forensicnomicon-data 1.1.0

// AUTO-GENERATED by forensicnomicon ingest pipeline.
// Source: fa
// Entries: 2597
#![allow(dead_code)]
// Do not edit manually — re-run `cargo run -p ingest` to regenerate.
#![allow(clippy::too_many_lines)]

use super::super::super::types::{
    ArtifactDescriptor, ArtifactLocation, DataScope, Decoder, FieldSchema, HiveTarget, OsScope,
    TriagePriority, ValueType,
};
pub(crate) static FA_FILE_PARITY_AGENT_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_parity_agent_cache",
    name: "Bit9LocalCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Bit9\\Parity Agent\\cache.*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Bit9 local cache database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine",
    name: "CrowdstrikeQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/CS/Quarantine/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Crowdstrike stores quarantined files encoded on disk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_2",
    name: "CrowdstrikeQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Application Support/Crowdstrike/Falcon/Quarantine/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Crowdstrike stores quarantined files encoded on disk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_3",
    name: "CrowdstrikeQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\drivers\\CrowdStrike\\Quarantine\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Crowdstrike stores quarantined files encoded on disk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CS_REGISTRY_BASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cs_registry_base",
    name: "CrowdstrikeAgentID",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/CS/registry.base"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Identifier of a CrowdStrike agent.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_4",
    name: "EsetAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Application Support/ESET/esets/cache/quarantine/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Eset Anti-Virus Quarantine (Infected) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs",
    name: "EsetAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\ESET\\ESET NOD32 Antivirus\\Logs\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Eset Anti-Virus Quarantine (Infected) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_5",
    name: "MicrosoftAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Microsoft Antimalware\\Quarantine\\**",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus Quarantine (Infected) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_6",
    name: "MicrosoftAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Microsoft\\Windows Defender\\Quarantine\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus Quarantine (Infected) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUPPORT_MPDETECTION_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_support_mpdetection_log",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Windows AntiMalware\\Support\\MPDetection-*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUPPORT_MPLOG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_support_mplog_log",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Windows AntiMalware\\Support\\MPLog-*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DETECTIONHISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_detectionhistory",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Microsoft\\Windows Defender\\Scans\\History\\Service\\DetectionHistory\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUPPORT_MPDETECTION_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_support_mpdetection_log_2",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Windows Defender\\Support\\MPDetection-*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUPPORT_MPLOG_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_support_mplog_log_2",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Windows Defender\\Support\\MPLog-*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_MPCMDRUN_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_mpcmdrun_log",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_systemroot%%\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\MpCmdRun.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_MPCMDRUN_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_mpcmdrun_log_2",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Temp\\MpCmdRun.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_TEMP_MPCMDRUN_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_temp_mpcmdrun_log",
    name: "MicrosoftAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.temp%%\\MpCmdRun.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_",
    name: "WindowsDefenderScanDetectionHistoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Microsoft\\Windows Defender\\Scans\\History\\Service\\DetectionHistory\\*\\*-*-*-*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Windows Defender scan detection history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_PATHS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_paths",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows Defender\\Exclusions\\Paths\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_PROCESSES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_processes",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows Defender\\Exclusions\\Processes\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_EXTENSIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_extensions",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows Defender\\Exclusions\\Extensions\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_TEMPORARYPATHS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_temporarypaths",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows Defender\\Exclusions\\TemporaryPaths\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_PATHS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_paths_2",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Paths\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_PROCESSES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_processes_2",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Processes\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_EXTENSIONS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_extensions_2",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Extensions\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXCLUSIONS_TEMPORARYPATHS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_exclusions_temporarypaths_2",
    name: "WindowsDefenderExclusions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\Windows Defender\\Exclusions\\TemporaryPaths\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Directories, processes and extensions configured not to be scanned by Windows Defender.
The can be set locally or through group policy objects (GPO).

Certain malware families (for example, Tofsee) are known to add directories to the
Paths list in order to avoid being detected by Windows Defender. Other malware
(for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-msexclusion/", "https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e", "https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SANTA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_santa",
    name: "SantaLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/santa/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Local Santa logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SANTA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_santa_2",
    name: "SantaLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/santa/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Local Santa logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_SOPHOS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_sophos_log",
    name: "SophosAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Logs/Sophos*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sophos Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_2",
    name: "SophosAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Sophos\\Sophos Anti-Virus\\Logs\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sophos Anti-Virus log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INFECTED: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_infected",
    name: "SophosAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Users/Shared/Infected/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sophos Anti-Virus Quarantine (Infected) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INFECTED_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_infected_2",
    name: "SophosAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Sophos\\Sophos Anti-Virus\\INFECTED\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sophos Anti-Virus Quarantine (Infected) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_log",
    name: "SymantecAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Logs\\*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus Log Files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AV_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_av_log",
    name: "SymantecAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Logs\\AV\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus Log Files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AV_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_av_log_2",
    name: "SymantecAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\Logs\\AV\\*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus Log Files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_log_2",
    name: "SymantecAVLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Symantec\\Symantec Endpoint Protection\\Logs\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus Log Files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_5_VBN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_5_vbn",
    name: "SymantecAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\**5\\*.vbn",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus quarantine (infected) and cloud submission files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_7",
    name: "SymantecAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\Quarantine\\**",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus quarantine (infected) and cloud submission files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_QUARANTINE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_quarantine_8",
    name: "SymantecAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Quarantine\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus quarantine (infected) and cloud submission files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CCSUBSDK: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ccsubsdk",
    name: "SymantecAVQuarantine",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Symantec\\Symantec Endpoint Protection\\*\\Data\\CmnClnt\\ccSubSDK\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Symantec Anti-Virus quarantine (infected) and cloud submission files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EVOLUTION: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_evolution",
    name: "GnomeEvolution",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/evolution/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Gnome Evolution files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EVOLUTION_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_evolution_2",
    name: "GnomeEvolution",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/evolution/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Gnome Evolution files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EVOLUTION_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_evolution_3",
    name: "GnomeEvolution",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/evolution/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Gnome Evolution files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WORD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_word",
    name: "MicrosoftOfficeAutosave",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Word\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Automatically created Microsoft Office recovery files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#microsoft-office-autosave"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXCEL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_excel",
    name: "MicrosoftOfficeAutosave",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Excel\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Automatically created Microsoft Office recovery files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#microsoft-office-autosave"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POWERPOINT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_powerpoint",
    name: "MicrosoftOfficeAutosave",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Powerpoint\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Automatically created Microsoft Office recovery files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#microsoft-office-autosave"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PUBLISHER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_publisher",
    name: "MicrosoftOfficeAutosave",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Publisher\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Automatically created Microsoft Office recovery files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#microsoft-office-autosave"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_MICROSOFT_OFFICE_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_microsoft_office_plist",
        name: "MicrosoftOfficeMRU",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.microsoft.office.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Microsoft Office Most Recently Used",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/mac4n6/macMRU-Parser"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_COM_MICROSOFT_SECUREBOOKMARKS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_com_microsoft_securebookmarks_plist",
    name: "MicrosoftOfficeMRU",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Containers/com.microsoft.*/Data/Library/Preferences/com.microsoft.*.securebookmarks.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Microsoft Office Most Recently Used",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/macMRU-Parser"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OUTLOOK_PAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_outlook_pab",
    name: "MicrosoftOutlookPABFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Outlook\\*.pab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Outlook PAB Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OUTLOOK_FILES_PAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_outlook_files_pab",
    name: "MicrosoftOutlookPABFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Documents\\Outlook Files\\*.pab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Outlook PAB Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OUTLOOK_PST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_outlook_pst",
    name: "MicrosoftOutlookPSTFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Outlook\\*.pst"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Outlook PST Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OUTLOOK_FILES_PST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_outlook_files_pst",
    name: "MicrosoftOutlookPSTFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Documents\\Outlook Files\\*.pst"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Outlook PST Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OUTLOOK_OST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_outlook_ost",
    name: "MicrosoftOutlookOSTFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Outlook\\*.ost"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Outlook OST Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OUTLOOK_FILES_OST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_outlook_files_ost",
    name: "MicrosoftOutlookOSTFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Documents\\Outlook Files\\*.ost"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Outlook OST Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NPM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_npm",
    name: "NodeJSPackageManagerCacheFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.npm/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Node JS package manager (NPM) cache files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://docs.npmjs.com/cli/cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NPM_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_npm_cache",
    name: "NodeJSPackageManagerCacheFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\npm-cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Node JS package manager (NPM) cache files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://docs.npmjs.com/cli/cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_ERRORLOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_errorlog",
    name: "MicrosoftSqlServerErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Microsoft SQL Server\\*\\MSSQL\\LOG\\ERRORLOG*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft SQL Server's error log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_ERRORLOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_errorlog_2",
    name: "MicrosoftSqlServerErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfilesx86%%\\Microsoft SQL Server\\*\\MSSQL\\LOG\\ERRORLOG*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft SQL Server's error log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_THUNDERBIRD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_thunderbird",
    name: "MozillaThunderbird",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.thunderbird/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Mozilla Thunderbird files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DROPBOX_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dropbox_db",
    name: "DropboxClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Dropbox\\*.db*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Dropbox cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/dropbox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DROPBOX_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dropbox_db_2",
    name: "DropboxClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Dropbox\\*.db*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Dropbox cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/dropbox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INSTANCE_SYNC_HISTORY_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_instance_sync_history_db",
    name: "DropboxClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Dropbox\\instance*\\sync_history.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Dropbox cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/dropbox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DROPBOX_DB_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dropbox_db_3",
    name: "DropboxClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.dropbox/*.db*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Dropbox cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/dropbox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INSTANCE_SYNC_HISTORY_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_instance_sync_history_db_2",
    name: "DropboxClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.dropbox/instance*/sync_history.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Dropbox cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/dropbox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVE_SNAPSHOT_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drive_snapshot_db",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\snapshot.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVE_SYNC_CONFIG_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drive_sync_config_db",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\sync_config.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVE_SYNC_CONFIG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drive_sync_config_log",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\sync_config.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SNAPSHOT_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_snapshot_db",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\user_default\\snapshot.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_sync_config_db",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\user_default\\sync_config.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_sync_config_log",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\user_default\\sync_config.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SYNC_LOG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_sync_log_log",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Drive\\user_default\\sync_log.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVE_SNAPSHOT_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drive_snapshot_db_2",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Drive/snapshot.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVE_SYNC_CONFIG_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drive_sync_config_db_2",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Drive/sync_config.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVE_SYNC_CONFIG_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drive_sync_config_log_2",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Drive/sync_config.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SNAPSHOT_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_snapshot_db_2",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Drive/user_default/snapshot.db",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_sync_config_db_2",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Drive/user_default/sync_config.db",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_default_sync_config_log_2",
    name: "GoogleDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Drive/user_default/sync_config.log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Drive cloud storage client artifacts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_drive"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_log_3",
    name: "SkyDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\SkyDrive\\logs\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Sky Drive cloud storage client artifacts.

Note that Sky Drive was renamed to One Drive.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/one_drive#sky-drive-client"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_LOG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_log_4",
    name: "SkyDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\SkyDrive\\setup\\logs\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Sky Drive cloud storage client artifacts.

Note that Sky Drive was renamed to One Drive.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/one_drive#sky-drive-client"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SETTINGS_APPLICATIONSETTINGS_XML: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_settings_applicationsettings_xml",
        name: "SkyDriveClient",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.localappdata%%\\Microsoft\\SkyDrive\\settings\\ApplicationSettings.xml",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Microsoft Sky Drive cloud storage client artifacts.

Note that Sky Drive was renamed to One Drive.
",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/one_drive#sky-drive-client"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_SETTINGS_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_settings_dat",
    name: "SkyDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\SkyDrive\\settings\\*.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Sky Drive cloud storage client artifacts.

Note that Sky Drive was renamed to One Drive.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/one_drive#sky-drive-client"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SETTINGS_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_settings_ini",
    name: "SkyDriveClient",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\SkyDrive\\settings\\*.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Sky Drive cloud storage client artifacts.

