Windows Load and Run

The old Load and Run values that still start programs at logon.

Use it to find a program started at logon through the legacy Load or Run values, which modern software rarely uses.

NTUSER.DAT
Persistence

What It Is

The Load and Run values are old startup entries under the Windows NT\CurrentVersion\Windows key in the user's hive, dating from early Windows. The Load value lists programs that run minimised when the user signs in, and the Run value lists programs the user has Windows run at startup. Each holds a space-separated list of file names, with a path included where a file is not in the system directory.

What It Proves

The Load and Run values in the Windows key start their programs at logon, a holdover from win.ini that Windows still honours. Setting either runs code for the user.

What It Does Not Prove

Both values are empty on a clean machine, so anything in them is the signal. They are legacy, so modern software rarely uses them.

Where It Lives

Windows Load and Run lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\Windows

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Windows Load and Run, each with what it tells you
Registry Value	What It Tells You
`Load` `REG_SZ(not present)`	alice's legacy Load value is not set, as on a clean machine, so nothing starts through it at logon. Any program path here is worth chasing.
`Run` `REG_SZ(not present)`	The legacy Run value, separate from the Run key, is not set either. Both are win.ini holdovers Windows still honours, so a value is the signal.

How to Read It

Read the Load and Run values under the Windows NT CurrentVersion Windows key. Both are empty by default, so any program path is worth investigating. Check every user hive, because public sources document these values only under HKCU.

When Windows Writes It: When a value is written, usually by an attacker.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes within retention. A hit shows the value set, not that it ran. Both values are empty on a clean machine.

KQLDefender XDR, Advanced hunting

// The legacy Load or Run values being writtenDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey endswith @"\Windows NT\CurrentVersion\Windows"| where RegistryValueName in~ ("Load", "Run")| project Timestamp, ActionType, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Windows Load and Run shows.

AmcacheGives the SHA-1 of the program named here.
Process Starts at Logon, Security Event 4688Not in the RegistryShows the program named here running at logon.

Sources

The facts on this page come from these public pages, which say more on each point.