File: <SYSTEMDRIVE>:\Users\<USERNAME>\NTUSER.dat

Registry key:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Overview

The RunMRU registry key tracks items (programs, files / folders, URL, …) launched from the Windows Run launcher (Windows + R shortcut) in a most recently used list.

Entries are added / updated in near real-time.

Information of interest

Each entry successfully launched trough the Windows Run launcher is stored in a dedicated value under the Explorer\RunMRU key. Entry that were not found by the operating system (error “Windows cannot find […]”) are not added in the RunMRU registry key.

The values are ordered in a Most recently used (MRU) list, specified in the MRUList value. Example: MRUList equals to ba means that the entry tagged as b was launched last / the most recently, preceded by the entry tagged as a.

The last write timestamp of the key indicates the timestamp of the most recently launched item.

References



View on GitHub