Note that Sky Drive was renamed to One Drive.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/one_drive#sky-drive-client"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_jupyter_jupyter_notebook_config_py",
        name: "JupyterConfigFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/.jupyter/jupyter_notebook_config.py"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Jupyter notebook configuration file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_jupyter_jupyter_notebook_config_py_2",
        name: "JupyterConfigFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/etc/jupyter/jupyter_notebook_config.py"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Jupyter notebook configuration file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_3: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_jupyter_jupyter_notebook_config_py_3",
        name: "JupyterConfigFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/private/etc/jupyter/jupyter_notebook_config.py"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Jupyter notebook configuration file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_4: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_jupyter_jupyter_notebook_config_py_4",
        name: "JupyterConfigFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/user/local/etc/jupyter/jupyter_notebook_config.py"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Jupyter notebook configuration file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_5: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_jupyter_jupyter_notebook_config_py_5",
        name: "JupyterConfigFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_programdata%%\\jupyter\\jupyter_notebook_config.py"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Jupyter notebook configuration file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ETC_EXPORTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_exports",
    name: "NfsExportsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/exports"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "NFS Exports configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_EXPORTS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_exports_2",
    name: "NfsExportsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/exports"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "NFS Exports configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_EXPORTS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_exports_3",
    name: "NfsExportsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/exports"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "NFS Exports configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_REDIS_WINDOWS_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_redis_windows_conf",
    name: "RedisConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Redis\\conf\\redis.windows.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Redis configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_REDIS_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_redis_conf",
    name: "RedisConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Redis\\conf\\redis.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Redis configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REDIS_REDIS_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_redis_redis_conf",
    name: "RedisConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/redis/redis.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Redis configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REDIS_REDIS_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_redis_redis_conf_2",
    name: "RedisConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/redis/redis.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Redis configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REDIS_REDIS_CONF_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_redis_redis_conf_3",
    name: "RedisConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/redis/redis.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Redis configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAMBA_SMB_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_samba_smb_conf",
    name: "SambaConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/samba/smb.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Samba configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_SSHD_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_sshd_config",
    name: "SshdConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ssh/sshd_config"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sshd configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_SSHD_CONFIG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_sshd_config_2",
    name: "SshdConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/ssh/sshd_config"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sshd configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_SSHD_CONFIG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_sshd_config_3",
    name: "SshdConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ssh/sshd_config"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Sshd configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_config",
    name: "SshUserConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.ssh/config"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "User ssh configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTAINERD_CONFIG_TOML: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_containerd_config_toml",
    name: "ContainerdConfig",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/containerd/config.toml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IO_CONTAINERD_METADATA_V1_BOLT_META_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_io_containerd_metadata_v1_bolt_meta_db",
        name: "ContainerdConfig",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/var/lib/containerd/io.containerd.metadata.v1.bolt/meta.db"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "containerd configuration files",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_IO_CONTAINERD_SNAPSHOTTER_V1_OVERLAYFS_METADATA_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_io_containerd_snapshotter_v1_overlayfs_metadata_db",
        name: "ContainerdConfig",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/metadata.db"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "containerd configuration files",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_CONFIG_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_json",
    name: "ContainerdConfig",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/containerd/io.containerd.runtime.v2.task/*/*/config.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPTIONS_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_options_json",
    name: "ContainerdConfig",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/containerd/io.containerd.runtime.v2.task/*/*/options.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_json",
    name: "ContainerdLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/containerd/io.containerd.runtime.v2.task/*/*/log.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd related events in the log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_DAEMON_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_daemon_log",
    name: "ContainerdLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/daemon.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd related events in the log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_DAEMON_LOG_GZ: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_daemon_log_gz",
    name: "ContainerdLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/daemon.log.*.gz"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd related events in the log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_SYSLOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_syslog",
    name: "ContainerdLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/syslog*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd related events in the log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_MESSAGE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_message",
    name: "ContainerdLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/message*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "containerd related events in the log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_access_log",
    name: "ElasticsearchAccessLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*_access.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch access logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_AUDIT_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_audit_json",
    name: "ElasticsearchAuditLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*_audit.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch audit logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.elastic.co/guide/en/elasticsearch/reference/current/audit-log-output.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_AUDIT_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_audit_log",
    name: "ElasticsearchAuditLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*_audit.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch audit logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.elastic.co/guide/en/elasticsearch/reference/current/audit-log-output.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_GC_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_gc_log",
    name: "ElasticsearchGCLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/gc.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch GC logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html#gc-logging"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_GC_LOG_0_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_gc_log_0_9",
    name: "ElasticsearchGCLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/gc.log.[0-9]"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch GC logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html#gc-logging"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_log",
    name: "ElasticsearchLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_json",
    name: "ElasticsearchLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_JSON_GZ: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_json_gz",
    name: "ElasticsearchLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*.json.gz"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_SERVER_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_server_json",
    name: "ElasticsearchServerLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*_server.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch server logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html#loggin-configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_JSON_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_json_2",
    name: "ElasticsearchServerLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*-*.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch server logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html#loggin-configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ELASTICSEARCH_JSON_GZ_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_elasticsearch_json_gz_2",
    name: "ElasticsearchServerLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/elasticsearch/*-*.json.gz"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Elasticsearch server logs are stored.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html#loggin-configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_MONGOD_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_mongod_conf",
    name: "MongoDBConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/etc/mongod.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "MongoDB configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.mongodb.com/docs/manual/reference/configuration-options/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_MONGOD_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_mongod_conf_2",
    name: "MongoDBConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/homebrew/etc/mongod.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "MongoDB configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.mongodb.com/docs/manual/reference/configuration-options/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_MONGOD_CONF_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_mongod_conf_3",
    name: "MongoDBConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/mongod.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "MongoDB configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.mongodb.com/docs/manual/reference/configuration-options/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MONGODB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mongodb",
    name: "MongoDBDatabasePath",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/var/mongodb/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "MongoDB database Path.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mongodb.com/docs/manual/reference/configuration-options/#mongodb-setting-storage.dbPath"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db",
    name: "MongoDBDatabasePath",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\data\\db\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "MongoDB database Path.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mongodb.com/docs/manual/reference/configuration-options/#mongodb-setting-storage.dbPath"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MONGODB_MONGOD_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mongodb_mongod_log",
    name: "MongoDBLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/mongodb/mongod.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MongoDB log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_MY_CNF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_my_cnf",
    name: "MySQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/my.cnf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MYSQL_CONF_D_MYSQLD_CNF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mysql_conf_d_mysqld_cnf",
    name: "MySQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/mysql/mysql.conf.d/mysqld.cnf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MYSQL_MYSQL_IBD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mysql_mysql_ibd",
    name: "MySQLDataDictionary",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/mysql/mysql.ibd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL data dictionary.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://dev.mysql.com/doc/refman/8.0/en/data-dictionary-transactional-storage.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MYSQL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mysql",
    name: "MySQLDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/mysql/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL data directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://dev.mysql.com/doc/refman/8.0/en/data-directory.html",
        "https://dev.mysql.com/doc/refman/8.0/en/innodb-architecture.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__2",
    name: "MySQLDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/mysql/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL data directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://dev.mysql.com/doc/refman/8.0/en/data-directory.html",
        "https://dev.mysql.com/doc/refman/8.0/en/innodb-architecture.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MYSQL_ERROR_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mysql_error_log",
    name: "MySQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/mysql/error.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_MYSQL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_mysql_log",
    name: "MySQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/mysql.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_log",
    name: "MySQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPENSEARCH_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opensearch_log",
    name: "OpenSearchLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/opensearch/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "OpenSearch log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://opensearch.org/docs/latest/opensearch/logs/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPENSEARCH_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opensearch_json",
    name: "OpenSearchLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/opensearch/*.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "OpenSearch log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://opensearch.org/docs/latest/opensearch/logs/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/postgresql/*/*/postgresql.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PG_HBA_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pg_hba_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/postgresql/*/*/pg_hba.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PG_IDENT_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pg_ident_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/postgresql/*/*/pg_ident.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PGSQL_POSTGRESQL_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pgsql_postgresql_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/postgresql.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PGSQL_PG_HBA_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pgsql_pg_hba_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/pg_hba.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PGSQL_PG_IDENT_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pgsql_pg_ident_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/pg_ident.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA_POSTGRESQL_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data_postgresql_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/postgresql.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA_PG_HBA_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data_pg_hba_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/pg_hba.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA_PG_IDENT_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data_pg_ident_conf",
    name: "PostgreSQLConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/pg_ident.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/runtime-config-file-locations.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data",
    name: "PostgreSQLDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL data directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/storage-file-layout.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA_OLD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data_old",
    name: "PostgreSQLDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data-old/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL data directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/storage-file-layout.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__3",
    name: "PostgreSQLDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL data directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/storage-file-layout.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__4",
    name: "PostgreSQLDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/postgresql/*/main/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL data directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://www.postgresql.org/docs/current/storage-file-layout.html",
        "https://docs.fedoraproject.org/en-US/quick-docs/postgresql/",
        "https://wiki.debian.org/PostgreSql",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_POSTGRESQL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_postgresql_log",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/postgresql/postgresql.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_POSTGRESQL_CSV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_postgresql_csv",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/postgresql/postgresql.csv*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_POSTGRESQL_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_postgresql_log_2",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/postgresql/postgresql-*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_POSTGRESQL_CSV_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_postgresql_csv_2",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/postgresql/postgresql-*.csv*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_POSTGRESQL_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_postgresql_log_3",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/postgresql/postgresql-*-*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_POSTGRESQL_CSV_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_postgresql_csv_3",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/postgresql/postgresql-*-*.csv*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_POSTGRESQL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_postgresql_log",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/log/postgresql.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_POSTGRESQL_CSV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_postgresql_csv",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/log/postgresql.csv*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_POSTGRESQL_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_postgresql_log_2",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/log/postgresql-*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_POSTGRESQL_CSV_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_postgresql_csv_2",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/log/postgresql-*.csv*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_POSTGRESQL_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_postgresql_log_3",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/log/postgresql-*-*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_POSTGRESQL_CSV_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_postgresql_csv_3",
    name: "PostgreSQLLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/data/log/postgresql-*-*.csv*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.postgresql.org/docs/14/runtime-config-logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REDIS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_redis",
    name: "RedisConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/redis/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redis configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INIT_D_REDIS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_init_d_redis",
    name: "RedisConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/init.d/redis_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redis configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REDIS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_redis_2",
    name: "RedisDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/redis/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redis Data Directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__5",
    name: "RedisDataDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/redis/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redis Data Directory.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REDIS_REDIS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_redis_redis_log",
    name: "RedisLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/redis/redis*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redis log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_REDIS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_redis_log",
    name: "RedisLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/redis*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redis log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_V2_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_v2_json",
    name: "DockerContainerConfig",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/docker/containers/*/config.v2.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Docker container configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_JSON_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_json_2",
    name: "DockerContainerConfig",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/docker/containers/*/config.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Docker container configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_JSON_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_json_log",
    name: "GKEDockerContainerLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/docker/containers/*/*-json.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where stdout and stderr from containers is logged in a Google Kubernetes Engine (GKE) environment.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_ESXAPIADAPTER_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_esxapiadapter_log",
    name: "ESXApiForwarder",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/log/esxapiadapter.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to the vSphere Trust Authority API forwarder.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_ATTESTD_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_attestd_log",
    name: "ESXiAttestationService",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/log/attestd.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to the vSphere Trust Authority Attestation Service.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_AUTH_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_auth_log",
    name: "ESXiAuthenticationLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/auth.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contains all events related to authentication for the local system.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_HOSTD_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_hostd_log",
    name: "ESXiHostAgentLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/hostd.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contains information about the agent that manages and configures the ESXi host and its virtual machines.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_KMXD_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_kmxd_log",
    name: "ESXiKeyProviderService",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/log/kmxd.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to the vSphere Trust Authority Key Provider Service.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_LOADESX_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_loadesx_log",
    name: "ESXiQuickBootLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/loadESX.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contains all events related to restarting an ESXi host through Quick Boot.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_SHELL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_shell_log",
    name: "ESXiShellLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/shell.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contains a record of all commands typed into the ESXi Shell and shell events (for example, when the shell was enabled)",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log",
    name: "ESXiSystemLogsDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/log/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "ESXi System Logs Directory",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.monitoring.doc/GUID-DACC9E0E-E857-4AE1-A469-3FDAE2B391A0.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_SYSLOG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_syslog_log",
    name: "ESXiSystemMessageslog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/syslog.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_ESXTOKEND_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_esxtokend_log",
    name: "ESXTokenService",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/log/esxtokend.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to the vSphere Trust Authority ESX Token Service.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_KMXA_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_kmxa_log",
    name: "ESXiTrustedInfrastructureAgentLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/log/kmxa.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to the Client Service on the ESXi Trusted Host.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_VMKERNEL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_vmkernel_log",
    name: "ESXiVMKernelLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/vmkernel.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to virtual machines and ESXi.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_VMKSUMMARYLOG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_vmksummarylog_log",
    name: "ESXiVMKernelSummaryLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/vmksummarylog.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Used to determine uptime and availability statistics for ESXi (comma separated).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_VMKWARNING_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_vmkwarning_log",
    name: "ESXiVMKernelWarningsLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/vmkwarning.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records activities related to virtual machines.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_VXPA_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_vxpa_log",
    name: "vCenterServerAgentLog",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/vxpa.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_3",
    name: "vSphereClientLogsDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/vmware/vsphere-ui/logs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "vSphere Client Logs Directory",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.monitoring.doc/GUID-7E10C58F-16EA-44AB-8AA0-8D4A66399879.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_LOGFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemdrive_logfile",
    name: "NTFSLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\$LogFile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The NTFS $LogFile file system metadata file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_MFT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemdrive_mft",
    name: "NTFSMFTFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\$MFT"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The NTFS $MFT and $MFTMirr file system metadata files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_MFTMIRR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemdrive_mftmirr",
    name: "NTFSMFTFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\$MFTMirr"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The NTFS $MFT and $MFTMirr file system metadata files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTEND_USNJRNL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extend_usnjrnl",
    name: "NTFSUSNJournal",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\$Extend\\$UsnJrnl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The NTFS $UsnJnrl file system metadata file.

Note that this currently does not include the $J alternate data stream name.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_4",
    name: "HadoopAppLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/hadoop/logs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTAINER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_container",
    name: "HadoopAppLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/hadoop/logs/userlogs/application_*/container_*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_5",
    name: "HadoopAppLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/**2/hadoop/logs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTAINER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_container_2",
    name: "HadoopAppLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/**2/hadoop/logs/userlogs/application_*/container_*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_APPLICATION: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_application",
    name: "HadoopAppRoot",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/hadoop/*/yarn/system/rmstore/FSRMStateRoot/RMAppRoot/application_*/application_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_APPLICATION_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_application_2",
    name: "HadoopAppRoot",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/hadoop/yarn/system/rmstore/FSRMStateRoot/RMAppRoot/application_*/application_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_APPLICATION_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_application_3",
    name: "HadoopAppRoot",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/**2/hadoop/*/yarn/system/rmstore/FSRMStateRoot/RMAppRoot/application_*/application_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_APPLICATION_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_application_4",
    name: "HadoopAppRoot",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/**2/hadoop/yarn/system/rmstore/FSRMStateRoot/RMAppRoot/application_*/application_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop application files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LEVELDB_TIMELINE_STORE_LDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_leveldb_timeline_store_ldb",
    name: "HadoopYarnLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/hadoop/yarn/timeline/leveldb-timeline-store.ldb/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop Yarn LevelDB/Timeline files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LEVELDB_TIMELINE_STORE_LDB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_leveldb_timeline_store_ldb_2",
    name: "HadoopYarnLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/hadoop/*/yarn/timeline/leveldb-timeline-store.ldb/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop Yarn LevelDB/Timeline files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LEVELDB_TIMELINE_STORE_LDB_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_leveldb_timeline_store_ldb_3",
    name: "HadoopYarnLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/**2/hadoop/yarn/timeline/leveldb-timeline-store.ldb/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop Yarn LevelDB/Timeline files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LEVELDB_TIMELINE_STORE_LDB_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_leveldb_timeline_store_ldb_4",
    name: "HadoopYarnLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/**2/hadoop/*/yarn/timeline/leveldb-timeline-store.ldb/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Hadoop Yarn LevelDB/Timeline files are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnose",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Siemens\\WinCC\\Diagnose\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSIS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnosis",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Common Files\\Siemens\\ace\\bin\\Diagnosis\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnose_2",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfilesx86%%\\Siemens\\WinCC\\Diagnose\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSIS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnosis_2",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfilesx86%%\\Common Files\\Siemens\\ace\\bin\\Diagnosis\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURITYCONTROLLER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_securitycontroller",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\security\\SecurityController\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGFILES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logfiles",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Siemens\\Automation\\Logfiles\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SETUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_setup",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Siemens\\Automation\\Logfiles\\Setup\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_6",
    name: "WindowsSiemensWinCCLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Siemens\\Logs\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Siemens WinCC software logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://cache.industry.siemens.com/dl/files/865/109757865/att_963121/v5/109757865_WinCC_Diagnostics_en.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/lib/python*/dist-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_2",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/lib/python*/site-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_3",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/dist-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_4",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/site-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_5",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/dist-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_6",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/site-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_7",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/dist-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_8",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/site-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_9",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/dist-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_INFO_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_info_10",
    name: "PythonDistInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/site-packages/*.dist-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the dist-info format of PEP-0376
(currently linux only).

dist-info is always a directory that must contain METADATA, RECORD and
INSTALLER. It may also contain REQUESTED.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.python.org/dev/peps/pep-0376/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/lib/python*/site-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_INFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_info",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/lib/python*/site-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PIP_EGG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pip_egg",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/pip/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PIP_EGG_INFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pip_egg_info",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/pip/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/dist-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_INFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_info",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/dist-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_2",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/site-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_INFO_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_info_2",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/site-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_2",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/dist-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_INFO_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_info_2",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/dist-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_3",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/site-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_INFO_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_info_3",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/site-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_3",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/dist-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_INFO_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_info_3",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/dist-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_4",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/site-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_INFO_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_info_4",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/site-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_4",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/dist-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIST_PACKAGES_EGG_INFO_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dist_packages_egg_info_4",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/dist-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_5",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/site-packages/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITE_PACKAGES_EGG_INFO_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_site_packages_egg_info_5",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/site-packages/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PYSHARED_EGG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pyshared_egg",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/pyshared/*.egg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PYSHARED_EGG_INFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pyshared_egg_info",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/pyshared/*.egg-info"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/lib/python*/site-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/lib/python*/site-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_2",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/pip/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_2",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/pip/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_3",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/dist-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_3",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/dist-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_4",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/site-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_4",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/python*/site-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_5",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/dist-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_5",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/dist-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_6",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/site-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_6",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib64/python*/site-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_7",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/dist-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_7",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/dist-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_8",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/site-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_8",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/python*/site-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_9",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/dist-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_9",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/dist-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_10",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/site-packages/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_10",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib64/python*/site-packages/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_11",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/pyshared/*.egg/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EGG_INFO_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_egg_info_11",
    name: "PythonEggInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/pyshared/*.egg-info/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in .egg formats (currently linux only).

Python eggs can have multiple formats, as described by setuptools.

.egg files can be either a zipfile or a directory that contains an info file.
.egg-info files can be either a directory or a file. If they are directories,
they should contain a MANIFEST that identifies the installed module.

PEP-0370 describes a default install location for per-user modules.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://pythonhosted.org/setuptools/formats.html",
        "https://www.python.org/dev/peps/pep-0370/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PYTHON_WHEELS_WHL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_python_wheels_whl",
    name: "PythonWheelInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/python-wheels/*.whl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the wheel format (currently linux only).

Zip archives with the .whl extension.

