usblist2.exe is a command-line utility developed by NirSoft, a well-known software company that creates hundreds of tiny, powerful utilities for Windows. NirSoft is famous for tools like ProduKey (retrieves Windows product keys) and USBDeview.
Specifically, usblist2.exe is an older, command-line version of USBDeview. The primary purpose of this executable is to:
A: Because modern antivirus uses heuristic detection. usblist2.exe accesses registry keys that malware also targets (e.g., USBSTOR keys). Antivirus sees the behavior, not the file name. If you trust the source, add an exclusion. But generally, trust your antivirus. usblist2.exe download
You can extract USB history using native PowerShell commands. No download needed.
To list all connected USB devices:
Get-WmiObject -Class Win32_USBHub | Select-Object Name, DeviceID
To list USB storage devices with timestamps (deep registry query):
Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR" -Recurse | ForEach-Object
$device = $_.PSPath
$friendlyName = (Get-ItemProperty -Path $device -Name "FriendlyName" -ErrorAction SilentlyContinue).FriendlyName
$firstInstall = (Get-ItemProperty -Path $device -Name "FirstInstallDate" -ErrorAction SilentlyContinue).FirstInstallDate
if ($friendlyName)
[PSCustomObject]@
Device = $friendlyName
FirstConnected = $firstInstall
RegistryPath = $device
To get last connection time (more advanced): usblist2
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*" -Name "LastArrivalDate" -ErrorAction SilentlyContinue | Select-Object LastArrivalDate, PSChildName
This is a graphical user interface app that allows you to browse all USB controllers and connected USB devices on your computer.
You have “Unknown Device” or “USB Device Not Recognized” errors. An old blog post recommends running a tool that contains usblist2.exe to purge old USB drivers. You want that tool. To list USB storage devices with timestamps (deep
Let us be blunt: Searching for “usblist2.exe download” on Google or Bing is a minefield. The first 10 results are likely to be malicious.