Does Windows log programs that have been run/called?

Solution 1:

You will not be able to check what ran, but you can prepare for the next time. If you open secpol.msc you can go to local policies/audit policy. Activate Success (and maybe also Failure) on Audit process tracking and you will get an event log entry in the security event log every time a process starts or ends. Unfortunately you'll see the process that ran but not the command line it was started with.

If you activate the auditing, a lot of logs might get generated, so you should adjust the size of the security event log.

You can access the logs with eventvwr.msc, Windows protocols, Security.

Solution 2:

Mark Russinovich Sysinternals Process Monitor does that. Among tracking file/reg/network accesses, it can track proc/thread lifetime and allows a lot of filtering.

Solution 3:

It may have been a scheduled task running. Check the Task Scheduler for tasks.

You could also check the Event Viewer for anything, though it probably won't have anything.