Wheels are installed per the standard installer described in PEP-0376, so
should mostly be discoverable as dist-info entries.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://wheel.readthedocs.org/en/latest/",
        "http://pip.readthedocs.org/en/stable/reference/pip_install/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WHEELS_WHL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wheels_whl",
    name: "PythonWheelInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/pip/wheels/*.whl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python module files distributed in the wheel format (currently linux only).

Zip archives with the .whl extension.

Wheels are installed per the standard installer described in PEP-0376, so
should mostly be discoverable as dist-info entries.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://wheel.readthedocs.org/en/latest/",
        "http://pip.readthedocs.org/en/stable/reference/pip_install/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_2_GEMSPEC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_2_gemspec",
    name: "RubyGems",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.gem/ruby/**2/*.gemspec"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Ruby Gems (currently linux only).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://guides.rubygems.org"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_2_GEMSPEC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_2_gemspec_2",
    name: "RubyGems",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/gems/**2/*.gemspec"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Ruby Gems (currently linux only).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://guides.rubygems.org"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_2_GEMSPEC_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_2_gemspec_3",
    name: "RubyGems",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/rubygems-integration/**2/*.gemspec"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Ruby Gems (currently linux only).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://guides.rubygems.org"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ATTACHMENTS_NOINDEX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_attachments_noindex",
    name: "SignalApplicationContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.var/app/org.signal.Signal/*/attachments.noindex/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Signal Application Content and Configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache",
    name: "SignalApplicationContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.var/app/org.signal.Signal/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Signal Application Content and Configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_7",
    name: "SignalApplicationContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.var/app/org.signal.Signal/*/logs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Signal Application Content and Configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ORG_SIGNAL_SIGNAL_CONFIG_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_org_signal_signal_config_json",
    name: "SignalApplicationContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.var/app/org.signal.Signal/config.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Signal Application Content and Configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ORG_SIGNAL_SIGNAL_DB_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_org_signal_signal_db_sqlite",
    name: "SignalDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.var/app/org.signal.Signal/db.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Signal Database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CHATSYNC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_chatsync",
    name: "SkypeChatSync",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Skype/*/chatsync/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Chat Sync Directory",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#skype"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MAIN_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_main_db",
    name: "SkypeDb",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Skype/*/Main.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Main Skype database",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#skype"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_SKYPE_SKYPE_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_skype_skype_plist",
        name: "SkypePreferences",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.skype.skype.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Skype Preferences and Recent Searches",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#skype"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE__6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__6",
    name: "SkypeUserProfile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Skype/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Skype User profile",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#skype"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_XCHATLOGS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_xchatlogs_log",
    name: "XChatLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.xchat2/xchatlogs/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "XChat Log Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://xchat.org/faq/#q222"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_2",
    name: "XChatLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.xchat2/xchatlogs/*/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "XChat Log Files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://xchat.org/faq/#q222"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_2",
    name: "JavaCacheFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.java/deployment/cache/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Java Plug-in cache.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_3",
    name: "JavaCacheFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Java/cache/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Java Plug-in cache.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_4",
    name: "JavaCacheFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Sun\\Java\\Deployment\\cache\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Java Plug-in cache.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_5",
    name: "JavaCacheFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Java Plug-in cache.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DS_STORE_APP_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ds_store_app_10",
    name: "KasperskyCaretoDarwinFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/.DS_Store.app/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Darwin file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHAGENTS_COM_APPLE_LAUNCHPORT_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchagents_com_apple_launchport_plist",
    name: "KasperskyCaretoDarwinFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/LaunchAgents/com.apple.launchport.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Darwin file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_AWCODC32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_awcodc32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\awcodc32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_AWVIEW32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_awview32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\awview32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_50225_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_50225_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_50225.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_50227_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_50227_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_50227.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_50229_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_50229_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_50229.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_51932_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_51932_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_51932.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_51936_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_51936_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_51936.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_51949_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_51949_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_51949.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_51950_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_51950_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_51950.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_57002_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_57002_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_57002.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_57006_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_57006_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_57006.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_57008_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_57008_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_57008.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_C_57010_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_c_57010_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\c_57010.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDGEXT32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdgext32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdgext32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDLLAIT32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdllait32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdllait32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDLLAIT64_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdllait64_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdllait64.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDLLUNINSTALLSGH32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdlluninstallsgh32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdlluninstallsgh32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDLLUNINSTALLSGH64_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdlluninstallsgh64_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdlluninstallsgh64.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDLLUNINSTALLWS32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdlluninstallws32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdlluninstallws32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CDLLUNINSTALLWS64_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cdlluninstallws64_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cdlluninstallws64.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CFGBKMGRS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cfgbkmgrs_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cfgbkmgrs.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_CFGMGR64_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_cfgmgr64_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\cfgmgr64.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_COMSVRPCS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_comsvrpcs_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\comsvrpcs.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_D3DX8_20_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_d3dx8_20_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\d3dx8_20.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_DLLCOMM_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_dllcomm_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\dllcomm.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DRIVERS_WMIMGR_SYS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_drivers_wmimgr_sys",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\drivers\\wmimgr.sys"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_DRVINFO_BIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_drvinfo_bin",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\drvinfo.bin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_FCACHE_BIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_fcache_bin",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\FCache.bin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_FFEXTENDEDCOMMAND_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_ffextendedcommand_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\FFExtendedCommand.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_GPKTCSP32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_gpktcsp32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\gpktcsp32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_HPQUEUE_BIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_hpqueue_bin",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\HPQueue.bin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_LPQUEUE_BIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_lpqueue_bin",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\LPQueue.bin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_MDWMNSP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_mdwmnsp_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\mdwmnsp.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_MFCN30_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_mfcn30_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\mfcn30.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_NMWCDLOG_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_nmwcdlog_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\nmwcdlog.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_OBJFRAME_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_objframe_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\objframe.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_RPCDIST_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_rpcdist_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\rpcdist.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SCSVRFT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_scsvrft_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\scsvrft.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SDPTBW_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_sdptbw_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\sdptbw.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SHLINK32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_shlink32_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\shlink32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SHLINK64_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_shlink64_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\shlink64.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SIIW9X_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_siiw9x_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\siiw9x.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SKYPEIE6PLUGIN_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_skypeie6plugin_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\skypeie6plugin.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SLBKBW_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_slbkbw_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\slbkbw.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_WIFISCAN_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_wifiscan_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\WifiScan.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_WMSPDMGR_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_wmspdmgr_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wmspdmgr.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MICROSOFT_C_27803_NLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_microsoft_c_27803_nls",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\microsoft\\c_27803.nls"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MICROSOFT_OBJFRAME_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_microsoft_objframe_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\microsoft\\objframe.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MICROSOFT_SHMGR_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_microsoft_shmgr_dll",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\microsoft\\shmgr.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_TEMP_DF01AC74D8BE15EE01_TMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_temp_df01ac74d8be15ee01_tmp",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.temp%%\\~DF01AC74D8BE15EE01.tmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_TEMP_DF23BF45A473C42B56_TMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_temp_df23bf45a473c42b56_tmp",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.temp%%\\~DF23BF45A473C42B56.tmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_TEMP_DF8471938479DA49221_TMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_temp_df8471938479da49221_tmp",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.temp%%\\~DF8471938479DA49221.tmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_TEMP_DFA0528CD81300F372_TMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_temp_dfa0528cd81300f372_tmp",
    name: "KasperskyCaretoWindowsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.temp%%\\~DFA0528CD81300F372.tmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Kaspersky Careto Windows file system indicators of compromise (IOCs).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KUBERNETES_ADMIN_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kubernetes_admin_conf",
    name: "KubernetesCertificates",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/kubernetes/admin.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Certificate files that are used for a Kubernetes cluster.

The files are typically only present on the control-plane node.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://kubernetes.io/docs/setup/best-practices/certificates/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KUBERNETES_CONTROLLER_MANAGER_CONF: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_kubernetes_controller_manager_conf",
        name: "KubernetesCertificates",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/etc/kubernetes/controller-manager.conf"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "Certificate files that are used for a Kubernetes cluster.

The files are typically only present on the control-plane node.
",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://kubernetes.io/docs/setup/best-practices/certificates/"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_KUBERNETES_KUBELET_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kubernetes_kubelet_conf",
    name: "KubernetesCertificates",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/kubernetes/kubelet.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Certificate files that are used for a Kubernetes cluster.

The files are typically only present on the control-plane node.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://kubernetes.io/docs/setup/best-practices/certificates/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KUBERNETES_SCHEDULER_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kubernetes_scheduler_conf",
    name: "KubernetesCertificates",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/kubernetes/scheduler.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Certificate files that are used for a Kubernetes cluster.

The files are typically only present on the control-plane node.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://kubernetes.io/docs/setup/best-practices/certificates/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SNAP_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_snap_db",
    name: "KubernetesClusterDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/etcd/member/snap/db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Kubernetes cluster (etcd) database.

The cluster database is hosted within a Pod and can be configured to be
deployed as distributed environment or single intance. The database is
mounted from the local file system into the corresponding containers
scheduled by a pod.

The database contains information about the clusters state, deployed
resourcees and also deleted components.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/",
        "https://github.com/etcd-io/etcd",
        "https://github.com/etcd-io/etcd/tree/main/tools/etcd-dump-db",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KUBELET_CONFIG_YAML: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kubelet_config_yaml",
    name: "KubernetesKubeletConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/kubelet/config.yaml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Files that stores the configuration of the local (Kubernetes) Kubelet.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/",
        "https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KUBERNETES_KUBELET_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kubernetes_kubelet_conf_2",
    name: "KubernetesKubeletConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/kubernetes/kubelet.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Files that stores the configuration of the local (Kubernetes) Kubelet.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/",
        "https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MANIFESTS_YAML: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_manifests_yaml",
    name: "KubernetesKubeletPodManifest",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/kubernetes/manifests/*.yaml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Manifest file that has been used to deploy a (Kubernetes) Pod.

The manifest contains the Pods specification.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_3",
    name: "KubernetesKubeletPodLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/pods/*/*/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where the log data of (Kubernetes) Pods can be found.

The path's name would contain the following elements:
'/var/log/pods/<namespace>_<pod_name>_<pod_id>/<container_name>/<num>.log'
Includes also redirected stdout, stderr and (if applicable) stdin of container executions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://github.com/kubernetes/kubernetes/pull/74441",
        "https://kubernetes.io/docs/concepts/cluster-administration/logging/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_SYSLOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_syslog_2",
    name: "KubernetesLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/syslog*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Log files that contain information about the Kubernetes installation of a node.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_PROFILELIST_PROFILESDIRECTORY: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_currentversion_profilelist_profilesdirectory",
        name: "AllUsersProfileEnvironmentVariable",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProfilesDirectory",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "The %AllUsersProfile% environment variable.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["http://support.microsoft.com/kb//214653"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_CURRENTVERSION_PROFILELIST_ALLUSERSPROFILE: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_currentversion_profilelist_allusersprofile",
        name: "AllUsersProfileEnvironmentVariable",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\AllUsersProfile",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "The %AllUsersProfile% environment variable.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["http://support.microsoft.com/kb//214653"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ETC_ENTERPRISE_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_enterprise_release",
    name: "LinuxRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/enterprise-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux specific distribution information.

See: lsb_release(1) man page, or the LSB Specification under the 'Command
Behaviour' section.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LSB_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_lsb_release",
    name: "LinuxRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/lsb-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux specific distribution information.

See: lsb_release(1) man page, or the LSB Specification under the 'Command
Behaviour' section.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ORACLE_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_oracle_release",
    name: "LinuxRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/oracle-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux specific distribution information.

See: lsb_release(1) man page, or the LSB Specification under the 'Command
Behaviour' section.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_REDHAT_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_redhat_release",
    name: "LinuxRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/redhat-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux specific distribution information.

See: lsb_release(1) man page, or the LSB Specification under the 'Command
Behaviour' section.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SYSTEM_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_system_release",
    name: "LinuxRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/system-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux specific distribution information.

