Run
A one time run location that can load a DLL as Explorer starts, then delete itself.
Use it to find a command or DLL queued to run once at the next logon, before it runs and deletes itself.
- SOFTWARE
- Persistence
What It Is
RunOnceEx is a one-time startup location that the Explorer shell processes after a user first signs in, removing its entries once they have run. If the Explorer shell is not present, the key is ignored. Installers typically use it for a step that runs once, such as finishing setup or registering a component. It lives in HKLM SOFTWARE under Microsoft\Windows\CurrentVersion.
What It Proves
A command or DLL listed under a section here is set to run once at the next logon. The Depend subkey loads a DLL into the context that processes the list.
What It Does Not Prove
Entries remove themselves after they run, so an empty key does not mean nothing ran. It shows what is queued now, not who queued it.
Where It Lives
RunOnceEx lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| No RunOnceEx key exists, so nothing is queued to run once at the next logon. Entries delete themselves, so check any Sysmon or Defender data for past writes. |
| alice's hive has no RunOnceEx key either. Public testing found the HKCU copy does not run, so the machine key is the one that matters. |
How to Read It
Open RunOnceEx and look at each section subkey (often named 0001) and its values. Check the Depend subkey, because a DLL path there is loaded as the list is processed. A path in Temp, AppData or ProgramData is the tell. Public testing found an HKCU copy does not run.
- When Windows Writes It
- It is written when software or an attacker adds an entry. Entries are deleted as they run.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Defender records these writes within retention. It shows the entry being set, not whether the payload ran before it deleted itself.
// Writes to RunOnceEx and its Depend subkey, with the process that wrote themDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what RunOnceEx shows.
- AmcacheKeeps the program's path and SHA-1 after the entry here has deleted itself.
- Process Starts at Logon, Security Event 4688Not in the RegistryShows what ran at logon, after the entry deleted itself.
Sources
The facts on this page come from these public pages, which say more on each point.
- Microsoft Learn: Understand and Control Startup Apps with the System Configuration Utility (opens in a new tab)
- Oddvar Moe: Persistence using RunOnceEx (opens in a new tab)
- MITRE ATT&CK T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (opens in a new tab)
- Sysinternals Autoruns (opens in a new tab)