> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/program-execution/runmru.md). # RunMRU The RunMRU (Run Most Recently Used) registry key tracks commands entered via the Windows Run dialog box (`Win + R`). RunMRU provides direct evidence of commands a user manually typed and executed. This makes it relevant for insider threat cases and social engineering investigations, including ClickFix-style attacks that trick users into pasting malicious commands into the Run box. ### Location **Dead Analysis (Offline):** ``` Registry File: C:\Users\\NTUSER.DAT Key: Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU ``` **Live Analysis:** ``` HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU ``` RunMRU is per-user. Each user account on the system maintains its own independent RunMRU key within their NTUSER.DAT hive. ### Structure and Interpretation The RunMRU key contains individual values and an ordering value: * **Lettered Values (a, b, c, ... z):** Each value stores a command string that was executed. Letters are assigned sequentially as new unique commands are entered. `a` is the *first* command ever entered, `b` the second, and so on. Each stored command has `\1` appended to it (e.g., `cmd\1`, `regedit\1`). * **MRUList:** This value tracks the *order of use*, not the order of creation. The leftmost character in MRUList represents the **most recently used** command. For example, an MRUList of `cab` means value `c` was used most recently, then `a`, then `b`. * **Maximum Entries:** 26 entries (a-z). Once all 26 slots are used, the next new command overwrites the **least recently used** entry's value name. If a duplicate command is entered, no new value is created. Instead, the existing entry's position is updated in MRUList. * **Invalid Commands:** If the user enters something invalid (e.g., a file path that doesn't exist), it will **not** be recorded. #### Important Distinction The letter assigned to a value does **not** indicate recency. A common misconception is that `a` is always the most recent. In reality, `a` is simply the first command that was ever entered. The **MRUList value is the authoritative source for execution order**. ### Forensic Value RunMRU can provide: * **The user account** that executed the command (derived from which NTUSER.DAT hive contains the entry). * **The exact command string** as the user typed it. * **Relative execution order** via the MRUList value. * **Last execution timestamp** from the registry key's Last Write Time, which reflects when the most recent command was entered. Individual commands do not have their own timestamps. #### Limitations * **Limited scope:** Only commands entered through the Run dialog box are recorded. Commands run via cmd.exe, PowerShell, Task Scheduler, or any other method are not captured here. * **Limited history:** Maximum of 26 entries per user. * **No per-entry timestamps:** Only the key's Last Write Time is available, which reflects only the most recent command entry. * **Easily cleared:** An attacker can delete the RunMRU key or individual values. Disabling the "Let Windows improve Start and search results by tracking app launches" privacy setting also stops RunMRU from recording and deletes existing history. ### Ways the Run Dialog Can Be Invoked The Run dialog is implemented in `shell32.dll` and can be triggered in multiple ways, all of which use the same underlying RunMRU key: * `Win + R` * Windows Start Menu Search > "Run" * Task Manager > "Run new task" * `Shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}` (Shell CLSID) * `rundll32.exe shell32.dll,#61` (calling the export directly) * Programmatically via `Shell.FileRun()` or `IShellDispatch.FileRun()` ### Modern Relevance: ClickFix and Fake CAPTCHA Attacks RunMRU has gained renewed forensic importance due to ClickFix/FakeCAPTCHA campaigns. These attacks use social engineering to trick users into opening the Run dialog and pasting a malicious command (typically a PowerShell download cradle) that was silently placed on their clipboard. Because the command passes through the Run box, it gets recorded in RunMRU. This makes the artifact a potential indicator of compromise for these campaigns. Look for RunMRU entries containing `powershell`, `mshta`, `cmd /c`, or encoded command strings. ### Artifact Correlation RunMRU should be correlated with other execution artifacts to build a more complete timeline: * **Prefetch:** Confirms whether the program referenced in RunMRU was actually executed and provides execution timestamps. * **BAM/DAM:** Background/Desktop Activity Moderator entries may corroborate execution with timestamps. * **Amcache:** May record the executable's SHA1 hash and metadata. * **ShimCache:** Confirms file presence on the system (not execution on Windows 10/11). * **UserAssist:** Tracks GUI program execution with run counts and timestamps. May overlap with Run box usage. * **Windows Event Logs:** Sysmon Event ID 1 (Process Create) or Security Event ID 4688 (Process Creation) can provide the full process command line with timestamps. ### Tools for Analysis * **Registry Explorer (Eric Zimmerman):** Browse and analyze the RunMRU key structure directly from offline NTUSER.DAT hives. * **RegRipper:** The `runmru` plugin automatically parses and presents RunMRU data in chronological order. * **Autopsy:** Parses RunMRU as part of its Recent Activity module. * **Cyber Triage:** Normalizes RunMRU data alongside other execution artifacts into a unified process view. * **KAPE:** Can target and collect NTUSER.DAT hives for offline analysis. Combine with RegRipper or Registry Explorer for parsing. ### Anti-Forensics Considerations * **Key deletion:** Attackers can delete the RunMRU key entirely or remove individual values. * **Privacy setting:** The Windows privacy setting "Let Windows improve Start and search results by tracking app launches" (`Start_TrackProgs` registry value) can be toggled off, which stops RunMRU recording and deletes the existing key. * **ACL modification:** Setting a Deny All ACL on the RunMRU key prevents Explorer from reading or writing to it, effectively disabling the artifact while the Run dialog still functions. * **Selective deletion:** Removing individual lettered values removes those commands from the Run dialog history, though the MRUList value may still reference the deleted letter until the next command is entered. ### References * [Microsoft: Run Dialog Documentation](https://learn.microsoft.com/en-us/windows/win32/shell/shell-filerun) * [Cyber Triage: How to Investigate RunMRU 2026](https://www.cybertriage.com/blog/how-to-investigate-runmru-2026/) * [Magnet Forensics: What is MRU (Most Recently Used)?](https://www.magnetforensics.com/blog/what-is-mru-most-recently-used/)