See: lsb_release(1) man page, or the LSB Specification under the 'Command
Behaviour' section.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ANACRONTAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_anacrontab",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/anacrontab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRON_DAILY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cron_daily",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.daily/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRON_HOURLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cron_hourly",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.hourly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRON_MONTHLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cron_monthly",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.monthly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRON_WEEKLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cron_weekly",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.weekly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ANACRON_CRON_DAILY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_anacron_cron_daily",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/anacron/cron.daily"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ANACRON_CRON_HOURLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_anacron_cron_hourly",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/anacron/cron.hourly"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ANACRON_CRON_MONTHLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_anacron_cron_monthly",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/anacron/cron.monthly"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ANACRON_CRON_WEEKLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_anacron_cron_weekly",
    name: "AnacronFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/anacron/cron.weekly"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Anacron files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_APTITUDE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_aptitude",
    name: "AptitudeLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/aptitude*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux aptitude package manager log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.debian.org/doc/manuals/aptitude/rn01re01.en.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APT_SOURCES_LIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apt_sources_list",
    name: "APTSources",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apt/sources.list"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "APT package sources list",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://manpages.ubuntu.com/manpages/trusty/en/man5/sources.list.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SOURCES_LIST_D_LIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sources_list_d_list",
    name: "APTSources",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apt/sources.list.d/*.list"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "APT package sources list",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://manpages.ubuntu.com/manpages/trusty/en/man5/sources.list.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APT_TRUSTED_GPG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apt_trusted_gpg",
    name: "APTTrustKeys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apt/trusted.gpg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "APT trusted keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/SecureApt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRUSTED_GPG_D_GPG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_trusted_gpg_d_gpg",
    name: "APTTrustKeys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apt/trusted.gpg.d/*.gpg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "APT trusted keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/SecureApt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APT_TRUSTDB_GPG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apt_trustdb_gpg",
    name: "APTTrustKeys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apt/trustdb.gpg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "APT trusted keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/SecureApt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KEYRINGS_GPG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_keyrings_gpg",
    name: "APTTrustKeys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/keyrings/*.gpg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "APT trusted keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/SecureApt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CRON_ALLOW: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_cron_allow",
    name: "CronAtAllowDenyFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.allow"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Files containing users authorised to run cron or at jobs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://manpages.ubuntu.com/manpages/saucy/man5/at.allow.5.html",
        "http://manpages.ubuntu.com/manpages/precise/en/man1/crontab.1.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CRON_DENY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_cron_deny",
    name: "CronAtAllowDenyFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.deny"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Files containing users authorised to run cron or at jobs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://manpages.ubuntu.com/manpages/saucy/man5/at.allow.5.html",
        "http://manpages.ubuntu.com/manpages/precise/en/man1/crontab.1.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_AT_ALLOW: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_at_allow",
    name: "CronAtAllowDenyFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/at.allow"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Files containing users authorised to run cron or at jobs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://manpages.ubuntu.com/manpages/saucy/man5/at.allow.5.html",
        "http://manpages.ubuntu.com/manpages/precise/en/man1/crontab.1.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_AT_DENY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_at_deny",
    name: "CronAtAllowDenyFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/at.deny"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Files containing users authorised to run cron or at jobs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://manpages.ubuntu.com/manpages/saucy/man5/at.allow.5.html",
        "http://manpages.ubuntu.com/manpages/precise/en/man1/crontab.1.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_DPKG_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_dpkg_log",
    name: "DebianPackagesLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/dpkg.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux dpkg log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APT_HISTORY_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apt_history_log",
    name: "DebianPackagesLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apt/history.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux dpkg log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APT_TERM_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apt_term_log",
    name: "DebianPackagesLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apt/term.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux dpkg log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DPKG_STATUS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dpkg_status",
    name: "DebianPackagesStatus",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/dpkg/status"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux dpkg status file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_DEBIAN_VERSION: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_debian_version",
    name: "DebianVersion",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/debian_version"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Debian version information.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_RESOLV_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_resolv_conf",
    name: "DNSResolvConfFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/resolv.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "DNS Resolver configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://man7.org/linux/man-pages/man5/resolv.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GNOME_SHELL_APPLICATION_STATE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gnome_shell_application_state",
    name: "GnomeApplicationState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/gnome-shell/application_state"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Gnome application state for frequent application data.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/gnome_desktop_environment"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INFO_TRASHINFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_info_trashinfo",
    name: "FreeDesktopTrashInfoFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/Trash/info/*.trashinfo"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "FreeDesktop.org Trash Info Files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://specifications.freedesktop.org/trash-spec/trashspec-latest.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_files",
    name: "FreeDesktopTrashFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/Trash/files/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "FreeDesktop.org Trash Files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://specifications.freedesktop.org/trash-spec/trashspec-latest.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRACKER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tracker",
    name: "GnomeTracker",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/tracker/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Gnome Tracker database and backup files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.gnome.org/Projects/Tracker/Documentation/GettingStarted"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data_2",
    name: "GnomeTracker",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/tracker/data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Gnome Tracker database and backup files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.gnome.org/Projects/Tracker/Documentation/GettingStarted"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SHARE_RECENTLY_USED_XBEL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_share_recently_used_xbel",
    name: "GTKRecentlyUsedDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/recently-used.xbel"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "GTK Recent Manager database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_HOSTS_ALLOW: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_hosts_allow",
    name: "HostAccessPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/hosts.allow"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to host access policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_HOSTS_DENY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_hosts_deny",
    name: "HostAccessPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/hosts.deny"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to host access policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_MODULES_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_modules_conf",
    name: "KernelModules",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/modules.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Kernel modules to be loaded on boot.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MODPROBE_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_modprobe_d",
    name: "KernelModules",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/modprobe.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Kernel modules to be loaded on boot.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_LESSHST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_lesshst",
    name: "LessHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.lesshst"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "less history file which remembers search and shell commands",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man1/less.1.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_at",
    name: "LinuxAtJobs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/at/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux at jobs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SPOOL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_spool",
    name: "LinuxAtJobsTemporaryOutputs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/at/spool/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux at jobs temporary outputs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ATSPOOL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_atspool",
    name: "LinuxAtJobsTemporaryOutputs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/cron/atspool/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux at jobs temporary outputs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AUDIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_audit",
    name: "LinuxAuditLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/audit/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux audit log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_AUTH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_auth",
    name: "LinuxAuthLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/auth*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux authentication log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_SECURE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_secure",
    name: "LinuxAuthLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/secure*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux authentication log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CA_CERTIFICATES_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_ca_certificates_conf",
    name: "LinuxCACertificatesConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ca-certificates.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Linux CA Certificates configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CERTS_CA_CERTIFICATES_CRT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_certs_ca_certificates_crt",
    name: "LinuxCACertificates",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ssl/certs/ca-certificates.crt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux CA Certificates.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CA_CERTIFICATES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ca_certificates",
    name: "LinuxCACertificates",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/ca-certificates/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux CA Certificates.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CA_CERTIFICATES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ca_certificates_2",
    name: "LinuxCACertificates",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/share/ca-certificates/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux CA Certificates.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_CRON_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_cron_log",
    name: "LinuxCronLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/cron.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux cron log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CRONTAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_crontab",
    name: "LinuxCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/crontab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Crontab files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRON_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cron_d",
    name: "LinuxCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Crontab files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cron",
    name: "LinuxCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/cron/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Crontab files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_DAEMON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_daemon",
    name: "LinuxDaemonLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/daemon*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux daemon log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DHCP_DHCP_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dhcp_dhcp_conf",
    name: "LinuxDHCPConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/dhcp/dhcp.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux DHCP Configuration File",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CENTOS_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_centos_release",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/centos-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ENTERPRISE_RELEASE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_enterprise_release_2",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/enterprise-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ORACLE_RELEASE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_oracle_release_2",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/oracle-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_REDHAT_RELEASE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_redhat_release_2",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/redhat-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ROCKY_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_rocky_release",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rocky-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SUSE_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_suse_release",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/SuSE-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SYSTEM_RELEASE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_system_release_2",
    name: "LinuxDistributionRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/system-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux distribution release information of non-LSB compliant systems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABLES_DSDT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tables_dsdt",
    name: "LinuxDSDTTable",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/sys/firmware/acpi/tables/DSDT"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux file containing DSDT table.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/acpi/initrd_table_override.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_FSTAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_fstab",
    name: "LinuxFstab",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/fstab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux fstab file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://en.wikipedia.org/wiki/Fstab"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GRUB_GRUB_CFG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_grub_grub_cfg",
    name: "LinuxGrubConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/boot/grub/grub.cfg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux grub configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/GNU_GRUB"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GRUB2_GRUB_CFG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_grub2_grub_cfg",
    name: "LinuxGrubConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/boot/grub2/grub.cfg"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux grub configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/GNU_GRUB"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_HOSTNAME: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_hostname",
    name: "LinuxHostnameFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/hostname"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux hostname file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IF_UP_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_if_up_d",
    name: "LinuxIfUpDownScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/network/if-up.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "ifupdown scripts executed whenever a network interface goes up or down respectively.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IF_DOWN_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_if_down_d",
    name: "LinuxIfUpDownScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/network/if-down.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "ifupdown scripts executed whenever a network interface goes up or down respectively.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_INITRAMFS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_initramfs",
    name: "LinuxInitrdFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/boot/initramfs*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Initrd (initramfs) files in /boot/ executed on startup.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://en.wikipedia.org/wiki/Initrd",
        "https://www.kernel.org/doc/Documentation/initrd.txt",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_INITRD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_initrd",
    name: "LinuxInitrdFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/boot/initrd*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Initrd (initramfs) files in /boot/ executed on startup.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://en.wikipedia.org/wiki/Initrd",
        "https://www.kernel.org/doc/Documentation/initrd.txt",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ISSUE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_issue",
    name: "LinuxIssueFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/issue"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux prelogin message and identification (issue) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://linux.die.net/man/5/issue"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ISSUE_NET: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_issue_net",
    name: "LinuxIssueFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/issue.net"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux prelogin message and identification (issue) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://linux.die.net/man/5/issue"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_KRB5_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_krb5_conf",
    name: "LinuxKerberosConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/krb5.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux Kerberos configuration information.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_KERN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_kern",
    name: "LinuxKernelLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/kern*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux kernel log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_LASTLOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_lastlog",
    name: "LinuxLastlogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/lastlog"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux lastlog file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LD_SO_PRELOAD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_ld_so_preload",
    name: "LinuxLoaderSystemPreloadFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ld.so.preload"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux dynamic linker/loader system-wide preload file (ld.so.preload).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://man7.org/linux/man-pages/man8/ld.so.8.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INIT_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_init_d",
    name: "LinuxLSBInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/init.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux LSB-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/LSBInitScripts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_INSSERV_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_insserv_conf",
    name: "LinuxLSBInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/insserv.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux LSB-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/LSBInitScripts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INSSERV_CONF_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_insserv_conf_d",
    name: "LinuxLSBInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/insserv.conf.d/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux LSB-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/LSBInitScripts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LOCALTIME: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_localtime",
    name: "LinuxLocalTime",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/localtime"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Local time zone configuration",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LSB_RELEASE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_lsb_release_2",
    name: "LinuxLSBRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/lsb-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux Standard Base (LSB) release information",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://linux.die.net/man/1/lsb_release"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_MESSAGES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_messages",
    name: "LinuxMessagesLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/messages*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux messages log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_D_NAME_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_name_conf",
    name: "LinuxNetworkManager",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/NetworkManager/conf.d/name.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux NetworkManager files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/5/networkmanager.conf",
        "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORKMANAGER_NETWORKMANAGER_CONF: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_networkmanager_networkmanager_conf",
        name: "LinuxNetworkManager",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/etc/NetworkManager/NetworkManager.conf"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "Linux NetworkManager files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://linux.die.net/man/5/networkmanager.conf",
            "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_NETWORKMANAGER_SYSTEM_CONNECTIONS: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_networkmanager_system_connections",
        name: "LinuxNetworkManager",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/etc/NetworkManager/system-connections"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "Linux NetworkManager files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://linux.die.net/man/5/networkmanager.conf",
            "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_CONF_D_NAME_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_name_conf_2",
    name: "LinuxNetworkManager",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/NetworkManager/conf.d/name.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux NetworkManager files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/5/networkmanager.conf",
        "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_D_NAME_CONF_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_name_conf_3",
    name: "LinuxNetworkManager",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/NetworkManager/conf.d/name.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux NetworkManager files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/5/networkmanager.conf",
        "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORKMANAGER_NETWORKMANAGER_INTERN_CONF: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_networkmanager_networkmanager_intern_conf",
        name: "LinuxNetworkManager",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/var/lib/NetworkManager/NetworkManager-intern.conf"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "Linux NetworkManager files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://linux.die.net/man/5/networkmanager.conf",
            "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_NETWORKMANAGER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_networkmanager",
    name: "LinuxNetworkManager",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/NetworkManager/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux NetworkManager files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/5/networkmanager.conf",
        "https://man.archlinux.org/man/NetworkManager.conf.5.en#FILE_FORMAT",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PASSWD_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_passwd_cache",
    name: "LinuxNssCachePasswdFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/passwd.cache"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Local NSS database for remote directory services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/google/nsscache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PAM_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_pam_conf",
    name: "LinuxPamConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/pam.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Configuration files for PAM.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.linux-pam.org/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PAM_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_pam_d",
    name: "LinuxPamConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/pam.d"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Configuration files for PAM.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.linux-pam.org/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PAM_D_COMMON_PASSWORD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pam_d_common_password",
    name: "LinuxPamConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/pam.d/common-password"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Configuration files for PAM.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.linux-pam.org/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PAM_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pam_d",
    name: "LinuxPamConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/pam.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Configuration files for PAM.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.linux-pam.org/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PASSWD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_passwd",
    name: "LinuxPasswdFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/passwd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux passwd file.

