Description: Programs Installed In Non-Standard Windows Locations
What The Data Shows: Programs Installed Outside of C:\Program Files
SQL:
SELECT path,
DATETIME(atime,"unixepoch","localtime") AS "Last Accessed",
DATETIME(mtime,"unixepoch","localtime") AS "Last Modified",
DATETIME(btime,"unixepoch","localtime") AS "Created"
FROM file
WHERE path LIKE "\users\%\AppData\%.exe"
OR path LIKE "\users\%\AppData\Roaming\%.exe"
OR path LIKE "\ProgramData\%.exe";