ExecutedProgramsList: See Every Program Run on Windows Without Installing Anything

If you need to figure out what software actually ran on a machine, ExecutedProgramsList pulls execution traces straight from the registry and Prefetch folder without touching your system files. This single portable executable gives you a sortable table of every .exe, batch file, and script that ever launched, which is exactly what you want for incident response or just digging through an old workstation.

What You Will See in the Table

The main window dumps a few columns: filename, full path, file timestamps, product version info if embedded, and last execution time where Windows bothered to log it. No installer runs in the background, no services start up, just double-click, and you have your data. I have pulled this list on machines that had been wiped of installed software but still showed traces in the registry, which is usually when people finally notice how much history Windows keeps hiding.

Why Forensic Teams Actually Use ExecutedProgramsList

Standard cleanup tools delete files, but they rarely touch the registry keys that log execution history. You can delete an .exe, empty your Recycle Bin, and clear browser cache, yet this tool will still show you what ran last Tuesday. That mismatch is exactly where incident responders look for hidden USB tools, encryption utilities, or data exfiltration clients.

I have seen analysts pull this list right before running hash checks against VirusTotal. If a suspicious executable shows up in Prefetch but the file itself is gone, you know something was trying to hide its tracks. The tool will not tell you if it is malicious on its own, so pair it with a hash checker or Defender SmartScreen for actual triage. MajorGeeks hosts free utilities like PrefetchView if you need to dig deeper into those .pf files directly.

Five Windows Sources, All Combined

The tool does not just read one place. It aggregates from MuiCache, the non-roaming MUICache key, AppCompat Flags (both Persisted and Store), and the Prefetch folder. Explaining why this matters: each source has its own blind spots, so combining them gives you a fuller picture than any single registry dump ever could.

● MuiCache tracks recently executed programs per user with timestamps. It is usually your best bet for recent activity.
● Shell\NoRoam\MUICache works the same way on older Windows but gets pruned or ignored on Windows 10 and 11.
● AppCompat Flags (Persisted / Store) only shows apps that tripped a compatibility shim or got flagged by Windows, so it is a smaller subset.
● Prefetch holds the actual .pf files with execution hashes and timestamps. It is system-wide, meaning you need to cross-check logon times on multi-user systems.

Export Options That Actually Matter

Double-clicking rows opens file properties, but the real power lives in the command line. If you are building a timeline or feeding data into another tool, drop this right after the executable:

/scomma for CSV
/stab for tab delimited
/stext for plain text
/shtml if your boss prefers something that opens in Edge without looking like a spreadsheet

I usually pipe it straight to /sxml when building an evidence report because XML keeps the structure intact and plays nice with parsing scripts later on. No need to manually copy-paste rows while Windows decides to freeze up mid-export.

Limitations You Should Know

It is not magic. AppCompat keys do not store timestamps, and MUICache entries get rotated out after a few weeks of normal use. Prefetch files are shared across all users on the machine, so attribution requires checking logon history. Also, the tool reads HKCU by default, meaning you cannot see another user's execution history without running it as an administrator or manually pointing it at their registry hive. It lists everything indiscriminately, so expect to sort through many Windows updates and background services before finding what actually matters.

Geek Verdict

ExecutedProgramsList does exactly one thing and does it well. It is not flashy, it will not clean up your system, and it certainly will not install a sidebar widget to track your activity. But when you need a quick, offline look at what ran on a machine without triggering antivirus alarms or writing registry keys yourself, this is the kind of tool you keep in your portable apps folder. The only real downside is that it relies on data Windows already chose to log, so if someone spent time scrubbing Prefetch and MUICache, you are going to get holes in the timeline. Still, for under five minutes of setup and zero bloat, it earns a spot next to Autoruns and Process Explorer on every rescue drive.

If you get stuck untangling Prefetch timestamps or need help parsing the CSV output, drop by the MajorGeeks forums. We have all been there, and someone usually has a script that automates the boring parts.