A passwd file consist of colon separated values in the format:
username:password:uid:gid:full name:home directory:shell
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_RSYSLOG_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_rsyslog_conf",
    name: "LinuxRsyslogConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rsyslog.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux rsyslog configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.rsyslog.com/doc/rsyslog_conf.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_RSYSLOG_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_rsyslog_d",
    name: "LinuxRsyslogConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rsyslog.d"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux rsyslog configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.rsyslog.com/doc/rsyslog_conf.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RSYSLOG_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rsyslog_d",
    name: "LinuxRsyslogConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rsyslog.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux rsyslog configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://www.rsyslog.com/doc/rsyslog_conf.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABLES_SSDT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tables_ssdt",
    name: "LinuxSSDTTables",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/sys/firmware/acpi/tables/SSDT*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files containing SSDT table.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/acpi/initrd_table_override.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUDO_IO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sudo_io",
    name: "LinuxSudoReplayLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/sudo-io/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sudoreplay log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSCTL_D_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysctl_d_conf",
    name: "LinuxSysctlConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/sysctl.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sysctl preload/configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/sysctl.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSCTL_D_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysctl_d_conf_2",
    name: "LinuxSysctlConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/sysctl.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sysctl preload/configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/sysctl.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSCTL_D_CONF_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysctl_d_conf_3",
    name: "LinuxSysctlConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/lib/sysctl.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sysctl preload/configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/sysctl.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSCTL_D_CONF_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysctl_d_conf_4",
    name: "LinuxSysctlConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/sysctl.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sysctl preload/configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/sysctl.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSCTL_D_CONF_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysctl_d_conf_5",
    name: "LinuxSysctlConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/lib/sysctl.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sysctl preload/configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/sysctl.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SYSCTL_CON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_sysctl_con",
    name: "LinuxSysctlConfigurationFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/sysctl.con"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux sysctl preload/configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/sysctl.conf.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_SYSLOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_syslog_3",
    name: "LinuxSysLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/syslog*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux syslog log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSLOG_NG_SYSLOG_NG_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_syslog_ng_syslog_ng_conf",
    name: "LinuxSyslogNgConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/syslog-ng/syslog-ng.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux syslog-ng configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://linux.die.net/man/5/syslog-ng.conf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_D_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_conf",
    name: "LinuxSyslogNgConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/syslog-ng/conf-d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux syslog-ng configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://linux.die.net/man/5/syslog-ng.conf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMD_JOURNALD_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_systemd_journald_conf",
    name: "LinuxSystemdJournalConfig",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/journald.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd journal config file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.archlinux.org/title/Systemd/Journal"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_journal",
    name: "LinuxSystemdJournalLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/journal/*/*.journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd journal log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.archlinux.org/title/Systemd/Journal"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_journal_2",
    name: "LinuxSystemdJournalLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/journal/*/*.journal~"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd journal log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.archlinux.org/title/Systemd/Journal"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_OS_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_os_release",
    name: "LinuxSystemdOSRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/os-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd /etc/os-release file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/os-release.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LIB_OS_RELEASE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lib_os_release",
    name: "LinuxSystemdOSRelease",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/os-release"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd /etc/os-release file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/os-release.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_CONTROL_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_control_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/system.control/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMD_ATTACHED_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_systemd_attached_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/systemd.attached/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/system/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/lib/systemd/system/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/lib/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_EARLY_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_early_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/generator.early/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_LATE_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_late_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/generator.late/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/generator/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_CONTROL_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_control_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/system.control/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMD_ATTACHED_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_systemd_attached_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/systemd.attached/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_SERVICE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_service_3",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/system/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRANSIENT_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_transient_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/transient/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service_3",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_EARLY_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_early_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/generator.early/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_LATE_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_late_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/generator.late/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/generator/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRANSIENT_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_transient_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/transient/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_CONTROL_SERVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_control_service",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/user.control/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service_4",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_SERVICE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_service_4",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/systemd/system/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service_5",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_CONTROL_SERVICE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_control_service_2",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/systemd/user.control/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service_6",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_SERVICE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_service_7",
    name: "LinuxSystemdServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/systemd/user/*.service"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd service unit files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.unit.html#System%20Unit%20Search%20Path"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_CONTROL_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_control_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/system.control/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMD_ATTACHED_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_systemd_attached_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/systemd.attached/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/system/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/lib/systemd/system/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/lib/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_EARLY_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_early_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/generator.early/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_LATE_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_late_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/generator.late/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/generator/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_CONTROL_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_control_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/system.control/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMD_ATTACHED_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_systemd_attached_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/systemd.attached/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_TIMER_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_timer_3",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/system/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRANSIENT_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_transient_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/transient/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer_3",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_EARLY_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_early_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/generator.early/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_LATE_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_late_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/generator.late/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GENERATOR_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_generator_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/generator/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRANSIENT_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_transient_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/transient/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_CONTROL_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_control_timer",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/user.control/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer_4",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/user/*/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_TIMER_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_timer_4",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/systemd/system/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer_5",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_CONTROL_TIMER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_control_timer_2",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/systemd/user.control/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer_6",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_TIMER_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_timer_7",
    name: "LinuxSystemdTimers",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/systemd/user/*.timer"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux systemd Timer files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.freedesktop.org/software/systemd/man/systemd.timer.html#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_RC_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_rc_local",
    name: "LinuxSysVInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rc.local"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Services started by sysv-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://savannah.nongnu.org/projects/sysvinit",
        "http://docs.oracle.com/cd/E37670_01/E41138/html/ol_svcscripts.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_RC_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_rc_d",
    name: "LinuxSysVInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rc*.d"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Services started by sysv-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://savannah.nongnu.org/projects/sysvinit",
        "http://docs.oracle.com/cd/E37670_01/E41138/html/ol_svcscripts.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RC_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rc_d",
    name: "LinuxSysVInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rc*.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Services started by sysv-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://savannah.nongnu.org/projects/sysvinit",
        "http://docs.oracle.com/cd/E37670_01/E41138/html/ol_svcscripts.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RC_D_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rc_d_2",
    name: "LinuxSysVInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rc.d/rc*.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Services started by sysv-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://savannah.nongnu.org/projects/sysvinit",
        "http://docs.oracle.com/cd/E37670_01/E41138/html/ol_svcscripts.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INIT_D_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_init_d_2",
    name: "LinuxSysVInit",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rc.d/init.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Services started by sysv-style init scripts.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://savannah.nongnu.org/projects/sysvinit",
        "http://docs.oracle.com/cd/E37670_01/E41138/html/ol_svcscripts.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_TIMEZONE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_timezone",
    name: "LinuxTimezoneFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/timezone"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux timezone file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RULES_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rules_d",
    name: "LinuxUdevRules",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/udev/rules.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux udev rules for the events received by the udev's daemon from the Linux kernel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.archlinux.org/title/Udev"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RULES_D_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rules_d_2",
    name: "LinuxUdevRules",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/udev/rules.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux udev rules for the events received by the udev's daemon from the Linux kernel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.archlinux.org/title/Udev"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_BTMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_btmp",
    name: "LinuxUtmpFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/btmp*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux btmp, utmp and wtmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_WTMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_wtmp",
    name: "LinuxUtmpFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/wtmp*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux btmp, utmp and wtmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RUN_UTMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_run_utmp",
    name: "LinuxUtmpFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/utmp*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux btmp, utmp and wtmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_WTMP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_wtmp_2",
    name: "LinuxWtmp",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/wtmp*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux wtmp login record file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_XINETD_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_xinetd_conf",
    name: "LinuxXinetd",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/xinetd.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux xinetd configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://en.wikipedia.org/wiki/Xinetd"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_XINETD_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_xinetd_d",
    name: "LinuxXinetd",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/xinetd.d/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux xinetd configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://en.wikipedia.org/wiki/Xinetd"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MLOCATE_MLOCATE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mlocate_mlocate_db",
    name: "LocateDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/mlocate/mlocate.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "locate/mlocate database and updatedb configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/1/locate",
        "https://linux.die.net/man/8/updatedb",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_UPDATEDB_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_updatedb_conf",
    name: "LocateDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/updatedb.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "locate/mlocate database and updatedb configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/1/locate",
        "https://linux.die.net/man/8/updatedb",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_NETGROUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_netgroup",
    name: "LoginPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/netgroup"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to login policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_NSSWITCH_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_nsswitch_conf",
    name: "LoginPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/nsswitch.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to login policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PASSWD_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_passwd_2",
    name: "LoginPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/passwd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to login policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SHADOW: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_shadow",
    name: "LoginPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/shadow"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to login policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURITY_ACCESS_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_security_access_conf",
    name: "LoginPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/security/access.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to login policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_K5LOGIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_k5login",
    name: "LoginPolicyConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.k5login"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux files related to login policy configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MYSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mysql_history",
    name: "MySQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/.mysql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_MYSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_mysql_history",
    name: "MySQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.mysql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_MYSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_mysql_history",
    name: "MySQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mysql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "MySQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_NANO_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_nano_history",
    name: "NanoHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.nano_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "nano history file that logs search and replace strings.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nano-editor.org/dist/v2.2/nano.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_NETGROUP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_netgroup_2",
    name: "NetgroupConfiguration",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/netgroup"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Linux netgroup configuration.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_NTP_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_ntp_conf",
    name: "NtpConfFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ntp.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "The configuration file for ntpd. e.g. ntp.conf.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.freebsd.org/cgi/man.cgi?query=ntp.conf&sektion=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_VENDOR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_vendor",
    name: "PCIDevicesInfoFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/sys/bus/pci/devices/*/vendor"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Info and config files for PCI devices located on the system.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-bus-pci",
        "https://www.kernel.org/doc/Documentation/filesystems/sysfs-pci.txt",
        "https://wiki.debian.org/HowToIdentifyADevice/PCI",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DEVICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_device",
    name: "PCIDevicesInfoFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/sys/bus/pci/devices/*/device"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Info and config files for PCI devices located on the system.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-bus-pci",
        "https://www.kernel.org/doc/Documentation/filesystems/sysfs-pci.txt",
        "https://wiki.debian.org/HowToIdentifyADevice/PCI",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CLASS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_class",
    name: "PCIDevicesInfoFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/sys/bus/pci/devices/*/class"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Info and config files for PCI devices located on the system.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-bus-pci",
        "https://www.kernel.org/doc/Documentation/filesystems/sysfs-pci.txt",
        "https://wiki.debian.org/HowToIdentifyADevice/PCI",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config",
    name: "PCIDevicesInfoFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/sys/bus/pci/devices/*/config"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Info and config files for PCI devices located on the system.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-bus-pci",
        "https://www.kernel.org/doc/Documentation/filesystems/sysfs-pci.txt",
        "https://wiki.debian.org/HowToIdentifyADevice/PCI",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_psql_history",
    name: "PostgreSQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/.psql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_PSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_psql_history",
    name: "PostgreSQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.psql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_POSTGRESQL_PSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_postgresql_psql_history",
    name: "PostgreSQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/postgresql/.psql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PGSQL_PSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pgsql_psql_history",
    name: "PostgreSQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/pgsql/.psql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_PSQL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_psql_history",
    name: "PostgreSQLHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.psql_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PostgreSQL History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_PYTHON_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_python_history",
    name: "PythonHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.python_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Python REPL history file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_RHOSTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_rhosts",
    name: "RHostsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.rhosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "RHosts file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAMBA_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_samba_log",
    name: "SambaLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/samba/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Samba log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.samba.org/index.php/Configuring_Logging_on_a_Samba_Server"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECRETS_SECRETS_LDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secrets_secrets_ldb",
    name: "SecretsServiceDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/sss/secrets/secrets.ldb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "The System Security Services Daemon (SSSD) database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://docs.pagure.org/SSSD.sssd/design_pages/secrets_service.html", "https://www.fireeye.com/blog/threat-research/2020/04/kerberos-tickets-on-linux-red-teams.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECRETS_SECRETS_MKEY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secrets_secrets_mkey",
    name: "SecretsServiceDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/sss/secrets/.secrets.mkey"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "The System Security Services Daemon (SSSD) database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://docs.pagure.org/SSSD.sssd/design_pages/secrets_service.html", "https://www.fireeye.com/blog/threat-research/2020/04/kerberos-tickets-on-linux-red-teams.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_SQLITE_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_sqlite_history",
    name: "SQLiteHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.sqlite_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SQLite History file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_AUTHORIZED_KEYS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_authorized_keys",
    name: "SSHAuthorizedKeysFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.ssh/authorized_keys"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SSH authorized keys files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_AUTHORIZED_KEYS2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_authorized_keys2",
    name: "SSHAuthorizedKeysFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.ssh/authorized_keys2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SSH authorized keys files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_SSH_HOST_KEY_PUB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_ssh_host_key_pub",
    name: "SSHHostPubKeys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ssh/ssh_host_*_key.pub"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SSH host public keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_KNOWN_HOSTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_known_hosts",
    name: "SSHKnownHostsFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.ssh/known_hosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SSH known_hosts files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SSH_KNOWN_HOSTS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ssh_known_hosts_2",
    name: "SSHKnownHostsFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ssh/known_hosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SSH known_hosts files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_THUMBNAILS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_thumbnails_3",
    name: "ThumbnailCacheFolder",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.thumbnails/**3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Thumbnail cache folder.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DEFAULT_UFW: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_default_ufw",
    name: "UFWConfigFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/default/ufw"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "UFW Configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_UFW_SYSCTL_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ufw_sysctl_conf",
    name: "UFWConfigFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ufw/sysctl.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "UFW Configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_UFW_RULES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ufw_rules",
    name: "UFWConfigFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ufw/*.rules"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "UFW Configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATIONS_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_applications_d",
    name: "UFWConfigFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ufw/applications.d/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "UFW Configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_UFW_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_ufw_log",
    name: "UFWLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/ufw.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "UFW Log file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_VIMINFO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_viminfo",
    name: "Viminfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.viminfo"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Viminfo file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_WGET_HSTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_wget_hsts",
    name: "WgetHSTSdatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.wget-hsts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Default wget HTTP Strict Transport Security (HSTS) database",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.gnu.org/software/wget/manual/html_node/HTTPS-_0028SSL_002fTLS_0029-Options.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AUTOSTART_DESKTOP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_autostart_desktop",
    name: "XDGAutostartEntries",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/xdg/autostart/*.desktop"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "XDG Autostart Entries",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AUTOSTART_DESKTOP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_autostart_desktop_2",
    name: "XDGAutostartEntries",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/autostart/*.desktop"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "XDG Autostart Entries",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_YUM_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_yum_conf",
    name: "YumSources",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/yum.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Yum package sources list",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sec-Configuring_Yum_and_Yum_Repositories.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_YUM_REPOS_D_REPO: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_yum_repos_d_repo",
    name: "YumSources",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/yum.repos.d/*.repo"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Yum package sources list",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sec-Configuring_Yum_and_Yum_Repositories.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZEITGEIST_ACTIVITY_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zeitgeist_activity_sqlite",
    name: "ZeitgeistDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/zeitgeist/activity.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Zeitgeist user activity database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/zeitgeist"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZEITGEIST_ACTIVITY_SQLITE_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zeitgeist_activity_sqlite_wal",
    name: "ZeitgeistDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/zeitgeist/activity.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Zeitgeist user activity database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/zeitgeist"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_RANDOMIZE_VA_SPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_randomize_va_space",
    name: "LinuxASLREnabled",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/randomize_va_space"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Kernel ASLR state.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IPV4_ICMP_ECHO_IGNORE_BROADCASTS: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_ipv4_icmp_echo_ignore_broadcasts",
        name: "LinuxIgnoreICMPBroadcasts",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "Whether the system ignores ICMP pings.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_KERNEL_BOOTLOADER_TYPE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_bootloader_type",
    name: "LinuxKernelBootloader",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/bootloader_type"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Bootloader state acquired from the kernel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_BOOTLOADER_VERSION: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_bootloader_version",
    name: "LinuxKernelBootloader",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/bootloader_version"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Bootloader state acquired from the kernel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_KEXEC_LOAD_DISABLED: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_kexec_load_disabled",
    name: "LinuxKernelModuleRestrictions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/kexec_load_disabled"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Module loading controls.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_MODULES_DISABLED: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_modules_disabled",
    name: "LinuxKernelModuleRestrictions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/modules_disabled"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Module loading controls.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_TAINTED: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_tainted",
    name: "LinuxKernelModuleTaintStatus",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/tainted"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Taint state of loaded modules (binary blobs, unsigned modules etc).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FORWARDING: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_forwarding",
    name: "LinuxNetworkIpForwardingState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv*/conf/*/forwarding"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "IP forwarding states.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MC_FORWARDING: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mc_forwarding",
    name: "LinuxNetworkIpForwardingState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/conf/*/mc_forwarding"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "IP forwarding states.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IPV4_IP_FORWARD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ipv4_ip_forward",
    name: "LinuxNetworkIpForwardingState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/ip_forward"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "IP forwarding states.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCEPT_SOURCE_ROUTE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_accept_source_route",
    name: "LinuxNetworkPathFilteringSettings",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv*/conf/*/accept_source_route"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "States that determine how the system responds to route manipulation.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RP_FILTER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rp_filter",
    name: "LinuxNetworkPathFilteringSettings",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/conf/*/rp_filter"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "States that determine how the system responds to route manipulation.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_MARTIANS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_martians",
    name: "LinuxNetworkPathFilteringSettings",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/conf/*/log_martians"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "States that determine how the system responds to route manipulation.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCEPT_REDIRECTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_accept_redirects",
    name: "LinuxNetworkRedirectState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv*/conf/*/accept_redirects"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redirect send/receive states.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_REDIRECTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_redirects",
    name: "LinuxNetworkRedirectState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/conf/*/secure_redirects"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redirect send/receive states.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SEND_REDIRECTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_send_redirects",
    name: "LinuxNetworkRedirectState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/conf/*/send_redirects"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Redirect send/receive states.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NET_ARP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_net_arp",
    name: "LinuxProcArp",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/net/arp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "ARP table via /proc/net/arp.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PROC_MOUNTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_proc_mounts",
    name: "LinuxProcMounts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/mounts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Current mounted filesystems.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/filesystems/proc.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_DMESG_RESTRICT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_dmesg_restrict",
    name: "LinuxRestrictedDmesgReadPrivileges",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/dmesg_restrict"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Restrict whether non-privileged users can read dmesg.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KERNEL_KPTR_RESTRICT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kernel_kptr_restrict",
    name: "LinuxRestrictedKernelPointerReadPrivileges",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/kernel/kptr_restrict"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Memory address obfuscation settings.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/kernel.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_PROTECTED_HARDLINKS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_protected_hardlinks",
    name: "LinuxSecureFsLinks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/fs/protected_hardlinks"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Security controls to restrict operations on links in world writable directories.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/fs.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_PROTECTED_SYMLINKS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_protected_symlinks",
    name: "LinuxSecureFsLinks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/fs/protected_symlinks"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Security controls to restrict operations on links in world writable directories.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/fs.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_SUID_DUMPABLE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_suid_dumpable",
    name: "LinuxSecureSuidCoreDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/fs/suid_dumpable"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Security controls for suid core dumps.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/sysctl/fs.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IPV4_TCP_SYNCOOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ipv4_tcp_syncookies",
    name: "LinuxSyncookieState",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/proc/sys/net/ipv4/tcp_syncookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Whether the system uses syncookies.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_8",
    name: "ApacheKafkaLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/kafka/logs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Apache Kafka Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CONTROLLER_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_controller_log",
    name: "ApacheKafkaLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/kafka/logs/controller.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Apache Kafka Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_KAFKA_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_kafka_log",
    name: "ApacheKafkaLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/kafka/logs/kafka-*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Apache Kafka Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_SERVER_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_server_log",
    name: "ApacheKafkaLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/kafka/logs/server.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Apache Kafka Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_STATE_CHANGE_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_state_change_log",
    name: "ApacheKafkaLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/kafka/logs/state-change.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Apache Kafka Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HAPROXY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_haproxy",
    name: "HAProxyLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/haproxy/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "HAProxy Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#8",
        "https://www.haproxy.com/blog/introduction-to-haproxy-logging/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_HAPROXY_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_haproxy_log",
    name: "HAProxyLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/haproxy.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "HAProxy Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#8",
        "https://www.haproxy.com/blog/introduction-to-haproxy-logging/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_HAPROXY_TRAFFIC_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_haproxy_traffic_log",
    name: "HAProxyLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/haproxy-traffic.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "HAProxy Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#8",
        "https://www.haproxy.com/blog/introduction-to-haproxy-logging/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_HAPROXY_ADMIN_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_haproxy_admin_log",
    name: "HAProxyLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/haproxy-admin.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "HAProxy Log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#8",
        "https://www.haproxy.com/blog/introduction-to-haproxy-logging/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_JENKINS_JENKINS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_jenkins_jenkins_log",
    name: "JenkinsLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/jenkins/jenkins.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Jenkins log file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.jenkins.io/display/JENKINS/Logging.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OSQUERY_OSQUERYD_RESULTS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_osquery_osqueryd_results_log",
    name: "OsqueryLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/osquery/osqueryd.results.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Osquery daemon log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://osquery.readthedocs.io/en/stable/deployment/logging/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OSQUERY_OSQUERYD_SNAPSHOTS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_osquery_osqueryd_snapshots_log",
    name: "OsqueryLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/osquery/osqueryd.snapshots.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Osquery daemon log files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://osquery.readthedocs.io/en/stable/deployment/logging/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_addressbook_addressbookimages_sqlitedb",
    name: "MacOSAddressBookImagesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/Xcode.app/Contents/Developer/Platforms/*.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/*.simruntime/Contents/Resources/SampleContent/Library/AddressBook/AddressBookImages.sqlitedb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Address book images SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_addressbook_addressbookimages_sqlitedb_2",
    name: "MacOSAddressBookImagesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Developer/CoreSimulator/Devices/*/data/Library/AddressBook/AddressBookImages.sqlitedb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Address book images SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMCONFIGURATION_COM_APPLE_AIRPORT_PREFERENCES_PL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_systemconfiguration_com_apple_airport_preferences_pl",
        name: "MacOSAirportPreferencesPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Airport (wireless networking) preferences property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://artifacts-kb.readthedocs.io/en/latest/sources/macos/NetworkSettings.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_APPLEPUSHSERVICE_APS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_applepushservice_aps_db",
    name: "MacOSApplePushServiceSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Application Support/ApplePushService/aps.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple push service SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_APPLESETUPDONE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_applesetupdone",
    name: "MacOSAppleSetupDoneFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/.AppleSetupDone"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mac OS .AppleSetupDone file that hints to the system installation date and time.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-settings-and-informations",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_APPLESETUPDONE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_applesetupdone_2",
    name: "MacOSAppleSetupDoneFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/.AppleSetupDone"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mac OS .AppleSetupDone file that hints to the system installation date and time.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-settings-and-informations",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ASL_ASL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_asl_asl",
    name: "MacOSAppleSystemLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/asl/*.asl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple system log (ASL) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs",
        "https://support.apple.com/guide/console/reports-cnsl664be99a/mac",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSTICMESSAGES_ASL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnosticmessages_asl",
    name: "MacOSAppleSystemLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/DiagnosticMessages/*.asl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple system log (ASL) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs",
        "https://support.apple.com/guide/console/reports-cnsl664be99a/mac",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ASL_ASL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_asl_asl_2",
    name: "MacOSAppleSystemLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/asl/*.asl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple system log (ASL) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs",
        "https://support.apple.com/guide/console/reports-cnsl664be99a/mac",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSTICMESSAGES_ASL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnosticmessages_asl_2",
    name: "MacOSAppleSystemLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/DiagnosticMessages/*.asl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple system log (ASL) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs",
        "https://support.apple.com/guide/console/reports-cnsl664be99a/mac",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_db",
    name: "MacOSApplicationBundleCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/*/Cache.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Application bundle cache SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_STRINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_strings",
    name: "MacOSApplicationResourcesStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*.app/Contents/Resources/*.lproj/*.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Application resources strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_STRINGS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_strings_2",
    name: "MacOSApplicationResourcesStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*/*.app/Contents/Resources/*.lproj/*.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Application resources strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_ASSETCACHE_ASSETINFO_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_com_apple_assetcache_assetinfo_db",
        name: "MacOSAssetCacheInfoSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Caches/com.apple.AssetCache/AssetInfo.db"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Asset cache information SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_DB_AUTH_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_auth_db",
    name: "MacOSAuthorizationRulesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/auth.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Authorization rules SQLite database file.

