Run
Commands this user typed into the Run box (Win+R), newest first.
Use it to read the commands a user typed into the Run box, newest first, with a time for the newest.
- NTUSER.DAT
- Program Execution
What It Is
RunMRU is the list of commands a user has typed into the Run box, the small window that opens with Win+R. MRU stands for most recently used, and Windows keeps the list so it can offer the same commands again. Each command is a value named by a letter, and a separate value records their order. It lives in the user's own NTUSER.DAT, so every command belongs to that user.
What It Proves
The user entered that command in the Run box. The newest command was run at the key's last write time.
What It Does Not Prove
Only the newest command has a time. Programs started from the Start menu or from taskbar search are not recorded here.
Where It Lives
RunMRU lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice's newest Run box command opened Remote Desktop to srv-fin-01, at the key time, 14 Oct 2026 22:16 UTC. Check srv-fin-01's own Security log for the sign-in. |
| Before that, alice opened the C$ admin share on srv-fin-01 from the Run box. MountPoints2 shows when she last reached it. |
| alice started PowerShell from the Run box, before the other two, with no time of its own. BAM and Prefetch can date when it ran. |
How to Read It
Values a, b, c and so on hold the commands, and you can ignore the \1 at the end of each. MRUList gives the order, with the newest letter first. The key's last write time belongs to the first letter in MRUList.
- When Windows Writes It
- Windows writes it each time the user runs a command from the Run box.
- Which Windows Versions
- Windows XP to 11 keep it.
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (runmru)
Hunt It
What a user types into the Run box is kept only in this key, so most live tools can show only the program that started, from process creation records. Velociraptor reads RunMRU from every user's NTUSER.DAT on disk.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. A Run box launch looks like any other Explorer launch, so this gives candidates, not the RunMRU list.
// Shells and RDP started by Explorer, which is how Run box launches appearDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what RunMRU shows.
- UserAssistIt gives run counts and last run times for programs the user started from the shell.
- Prefetch FilesNot in the RegistryThey date each program's runs, where RunMRU times only its newest command.
- Process Creation, Security Event 4688Not in the RegistryIt records each run with its full command line. Windows writes it to the Security log only when Audit Process Creation is on, and the command line only when command line logging is on too.
Sources
The facts on this page come from these public pages, which say more on each point.