilities. Below is a detailed description of MUICache artifact in ArtiFast Windows.
For more information or suggestions please contact: firstname.lastname@example.org