Superscedes /etc/authorization seen Mac OS X 10.8 Mountain Lion and earlier versions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_AUTH_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_auth_db_2",
    name: "MacOSAuthorizationRulesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/auth.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Authorization rules SQLite database file.

Superscedes /etc/authorization seen Mac OS X 10.8 Mountain Lion and earlier versions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CALENDARS_CALENDAR_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_calendars_calendar_cache",
    name: "MacOSCalendarCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Calendars/Calendar Cache"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Calendar cache SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CALLHISTORYDB_CALLHISTORY_STOREDATA: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_callhistorydb_callhistory_storedata",
        name: "MacOSCallHistoryCacheSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Application Support/CallHistoryDB/CallHistory.storedata",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Call history cache SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_LSSHAREDFILELIST_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_lssharedfilelist_plist",
        name: "MacOSApplicationsRecentItems",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/*.LSSharedFileList.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Recent Items application specific",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#recent-items"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_JOBS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_jobs",
    name: "MacOSAtJobs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/cron/jobs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "MacOS at jobs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc", "https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/at.1.html#//apple_ref/doc/man/1/at"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AUDIT_0_9_0_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_audit_0_9_0_9",
    name: "MacOSAuditLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/audit/[0-9]*.[0-9]*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Audit log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AUDIT_0_9_0_9_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_audit_0_9_0_9_2",
    name: "MacOSAuditLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/audit/[0-9]*.[0-9]*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Audit log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_BLUETOOTH_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_bluetooth_plist",
        name: "MacOSBluetoothPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/com.apple.Bluetooth.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Bluetooth preferences and paired device information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/Utilities/*.app/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_2",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/CoreServices/*.app/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_3",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_4",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_5",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/PlugIns/*.plugin/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_6",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.bundle/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_7",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/Resources/*.bundle/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_8",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Filesystems/*/*.kext/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_9",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Filesystems/*/Encodings/*.kext/Contents/_CodeSignature/CodeResources",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CODESIGNATURE_CODERESOURCES_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_codesignature_coderesources_10",
    name: "MacOSCodeSignatureCodeResourcesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.kext/Contents/_CodeSignature/CodeResources"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Code signature CodeResources plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*/*.app/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_2",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*/*.app/Contents/Resources/*.help/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_3",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/CoreServices/*.app/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_4",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_5",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Info.plist",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_6",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/PlugIns/*.plugin/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_7",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.bundle/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_8",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Extensions/*.kext/Contents/Resources/*.bundle/Contents/Info.plist",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KEXT_INFO_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kext_info_plist",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/PlugIns/*.kext/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_9",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Filesystems/*/*.kext/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_10",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Filesystems/*/Encodings/*.kext/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RESOURCES_INFO_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_resources_info_plist",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Frameworks/*.framework/Versions/A/Resources/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_INFO_PLIST_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_info_plist_11",
    name: "MacOSContentsInfoPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.kext/Contents/Info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents Info.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*/*.app/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_2",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*/*.app/Contents/Resources/*.help/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_3",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/CoreServices/*.app/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_4",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/version.plist",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_5",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/PlugIns/*.plugin/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_6",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.bundle/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_7",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Extensions/*.kext/Contents/Resources/*.bundle/Contents/version.plist",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_8",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KEXT_VERSION_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_kext_version_plist",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/PlugIns/*.kext/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_9",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Filesystems/*/*.kext/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_10",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Filesystems/*/Encodings/*.kext/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RESOURCES_VERSION_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_resources_version_plist",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Frameworks/*.framework/Versions/A/Resources/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENTS_VERSION_PLIST_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_contents_version_plist_11",
    name: "MacOSContentsVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.kext/Contents/version.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents version.plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSTICREPORTS_CORE_ANALYTICS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnosticreports_core_analytics",
    name: "MacOSCoreAnalyticsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Logs/DiagnosticReports/*.core_analytics"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "CoreAnalytics log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x#diagnostic-reports", "https://www.crowdstrike.com/blog/i-know-what-you-did-last-month-a-new-artifact-of-execution-on-macos-10-13/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AGGREGATES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_aggregates",
    name: "MacOSCoreAnalyticsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/analyticsd/aggregates/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "CoreAnalytics log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x#diagnostic-reports", "https://www.crowdstrike.com/blog/i-know-what-you-did-last-month-a-new-artifact-of-execution-on-macos-10-13/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AGGREGATES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_aggregates_2",
    name: "MacOSCoreAnalyticsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/analyticsd/aggregates/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "CoreAnalytics log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x#diagnostic-reports", "https://www.crowdstrike.com/blog/i-know-what-you-did-last-month-a-new-artifact-of-execution-on-macos-10-13/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CRONTAB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_crontab_2",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/crontab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CRONTAB_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_crontab_3",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/crontab"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tabs",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/lib/cron/tabs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tabs_2",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/at/tabs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tabs_3",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/at/tabs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tabs_4",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/cron/tabs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TABS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tabs_5",
    name: "MacOSCronTabs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/cron/tabs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Cron tabs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_DOCK_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_dock_plist",
        name: "MacOSDockConfigurationPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.apple.Dock.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Dock configuration property list (plist) file.

This property list contains information about the configuration of a user's Dock.
",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_DEFAULT_SQLINDEX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_default_sqlindex",
    name: "MacOSDirectoryServicesLocalNodesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/dslocal/nodes/Default/sqlindex"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Directory services local nodes database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DEFAULT_SQLINDEX_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_default_sqlindex_2",
    name: "MacOSDirectoryServicesLocalNodesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/dslocal/nodes/Default/sqlindex"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Directory services local nodes database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_duetactivityscheduler_duetactivityschedulerclassc_db",
        name: "MacOSDuetActivitySchedulerSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/private/var/db/DuetActivityScheduler/DuetActivitySchedulerClassC.db"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Duet activity scheduler database.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB_2:
    ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_duetactivityscheduler_duetactivityschedulerclassc_db_2",
    name: "MacOSDuetActivitySchedulerSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/DuetActivityScheduler/DuetActivitySchedulerClassC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet activity scheduler database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PEOPLE_INTERACTIONC_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_people_interactionc_db",
    name: "MacOSDuetinteractionCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/CoreDuet/People/interactionC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet interactionC database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PEOPLE_INTERACTIONC_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_people_interactionc_db_2",
    name: "MacOSDuetinteractionCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/CoreDuet/People/interactionC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet interactionC database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_knowledge_knowledgec_db",
    name: "MacOSDuetKnowledgeCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Knowledge/knowledgeC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet knowledgeC User and Application usage database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_knowledge_knowledgec_db_2",
    name: "MacOSDuetKnowledgeCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/CoreDuet/Knowledge/knowledgeC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet knowledgeC User and Application usage database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_knowledge_knowledgec_db_3",
    name: "MacOSDuetKnowledgeCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/CoreDuet/Knowledge/knowledgeC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet knowledgeC User and Application usage database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COREDUET_COREDUETD_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_coreduet_coreduetd_db",
    name: "MacOSDuetSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/CoreDuet/coreduetd.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COREDUET_COREDUETD_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_coreduet_coreduetd_db_2",
    name: "MacOSDuetSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/CoreDuet/coreduetd.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COREDUET_COREDUETD_DB_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_coreduet_coreduetd_db_3",
    name: "MacOSDuetSystemEventsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/CoreDuet/coreduetd.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet system events database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COREDUET_COREDUETD_DB_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_coreduet_coreduetd_db_4",
    name: "MacOSDuetSystemEventsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/CoreDuet/coreduetd.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Duet system events database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FSEVENTSD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fseventsd",
    name: "MacOSFSEventsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/.fseventsd/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "File system events disk log stream (fsevents) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/MacOS%20File%20System%20Events%20Disk%20Log%20Stream%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATA_FSEVENTSD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_data_fseventsd",
    name: "MacOSFSEventsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Volumes/Data/.fseventsd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "File system events disk log stream (fsevents) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/MacOS%20File%20System%20Events%20Disk%20Log%20Stream%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RESOURCES_GKOPAQUE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_resources_gkopaque_db",
    name: "MacOSGatekeeperOpaqueConfigurationSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/gkopaque.bundle/Contents/Resources/gkopaque.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Gatekeeper opaque configuration database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RESOURCES_GKOPAQUE_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_resources_gkopaque_db_2",
    name: "MacOSGatekeeperOpaqueConfigurationSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/gkopaque.bundle/Contents/Resources/gkopaque.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Gatekeeper opaque configuration database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_globalpreferences_plist",
        name: "MacOSGlobalPreferencesPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/.GlobalPreferences.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Global preferences property list (plist) file.

