I managed to somehow do it by looking at the modification time of the file IconCache.db present in Appdata\Local in each user folder.
What I am trying to do now is set the relevance for a correct manner, but failed to do so still, i think my logic might be incorrect.
I want to add an exclusion list so that the query ignores some folders, I did it like this:
exists files whose (name of it = "IconCache.db" and modification time of it > now - 60 * day) of folders "AppData\Local" of folders of folder "C:\Users" whose (name of it as lowercase does not contain "all users" OR name of it as lowercase does not contain "default" OR name of it as lowercase does not contain "public" OR name of it as lowercase does not contain "administrator")
In this case, the IconCache has not been modified in the last 60 days, but still my query is returning “true”.
Any logical approach to this error?
Just adding that the following: exists files whose (name of it = "IconCache.db" and modification time of it > now - 60 * day) of folders "AppData\Local" of folders of folder "C:\Users"
works perfectly.