When you launch a program for the first time via Windows Explorer, the system extracts the application’s name from its internal resources and caches it. This allows Windows to quickly display the program name in places like the menu or recent apps list without having to re-scan the original file every time. Why It Matters for Forensics
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache muicache
Imagine an application installed on an English version of Windows. The executable might be named calc.exe . However, if a user is running a Spanish interface, Windows needs to know that this executable should be displayed as "Calculadora" in the Start Menu or Task Manager. When you launch a program for the first