This property list contains information about the system's locale and time zone.
",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ACCOUNTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_accounts",
    name: "MacOSiCloudAccounts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/iCloud/Accounts/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iCloud Accounts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_MOBILEMEACCOUNTS_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_mobilemeaccounts_plist",
        name: "MacOSiCloudPreferences",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/MobileMeAccounts.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "iCloud user preferences",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_IDENTITYSERVICES_IDS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_identityservices_ids_db",
    name: "MacOSIdentityServicesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/IdentityServices/ids.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Identity services SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_IPOD_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_ipod_plist",
        name: "MacOSiDevices",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.apple.iPod.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Attached iDevices",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_RECEIPTS_INSTALLHISTORY_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_receipts_installhistory_plist",
    name: "MacOSInstallationHistoryPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Receipts/InstallHistory.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Software installation history property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#software-installation"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_INSTALL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_install_log",
    name: "MacOSInstallationLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/install.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Software installation log file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_INSTALL_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_install_log_2",
    name: "MacOSInstallationLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/install.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Software installation log file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_ITXIB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_itxib",
    name: "MacOSiTunesInterfaceBuilderDocumentPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/iTunes.app/Contents/Resources/*.lproj/*.itxib"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iTunes Interface Builder document (*.itxib) plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INFO_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_info_plist",
    name: "MacOSiOSBackupInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/info.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iOS device backup information",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#idevice-backup"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MANIFEST_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_manifest_plist",
    name: "MacOSiOSBackupManifest",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.plist",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iOS device backup apps information",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#idevice-backup"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MANIFEST_MDBD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_manifest_mdbd",
    name: "MacOSiOSBackupMbdb",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.mdbd",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iOS device backup files information",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#idevice-backup"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BACKUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_backup",
    name: "MacOSiOSBackupsMainDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/MobileSync/Backup/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iOS device backups directory",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#idevice-backup"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STATUS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_status_plist",
    name: "MacOSiOSBackupStatus",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Status.plist",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iOS device backup status information.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#idevice-backup"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions",
    name: "MacOSKernelExtensionFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Extensions/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Kernel extension (.kext) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#kernel-extension"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_2",
    name: "MacOSKernelExtensionFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Kernel extension (.kext) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#kernel-extension"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_HITOOLBOX_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_hitoolbox_plist",
        name: "MacOSKeyboardLayoutPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/com.apple.HIToolbox.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Keyboard layout property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_LOG_LASTLOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_lastlog_2",
    name: "MacOSLastlogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/lastlog"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Lastlog file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_LASTLOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_lastlog_3",
    name: "MacOSLastlogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/lastlog"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Lastlog file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHAGENTS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchagents_plist",
    name: "MacOSLaunchAgentsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/LaunchAgents/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Launch Agents property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHAGENTS_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchagents_plist_2",
    name: "MacOSLaunchAgentsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/LaunchAgents/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Launch Agents property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHAGENTS_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchagents_plist_3",
    name: "MacOSLaunchAgentsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/LaunchAgents/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Launch Agents property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHDAEMONS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchdaemons_plist",
    name: "MacOSLaunchDaemonsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/LaunchDaemons/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Launch Daemons property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHDAEMONS_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchdaemons_plist_2",
    name: "MacOSLaunchDaemonsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/LaunchDaemons/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Launch Daemons property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LAUNCHDAEMONS_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_launchdaemons_plist_3",
    name: "MacOSLaunchDaemonsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/LaunchDaemons/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Launch Daemons property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_9",
    name: "MacOSLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Logs/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Miscellaneous system log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_loginwindow_plist",
        name: "MacOSLoginWindowPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/com.apple.loginwindow.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Log-in window information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences",
            "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf",
            "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_LOGINWINDOW_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_loginwindow_plist",
    name: "MacOSLoginWindowPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Preferences/loginwindow.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Log-in window information property list (plist) file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences",
        "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf",
        "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_byhost_com_apple_loginwindow_plist",
        name: "MacOSLoginWindowPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/ByHost/com.apple.loginwindow.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Log-in window information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences",
            "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf",
            "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_byhost_com_apple_loginwindow_plist_2",
        name: "MacOSLoginWindowPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Preferences/ByHost/com.apple.loginwindow.*.plist",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Log-in window information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences",
            "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf",
            "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_loginwindow_plist_2",
        name: "MacOSLoginWindowPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/var/root/Library/Preferences/com.apple.loginwindow.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Log-in window information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences",
            "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf",
            "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_3: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_loginwindow_plist_3",
        name: "MacOSLoginWindowPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/private/var/root/Library/Preferences/com.apple.loginwindow.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Log-in window information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences",
            "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf",
            "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_MAILDATA_ACCOUNTS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_maildata_accounts_plist",
    name: "MacOSMailAccounts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/MailData/Accounts.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Accounts. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MAILDATA_BACKUPTOC_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_maildata_backuptoc_plist",
    name: "MacOSMailBackupTOC",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/MailData/BackupTOC.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Backup Table of Content. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MAILBOXES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mailboxes",
    name: "MacOSMailboxes",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/Mailboxes/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Mailbox Directory. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MAIL_DOWNLOADS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_mail_downloads",
    name: "MacOSMailDownloadAttachments",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Downloads Directory",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MAILDATA_ENVELOPE_INDEX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_maildata_envelope_index",
    name: "MacOSMailEnvelopIndex",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/MailData/Envelope Index"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Envelope Index. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IMAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_imap",
    name: "MacOSMailIMAP",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/IMAP-*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail IMAP Synched Mailboxes. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_V_0_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_v_0_9",
    name: "MacOSMailMainDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Main Folder. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MAILDATA_OPENEDATTACHMENTSV2_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_maildata_openedattachmentsv2_plist",
        name: "MacOSMailOpenedAttachments",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/MailData/OpenedAttachmentsV2.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Mail Opened Attachments",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_POP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pop",
    name: "MacOSMailPOP",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/POP-*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail POP Synched Mailboxes. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_MAIL_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_mail_plist",
        name: "MacOSMailPreferences",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.apple.Mail.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Mail Preferences",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ADDRESSBOOK_MAILRECENTS_V4_ABCDMR: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_addressbook_mailrecents_v4_abcdmr",
        name: "MacOSMailRecentContacts",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Application Support/AddressBook/MailRecents-v4.abcdmr",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Mail Recent Contacts",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_SIGNATURES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_signatures",
    name: "MacOSMailSignatures",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Mail/V[0-9]/MailData/Signatures/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Mail Signatures by Account. Until now only V2, V3 and V5 have been observed.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MESSAGES_CHAT_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_messages_chat_db",
    name: "MacOSMessageChatSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Messages/chat.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "iMessage chat SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORKD_NETUSAGE_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_networkd_netusage_sqlite",
    name: "MacOSNetworkUsageSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/networkd/netusage.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Network usage SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORKD_NETUSAGE_SQLITE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_networkd_netusage_sqlite_2",
    name: "MacOSNetworkUsageSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/networkd/netusage.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Network usage SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NOTES_NOTESV_STOREDATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_notes_notesv_storedata",
    name: "MacOSNotesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Containers/com.apple.Notes/Data/Library/Notes/NotesV*.storedata",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Notes SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NOTIFICATIONCENTER_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_notificationcenter_db",
    name: "MacOSNotificationCenterSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/NotificationCenter/*.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "MacOS NotificationCenter SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_db",
    name: "MacOSNotificationCenterSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/folders/[a-z][0-9]/*/0/com.apple.notificationcenter/db/db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "MacOS NotificationCenter SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB2_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db2_db",
    name: "MacOSNotificationCenterSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/folders/[a-z][0-9]/*/0/com.apple.notificationcenter/db2/db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "MacOS NotificationCenter SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_db_2",
    name: "MacOSNotificationCenterSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/folders/[a-z][0-9]/*/0/com.apple.notificationcenter/db/db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "MacOS NotificationCenter SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB2_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db2_db_2",
    name: "MacOSNotificationCenterSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/folders/[a-z][0-9]/*/0/com.apple.notificationcenter/db2/db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "MacOS NotificationCenter SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DAILY_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_daily_local",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/daily.local/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DEFAULTS_PERIODIC_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_defaults_periodic_conf",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/defaults/periodic.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MONTHLY_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_monthly_local",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/monthly.local/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PERIODIC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_periodic_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/periodic/**2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PERIODIC_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_periodic_conf",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/periodic.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PERIODIC_CONF_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_periodic_conf_local",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/periodic.conf.local"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DAILY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_daily",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/periodic/daily/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MONTHLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_monthly",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/periodic/monthly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEEKLY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_weekly",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/periodic/weekly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEEKLY_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_weekly_local",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/weekly.local/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DAILY_LOCAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_daily_local_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/daily.local/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DEFAULTS_PERIODIC_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_defaults_periodic_conf_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/defaults/periodic.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MONTHLY_LOCAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_monthly_local_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/monthly.local/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PERIODIC_2_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_periodic_2_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/periodic/**2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PERIODIC_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_periodic_conf_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/periodic.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PERIODIC_CONF_LOCAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_periodic_conf_local_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/periodic.conf.local"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DAILY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_daily_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/periodic/daily/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MONTHLY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_monthly_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/periodic/monthly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEEKLY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_weekly_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/periodic/weekly/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEEKLY_LOCAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_weekly_local_2",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/weekly.local/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PERIODIC_2_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_periodic_2_3",
    name: "MacOSPeriodicSystemFunctionConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/etc/periodic/**2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Configuration files of system function scripts that should run periodically.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-info-misc",
        "https://www.freebsd.org/cgi/man.cgi?periodic",
        "https://www.freebsd.org/cgi/man.cgi?periodic.conf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_launchservices_quarantineevent",
        name: "MacOSQuarantineEventsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEvents",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Quarantine events SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT_2:
    ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_com_apple_launchservices_quarantineevent_2",
    name: "MacOSQuarantineEventsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Quarantine events SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_RECENTITEMS_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_recentitems_plist",
        name: "MacOSRecentItemsPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.apple.recentitems.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Recent items property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#recent-items"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_CLIENTCACHES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_clientcaches",
    name: "MacOSRemoteDesktopAdministratorSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/RemoteManagement/ClientCaches/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RMDB_RMDB_SQLITE3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rmdb_rmdb_sqlite3",
    name: "MacOSRemoteDesktopAdministratorSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/RemoteManagement/RMDB/rmdb.sqlite3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CLIENTCACHES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_clientcaches_2",
    name: "MacOSRemoteDesktopAdministratorSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/RemoteManagement/ClientCaches/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RMDB_RMDB_SQLITE3_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rmdb_rmdb_sqlite3_2",
    name: "MacOSRemoteDesktopAdministratorSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/RemoteManagement/RMDB/rmdb.sqlite3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHES_APPUSAGE_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_caches_appusage_plist",
    name: "MacOSRemoteDesktopClientSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/RemoteManagement/caches/AppUsage.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHES_APPUSAGE_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_caches_appusage_plist_2",
    name: "MacOSRemoteDesktopClientSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/RemoteManagement/caches/AppUsage.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHES_USERACCT_TMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_caches_useracct_tmp",
    name: "MacOSRemoteDesktopClientSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/RemoteManagement/caches/UserAcct.tmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHES_USERACCT_TMP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_caches_useracct_tmp_2",
    name: "MacOSRemoteDesktopClientSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/RemoteManagement/caches/UserAcct.tmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Remote Desktop (ARD) was first released in 2002 and is Apple’s desktop management system for software distribution, asset management, and remote assistance.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://help.apple.com/remotedesktop/mac/3.9/", "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html", "https://github.com/fireeye/ARDvark#ard-artifacts-to-parse"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*.app/Contents/Resources/*.help/Contents/Resources/*.lproj/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_2",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Applications/*/*.app/Contents/Resources/*.help/Contents/Resources/*.lproj/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_3",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/CoreServices/*.app/Contents/Resources/*.lproj/InfoPlist.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_4",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.bundle/Contents/Resources/*.lproj/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_5",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.bundle/Contents/Resources/*.lproj/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RESOURCES_INFOPLIST_STRINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_resources_infoplist_strings",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/Resources/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_6",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Extensions/*.kext/Contents/Resources/*.lproj/InfoPlist.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_7",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Filesystems/*/*.kext/Contents/Resources/*.lproj/InfoPlist.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_8",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Filesystems/*/Encodings/*.kext/Contents/Resources/*.lproj/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_INFOPLIST_STRINGS_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_infoplist_strings_9",
    name: "MacOSResourcesInfoStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.kext/Contents/Resources/*.lproj/InfoPlist.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources InfoPlist.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/CoreServices/*.app/Contents/Resources/*.lproj/Localizable.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_2",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/Extensions/*.kext/Contents/Resources/*.lproj/Localizable.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_3",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.lproj/Localizable.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_4",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/Frameworks/*.framework/Versions/A/Frameworks/*.framework/Versions/A/Resources/*.lproj/Localizable.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_5",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/PreferencePanes/*.prefPane/Contents/Resources/*.lproj/Localizable.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_6",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/PrivateFrameworks/*.framework/Versions/A/Plugins/*.bundle/Contents/Resources/*.lproj/Localizable.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_7",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.lproj/Localizable.strings"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LPROJ_LOCALIZABLE_STRINGS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_lproj_localizable_strings_8",
    name: "MacOSResourcesLocalizableStringsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "/System/Library/SystemProfiler/*/Contents/Resources/*.lproj/Localizable.strings",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Resources Localizable.strings plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_com_apple_sidebarlists_plist",
    name: "MacOSSidebarListsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Preferences/com.apple.sidebarlists.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Sidebar lists preferences property list (plist) file.

This property list contains the names of volumes mounted on the desktop that have appeared in the sidebar list.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_com_apple_sidebarlists_plist_2",
    name: "MacOSSidebarListsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Preferences/com.apple.sidebarlists.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Sidebar lists preferences property list (plist) file.

This property list contains the names of volumes mounted on the desktop that have appeared in the sidebar list.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ASSISTANT_SIRIANALYTICS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_assistant_sirianalytics_db",
    name: "MacOSSiriAnalyticsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Assistant/SiriAnalytics.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri analytics SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUGGESTIONS_ENTITIES_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_suggestions_entities_db",
    name: "MacOSSiriSuggestionsEntitiesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Suggestions/entities.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri suggestions entities SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUGGESTIONS_ENTITIES_DB_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_suggestions_entities_db_wal",
    name: "MacOSSiriSuggestionsEntitiesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Suggestions/entities.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri suggestions entities SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PENDING_QUEUE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pending_queue_db",
    name: "MacOSSiriSuggestionsPendingQueueSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Suggestions/pending/queue.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri suggestions pending queue SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PENDING_QUEUE_DB_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pending_queue_db_wal",
    name: "MacOSSiriSuggestionsPendingQueueSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Suggestions/pending/queue.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri suggestions pending queue SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUGGESTIONS_SNIPPETS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_suggestions_snippets_db",
    name: "MacOSSiriSuggestionsSnippetsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Suggestions/snippets.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri suggestions snippets SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUGGESTIONS_SNIPPETS_DB_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_suggestions_snippets_db_wal",
    name: "MacOSSiriSuggestionsSnippetsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Suggestions/snippets.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Siri suggestions snippets SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_VM_SLEEPIMAGE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_vm_sleepimage",
    name: "MacOSSleepimageFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/vm/sleepimage"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Sleepimage file which contains the content of memory before going to sleep",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#sleep.2fhibernate-and-swap-image-file"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_VM_SLEEPIMAGE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_vm_sleepimage_2",
    name: "MacOSSleepimageFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/vm/sleepimage"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Sleepimage file which contains the content of memory before going to sleep",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#sleep.2fhibernate-and-swap-image-file"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_SOFTWAREUPDATE_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_softwareupdate_plist",
        name: "MacOSSoftwareUpdatePreferencesPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/com.apple.SoftwareUpdate.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Software update preferences property list (plist) files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#software-installation"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_STORE_V1_VOLUMECONFIG_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_store_v1_volumeconfig_plist",
    name: "MacOSSpotlightStoreVolumeConfigurationPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/.Spotlight-V100/Store-V1/VolumeConfig.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Spotlight store volume configuration plist file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SPOTLIGHT_V100_VOLUMECONFIGURATION_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_spotlight_v100_volumeconfiguration_plist",
        name: "MacOSSpotlightVolumeConfigurationPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/.Spotlight-V100/VolumeConfiguration.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Spotlight volume configuration plist file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_plist",
    name: "MacOSStartupItemsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/StartupItems/**/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Startup Items property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations", "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_plist_2",
    name: "MacOSStartupItemsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/StartupItems/**/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Startup Items property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations", "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_VM_SWAPFILE_0_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_vm_swapfile_0_9",
    name: "MacOSSwapFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/vm/swapfile[0-9]"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Swap file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#sleep.2fhibernate-and-swap-image-file"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_VM_SWAPFILE_0_9_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_vm_swapfile_0_9_2",
    name: "MacOSSwapFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/vm/swapfile[0-9]"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Swap file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#sleep.2fhibernate-and-swap-image-file"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEMCONFIGURATION_PREFERENCES_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_systemconfiguration_preferences_plist",
        name: "MacOSSystemConfigurationPreferencesPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/SystemConfiguration/preferences.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "System configuration preferences property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_LOG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_4",
    name: "MacOSSystemLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System log file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_5",
    name: "MacOSSystemLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System log file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_SYSTEMPOLICY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_systempolicy",
    name: "MacOSSystemPolicySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/SystemPolicy"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System policy database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DB_SYSTEMPOLICY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_db_systempolicy_2",
    name: "MacOSSystemPolicySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/SystemPolicy"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System policy database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_plist_3",
    name: "MacOSSystemPreferencesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Preferences/**/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System Preferences property list (plist) files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CORESERVICES_SYSTEMVERSION_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_coreservices_systemversion_plist",
    name: "MacOSSystemVersionPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/System/Library/CoreServices/SystemVersion.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Operating system name and version property list (plist) file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-settings-and-informations"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_TCC_TCC_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_tcc_tcc_db",
    name: "MacOSTCCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Application Support/com.apple.TCC/TCC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Transparency, Consent, Control (TCC) framework SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/tcc_database"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_TCC_TCC_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_tcc_tcc_db_2",
    name: "MacOSTCCSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/com.apple.TCC/TCC.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Transparency, Consent, Control (TCC) framework SQLite database files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/tcc_database"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KEYBOARDSERVICES_TEXTREPLACEMENTS_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_keyboardservices_textreplacements_db",
        name: "MacOSTextReplacementsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/KeyboardServices/TextReplacements.db"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Text replacements SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_TIMEMACHINE_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_timemachine_plist",
        name: "MacOSTimeMachinePlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/Library/Preferences/com.apple.TimeMachine.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Time Machine information property list (plist) file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_DIAGNOSTICS_TRACEV3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnostics_tracev3",
    name: "MacOSUnifiedLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/diagnostics/*.tracev3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging and Activity Tracing",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRACEV3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tracev3",
    name: "MacOSUnifiedLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/diagnostics/*/*.tracev3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging and Activity Tracing",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__7",
    name: "MacOSUnifiedLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/uuidtext/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging and Activity Tracing",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DIAGNOSTICS_TRACEV3_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_diagnostics_tracev3_2",
    name: "MacOSUnifiedLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/diagnostics/*.tracev3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging and Activity Tracing",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRACEV3_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tracev3_2",
    name: "MacOSUnifiedLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/diagnostics/*/*.tracev3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging and Activity Tracing",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__8",
    name: "MacOSUnifiedLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/uuidtext/*/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging and Activity Tracing",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_LOG_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_log_5",
    name: "MacOSUserApplicationLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Logs/*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User applications log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOCK_DESKTOPPICTURE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_dock_desktoppicture_db",
    name: "MacOSUserDockDesktopPictureSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Dock/desktoppicture.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Dock user desktop picture SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_globalpreferences_plist_2",
        name: "MacOSUserGlobalPreferencesPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/.GlobalPreferences.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "User global preferences property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_KEYCHAINS_KEYCHAIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_keychains_keychain",
    name: "MacOSUserKeychainFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Keychains/*.keychain"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User keychain files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OCSPCACHE_SQLITE3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ocspcache_sqlite3",
    name: "MacOSUserKeychainOCSPCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Keychains/*/ocspcache.sqlite3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User keychain CRL and OCSP cache SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USER_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_user_db",
    name: "MacOSUserLocalItemsKeychainKeybagSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Keychains/*/user.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User (iCloud) local items keychain keybag SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KEYCHAIN_2_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_keychain_2_db",
    name: "MacOSUserLocalItemsKeychainRecordsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Keychains/*/keychain-2.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User (iCloud) local items keychain encrypted records SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_COM_APPLE_LOGINITEMS_PLIST: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_preferences_com_apple_loginitems_plist",
        name: "MacOSUserLoginItemsPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Preferences/com.apple.loginitems.plist"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "User login items property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations-2",
            "https://objective-see.org/blog/blog_0x31.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENTAGENT_BACKGROUNDIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_backgroundtaskmanagementagent_backgroundit",
    name: "MacOSUserLoginItemsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User login items property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations-2", "https://objective-see.org/blog/blog_0x31.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_com_apple_backgroundtaskmanagement_backgrounditems_v",
        name: "MacOSUserLoginItemsPlistFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "/private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v*.btm",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "User login items property list (plist) file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations-2",
            "https://objective-see.org/blog/blog_0x31.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V_2:
    ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_backgroundtaskmanagement_backgrounditems_v_2",
    name: "MacOSUserLoginItemsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v*.btm"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User login items property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#autorun-locations-2",
        "https://objective-see.org/blog/blog_0x31.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_plist",
    name: "MacOSUserPasswordHashesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/dslocal/nodes/Default/users/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User password hashes property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-settings-and-informations",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_plist_2",
    name: "MacOSUserPasswordHashesPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/dslocal/nodes/Default/users/*.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User password hashes property list (plist) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/mac_os_x_10.9_artifacts_location#system-settings-and-informations",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences",
    name: "MacOSUserPreferencesDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Preferences/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents of the user Preferences directories.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#preferences"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_accounts_accounts_sqlite",
    name: "MacOSUserAccountsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Accounts/Accounts*.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User Accounts SQLite database files.

