Windows execution artifact viewer

See everything that actually ran on this machine.

Prefetch, Amcache, Shimcache, BAM/DAM, and UserAssist each hold part of the story, and each one can be wrong in a different way. Execution Parser reads all five directly from disk and lines them up in a single timeline, so you can corroborate one artifact against another instead of taking any single one at its word.

Download for Windows See what it reads

Execution Parser timeline view with the detail panel open, showing Amcache evidence — resolved path, on-disk status, signature, SHA-1, and a Check on VirusTotal button.

One tool, five artifacts

Every execution artifact on Windows has a blind spot. Execution Parser doesn't hide that.

Prefetch

proves execution

Run count, last 8 run times, and every file it loaded.

Amcache

ties a binary to the machine

SHA-1, file size, compile time, first seen. Delete the file after and this still shows it.

Shimcache

proves presence, not execution

Says the file was on disk.

BAM / DAM

per-user, last execution only

Last time each user ran something.

UserAssist

GUI launches only

Only sees stuff from the Start menu or Explorer.

Execution Parser

An activity review tool for Windows 10 and 11.

Download for Windows