Windows Background Activity Moderator (BAM)
Win10:
SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}
SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}
Provides full path of the executable file that was run on the system and last execution date/time