How does the Reports -> Software Inventory -> Installed Programs - get that information

[GarrettB42]

How does the Reports section get the information from all the systems? Specifically Software -> Installed Programs. I'm asking this because I have been investigating some malware on company computers. It's one that doesn't hide itself, but installs and leaves an install entry in Windows. I pull the report and I see new people on the list with this installed. When I look at the install date they are not new. They've had the infection for months. 

I hope my question makes sense.  I want to find a way to get a accurate report. Thanks.

[AshC · Accepted solution]

Hi Garrett,

This info is stored in our database and the report is sent whenever software inventory list changes are detected. We query the list of installed applications from the registry which is behind the Add/Remove Programs section.

A fairly recent change was made to collect user specific installs (as opposed to an MSI setup for use with all users on the PC).  This update was made mid-November.

[GraysenRichard]

Thank you for such a valuable information. I was looking for a long time detailed explanation. Really appreciate your reply!

[AshC]

No problem @GraysenRichard  !