Execution
RunMRU
RunMRU cheat sheet: commands typed in the Windows Run dialog (Win+R) in NTUSER.DAT, MRUList order, the LastWrite time and LOLBin or UNC patterns to hunt.
- Location
- NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
- Proves
- A user typed these commands, paths or URLs in the Run dialog, in this order
- Timestamps
- RunMRU key LastWrite as FILETIME, UTC, dating only the most recent command; older entries undated
- Retention
- Limited MRU list, reused commands move to the top; cleared with recent items or by cleaners; deleted values in hive slack and VSS
- Access
- Per-user NTUSER.DAT, locked while the user is logged on: collect via raw NTFS (KAPE) or VSS; reg query for the current user
- Evidence of
- ExecutionUser activity
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesUser
- Velociraptor
- Windows.Triage.Targets:RegistryHivesUser
Tools
Compare all toolsWhat it is
RunMRU is the history of the Run dialog (Win+R). Every distinct command, path or URL that a user types there is stored in their NTUSER.DAT so it can be suggested again. Because the Run box is a favourite of hands-on-keyboard attackers and of social-engineering lures ("press Win+R and paste this"), RunMRU is a small but high-value artifact.
Location
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Same key from Windows XP to Windows 11.
What it proves
- The user typed or pasted the command into the Run dialog and pressed Enter (entries are saved when the dialog executes them).
- The order of those commands, and the time of the most recent one.
- It does not prove the command succeeded; confirm with Prefetch, BAM/DAM, process-creation events or PowerShell logs.
Key fields
| Element | Meaning |
|---|---|
Values a, b, c… | One command each, as text, ending with \1 (a marker added by Explorer, not part of the command) |
MRUList | String of value letters, most recent first (for example cab) |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Key LastWrite | A command is run from the dialog (new or reused) | FILETIME, UTC | Dates only the first letter of MRUList; older entries have no time |
Retention and clearing
- The list keeps a limited number of entries; running a known command again moves it to the top rather than adding a duplicate.
- Clearing recent items or privacy tools remove the values; deleted values may persist in hive slack and in shadow-copy NTUSER.DAT files.
Collection
- KAPE target:
RegistryHivesUser - Velociraptor (
Windows.Triage.Targets):RegistryHivesUser;Windows.Timeline.Registry.RunMRUproduces a timeline live. - Built-in (current user):
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): shows values in
MRUListorder. - RegRipper:
runmruplugin. - Velociraptor:
Windows.Timeline.Registry.RunMRU.
Investigation tips
- Hunt for LOLBins and download cradles:
powershell -enc,mshta http…,rundll32,certutil -urlcache,cmd /c curl. - Pasted one-liners are the hallmark of "fake CAPTCHA" / ClickFix lures that instruct users to press Win+R; the RunMRU LastWrite often gives the infection time.
- UNC entries (
\\10.0.0.5\c$) show manual access to other hosts;mstsc /v:entries show RDP targets. - Place the LastWrite time next to TypedPaths and UserAssist to rebuild the user's session.
Related artifacts
- TypedPaths and WordWheelQueryTypedPaths and WordWheelQuery cheat sheet: paths typed in the Explorer address bar and Explorer search terms in NTUSER.DAT, order, timestamps and tips.
- UserAssistUserAssist cheat sheet: NTUSER.DAT GUID keys, ROT13 value names, run count, focus time and last run FILETIME for programs a user launched from Explorer.
- PowerShell logs and historyPowerShell forensics: 4103/4104 script block logs, 400/403/800 engine events, PSReadLine ConsoleHost_history.txt, transcripts and logging policy keys.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
Glossary terms
- NTUSER.DATThe per-user registry hive stored in each Windows profile and loaded as HKEY_CURRENT_USER, rich in user activity and persistence traces.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.
- LOLBin (living-off-the-land binary)A legitimate, signed Windows binary that attackers abuse to download, execute or hide payloads without dropping their own tools.
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.