Skip to content
WMIparser

Glossary

CCM_RecentlyUsedApps (SCCM software metering)

ConfigMgr client WMI class recording, per user and executable, the path, last launch time, launch count and file version information.

CCM_RecentlyUsedApps is a WMI class of the Configuration Manager (SCCM / ConfigMgr) client, in the namespace root\ccm\SoftwareMeteringAgent. Its software-metering component keeps one instance per executable and user: where the file ran from (FolderPath, ExplorerFileName), who ran it (LastUserName), when last (LastUsedTime), how often (LaunchCount), and the file's version information (CompanyName, ProductName, FileDescription, OriginalFileName and more). Configuration Manager uses it for software usage reporting.

Why it matters in investigations

For an investigator it is evidence of execution, per user, that survives the deletion of the binary. It only exists on machines with the ConfigMgr client, but where it exists it sits in the same CIM repository you already collect for WMI persistence, so no extra acquisition is needed.

Two details matter when reading it. LastUsedTime is a CIM DATETIME string that carries its own offset from UTC in minutes, so convert it with that offset rather than assuming a time zone. And it is the last launch by that user, not the first. Because each update rewrites the record, OBJECTS.DATA often still holds older copies in freed space, with an earlier LastUsedTime and a lower LaunchCount; carving them can date earlier runs.

Example

A record for a tool launched from a user-writable folder:

FolderPath        C:\ProgramData\Intel\
ExplorerFileName  m64.exe
LastUserName      FIN\svc_backup
LastUsedTime      20260914100914.000000+000   (10:09:14 UTC)
LaunchCount       2
CompanyName       (empty)

No version information, a folder outside Program Files and a low launch count are all worth a closer look. None of them proves anything alone: identify the file before concluding. This record comes from the fictional sample host FIN-WKS-07 shipped with the tool.

WMI Parser shows these records, live and carved, in its evidence-of-execution view. For field meanings and a worked example, read SCCM RecentlyUsedApps: evidence of execution in WMI.