Seen Accounts3.sqlite and Accounts4.sqlite
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#user.27s-accounts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_accounts_accounts_sqlite_wal",
    name: "MacOSUserAccountsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Accounts/Accounts*.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User Accounts SQLite database files.

Seen Accounts3.sqlite and Accounts4.sqlite
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#user.27s-accounts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TRASH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_trash",
    name: "MacOSUserTrashDirectory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.Trash/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Contents of the user Trash directories.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mac_os_x_10.9_artifacts_location#misc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RUN_UTMPX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_run_utmpx",
    name: "MacOSUtmpxFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/run/utmpx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Utmpx login record file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RUN_UTMPX_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_run_utmpx_2",
    name: "MacOSUtmpxFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/utmpx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Utmpx login record file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PASSES_PASSES23_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_passes_passes23_sqlite",
    name: "MacOSWalletSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Passes/passes23.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Wallet SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AWDD_PERSISTENT_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_awdd_persistent_db",
    name: "MacOSWirelessDiagnosticDataPersistentSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/db/awdd/persistent.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Wireless Diagnostic Data (AWDD) persistent SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AWDD_PERSISTENT_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_awdd_persistent_db_2",
    name: "MacOSWirelessDiagnosticDataPersistentSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/awdd/persistent.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Apple Wireless Diagnostic Data (AWDD) persistent SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IOS_DEVICE_LOGS_IOS_DEVICE_LOGS_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_ios_device_logs_ios_device_logs_db",
        name: "MacOSXcodeiOSDeviceLogsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Developer/Xcode/iOS Device Logs/iOS Device Logs *.db",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Xcode iOS Device Logs SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_USERS_HOMEDIR_BASH_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_bash_logout",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.bash_logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_BASH_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_bash_profile",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.bash_profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_BASHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_bashrc",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_BASH_BASHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_bash_bashrc",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/bash.bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_BASHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_bashrc",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_BASH_BASHRC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_bash_bashrc_2",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/bash.bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_BASHRC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_bashrc_2",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BASH_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_bash_logout",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.bash_logout",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BASH_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_bash_profile",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.bash_profile",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BASHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_bashrc",
    name: "BashShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_BASH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_bash_history",
    name: "BashShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.bash_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BASH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_bash_history",
    name: "BashShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.bash_history",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BASH_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_bash_sessions",
    name: "BashShellSessionFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.bash_sessions/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Bourne Again shell (bash) session files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/bash_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_SH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_sh_history",
    name: "BourneShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.sh_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne shell (sh) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Bourne_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sh_history",
    name: "BourneShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.sh_history",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Bourne shell (sh) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Bourne_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_CSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_cshrc",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CSH_CSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_csh_cshrc",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/csh.cshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CSH_LOGIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_csh_login",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/csh.login"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CSH_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_csh_logout",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/csh.logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CSH_CSHRC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_csh_cshrc_2",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/csh.cshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CSH_LOGIN_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_csh_login_2",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/csh.login"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_CSH_LOGOUT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_csh_logout_2",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/csh.logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cshrc",
    name: "CShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.cshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "C shell (csh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/C_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_D_CONFIG_FISH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_config_fish",
    name: "FishShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/fish/conf.d/config.fish"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "FishShell (fish) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://fishshell.com/docs/current/language.html#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_D_FISH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_fish",
    name: "FishShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/fish/conf.d/*.fish"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "FishShell (fish) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://fishshell.com/docs/current/language.html#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FISH_CONFIG_FISH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fish_config_fish",
    name: "FishShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/fish/config.fish"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "FishShell (fish) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://fishshell.com/docs/current/language.html#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FISH_CONFIG_FISH_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fish_config_fish_2",
    name: "FishShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/fish/config.fish"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "FishShell (fish) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://fishshell.com/docs/current/language.html#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FISH_FISH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fish_fish_history",
    name: "FishShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.local/share/fish/fish_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Fish shell (fish) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://fishshell.com/docs/current/cmds/history.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_KSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_ksh",
    name: "KornShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.ksh"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "KornShell (ksh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/KornShell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_KSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_kshrc",
    name: "KornShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/kshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "KornShell (ksh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/KornShell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_KSHRC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_kshrc_2",
    name: "KornShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/kshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "KornShell (ksh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/KornShell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_KSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ksh",
    name: "KornShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.ksh"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "KornShell (ksh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/KornShell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_BASH_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_bash_logout",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.bash_logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_BASH_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_bash_profile",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.bash_profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_BASHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_bashrc",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.bashrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_CSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_cshrc",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.cshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_KSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_ksh",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.ksh"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FISH_CONFIG_FISH_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fish_config_fish_3",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.config/fish/config.fish"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_logout",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_profile",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_TCSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_tcsh",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.tcsh"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_ZLOGIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_zlogin",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.zlogin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_ZLOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_zlogout",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.zlogout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_ZPROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_zprofile",
    name: "RootUserShellConfigs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.zprofile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_BASH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_bash_history",
    name: "RootUserShellHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.bash_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FISH_FISH_HISTORY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fish_fish_history_2",
    name: "RootUserShellHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.local/share/fish/fish_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_SH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_sh_history",
    name: "RootUserShellHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.sh_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_ZHISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_zhistory",
    name: "RootUserShellHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.zhistory"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ROOT_ZSH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_root_zsh_history",
    name: "RootUserShellHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/root/.zsh_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Common Unix root shell history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_logout",
    name: "ShellLogoutFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Shell logout file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logout",
    name: "ShellLogoutFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.logout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Shell logout file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_profile",
    name: "ShellProfileFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Shell profile file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_profile",
    name: "ShellProfileFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Shell profile file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PROFILE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_profile_2",
    name: "ShellProfileFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Shell profile file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_profile",
    name: "ShellProfileFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.profile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Shell profile file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_TCSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_tcsh",
    name: "TeeShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.tcsh"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tee shell (tcsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Tcsh"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TCSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tcsh",
    name: "TeeShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.tcsh"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tee shell (tcsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Tcsh"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_ZLOGIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_zlogin",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.zlogin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_ZLOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_zlogout",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.zlogout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_ZPROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_zprofile",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.zprofile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ZSHENV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_zshenv",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zshenv"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ZSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_zshrc",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZLOGIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zlogin",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zsh/zlogin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZLOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zlogout",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zsh/zlogout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZPROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zprofile",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zsh/zprofile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZSHENV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zshenv",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zsh/zshenv"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZSHRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zshrc",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/zsh/zshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ZSHENV_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_zshenv_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zshenv"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_ZSHRC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_zshrc_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZLOGIN_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zlogin_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zsh/zlogin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZLOGOUT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zlogout_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zsh/zlogout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZPROFILE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zprofile_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zsh/zprofile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZSHENV_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zshenv_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zsh/zshenv"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_ZSHRC_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_zshrc_2",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/zsh/zshrc"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZLOGIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zlogin",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.zlogin"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZLOGOUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zlogout",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.zlogout"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZPROFILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zprofile",
    name: "ZShellConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.zprofile"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) configuration files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_ZHISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_zhistory",
    name: "ZShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.zhistory"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_HOMEDIR_ZSH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_homedir_zsh_history",
    name: "ZShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.zsh_history"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZHISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zhistory",
    name: "ZShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.zhistory"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ZSH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_zsh_history",
    name: "ZShellHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Packages\\*\\LocalState\\rootfs\\home\\*\\.zsh_history",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Z shell (zsh) history files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://en.wikipedia.org/wiki/Z_shell"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Apache Software Foundation\\Tomcat*\\logs\\**\\access_log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Apache Software Foundation\\Tomcat*\\logs\\access_log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Apache Software Foundation\\Tomcat*\\logs\\**\\catalina.out",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Apache Software Foundation\\Tomcat*\\logs\\catalina.out",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_2",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfiles%%\\Apache Software Foundation\\Tomcat*\\logs\\**\\access_log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_2",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfiles%%\\Apache Software Foundation\\Tomcat*\\logs\\access_log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_2",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfiles%%\\Apache Software Foundation\\Tomcat*\\logs\\**\\catalina.out",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_2",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfiles%%\\Apache Software Foundation\\Tomcat*\\logs\\catalina.out",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_3",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfilesx86%%\\Apache Software Foundation\\Tomcat*\\logs\\**\\access_log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_3",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfilesx86%%\\Apache Software Foundation\\Tomcat*\\logs\\access_log*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_3",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfilesx86%%\\Apache Software Foundation\\Tomcat*\\logs\\**\\catalina.out",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_3",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_programfilesx86%%\\Apache Software Foundation\\Tomcat*\\logs\\catalina.out",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_4",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/tomcat*/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_4",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/tomcat*/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_4",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/tomcat*/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_4",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/tomcat*/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_5",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/tomcat*/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_5",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/tomcat*/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_5",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/tomcat*/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_5",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/tomcat*/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_6",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/tomcat*/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_6",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/tomcat*/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_6",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/tomcat*/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_6",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/tomcat*/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_7",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/tomcat*/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_7",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/tomcat*/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_7",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/tomcat*/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_7",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/tomcat*/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_8",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Tomcat/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_8",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Tomcat/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_8",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Tomcat/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_8",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Tomcat/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_9",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/apache-tomcat*/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_9",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/apache-tomcat*/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_9",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/apache-tomcat*/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_9",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/apache-tomcat*/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ACCESS_LOG_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_access_log_10",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/Cellar/tomcat*/logs/**/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_10",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/Cellar/tomcat*/logs/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATALINA_OUT_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catalina_out_10",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/Cellar/tomcat*/logs/**/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_CATALINA_OUT_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_catalina_out_10",
    name: "TomcatLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/Cellar/tomcat*/logs/catalina.out"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging",
        "https://tomcat.apache.org/tomcat-8.0-doc/logging.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Apache Software Foundation\\Tomcat*\\conf\\tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_2",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Apache Software Foundation\\Tomcat*\\conf\\tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_3",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfilesx86%%\\Apache Software Foundation\\Tomcat*\\conf\\tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_4",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/opt/tomcat*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_5",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/lib/tomcat*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_6",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/tomcat*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_7",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/share/tomcat*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_8",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/lib/tomcat*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_9",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Tomcat/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_10",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/apache-tomcat-*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_TOMCAT_USERS_XML_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_tomcat_users_xml_11",
    name: "TomcatPasswordFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/usr/local/Cellar/tomcat/*/conf/tomcat-users.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Tomcat password file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Configuring_Manager_Application_Access"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_GROUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_group",
    name: "UnixGroupsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/group"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix groups file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_GROUP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_group_2",
    name: "UnixGroupsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/group"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix groups file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_HOSTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_hosts",
    name: "UnixHostsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/hosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix hosts file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_HOSTS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_hosts_2",
    name: "UnixHostsFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/hosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix hosts file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LOCALTIME_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_localtime_2",
    name: "UnixLocalTimeConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/localtime"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix local time zone configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LOCALTIME_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_localtime_3",
    name: "UnixLocalTimeConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/localtime"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix local time zone configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PASSWD_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_passwd_3",
    name: "UnixPasswdFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/passwd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix passwd file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_PASSWD_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_passwd_4",
    name: "UnixPasswdFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/passwd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix passwd file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SHADOW_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_shadow_2",
    name: "UnixShadowFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/shadow"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix shadow file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SHADOW_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_shadow_3",
    name: "UnixShadowFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/shadow"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix shadow file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SHADOW_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_shadow_4",
    name: "UnixShadowBackupFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/shadow-"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix shadow backup file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/shadow.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SHADOW_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_shadow_5",
    name: "UnixShadowBackupFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/shadow-"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix shadow backup file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://man7.org/linux/man-pages/man5/shadow.5.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SUDOERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_sudoers",
    name: "UnixSudoersConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/sudoers"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix sudoers configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_SUDOERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_sudoers_2",
    name: "UnixSudoersConfigurationFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/etc/sudoers"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Unix sudoers configuration file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_BTMP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_btmp_2",
    name: "UnixUtmpFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/btmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Utmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_WTMP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_wtmp_3",
    name: "UnixUtmpFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/wtmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Utmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RUN_UTMP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_run_utmp_2",
    name: "UnixUtmpFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/run/utmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Utmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_BTMP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_btmp_3",
    name: "UnixUtmpFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/btmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Utmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOG_WTMP_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_log_wtmp_4",
    name: "UnixUtmpFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/log/wtmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Utmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RUN_UTMP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_run_utmp_3",
    name: "UnixUtmpFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/run/utmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Utmp login record files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CHROME_EXTENSIONS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_chrome_extensions_5",
    name: "ChromeExtensionRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Google\\Chrome\\Extensions\\**5",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Chrome extensions installed by writing windows registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.chrome.com/extensions/external_extensions#registry"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CHROME_EXTENSIONS_5_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_chrome_extensions_5_2",
    name: "ChromeExtensionRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Google\\Chrome\\Extensions\\**5",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Chrome extensions installed by writing windows registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.chrome.com/extensions/external_extensions#registry"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\File System\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_2",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\File System\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_3",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\File System\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_4",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\File System\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_5",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/File System/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_6",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/File System/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_7",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/File System/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_8",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/File System/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_9",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/File System/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_10",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/File System/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://developer.chrome.com/apps/fileSystem", "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem", "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_11",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/File System/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_12",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/File System/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_13",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/File System/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FILE_SYSTEM_5_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_file_system_5_14",
    name: "ChromeFileSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/File System/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium File System files.

The File System directory backs Chrome's fileSystem API. Inside this
directory are a mixture of the data files saved using the fileSystem
API and LevelDB directories that track the logical structure of the
virtual file system.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://developer.chrome.com/apps/fileSystem",
        "https://developer.mozilla.org/en-US/docs/Web/API/FileSystem",
        "https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\IndexedDB\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_2",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\IndexedDB\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_3",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\IndexedDB\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_4",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\IndexedDB\\**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_5",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_6",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_7",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_8",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_9",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/IndexedDB/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_10",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_11",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_12",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/IndexedDB/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_13",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/IndexedDB/**5",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXEDDB_5_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexeddb_5_14",
    name: "ChromeIndexedDB",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/IndexedDB/**5"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium IndexedDB files.

The IndexedDB directory contains one directory per origin that uses
IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
directories are the files the comprise a LevelDB database, which in turn
holds IndexedDB data for that origin. There may be an accompanying .blob
directory, which contains a nested folder structure of blobs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_2",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_3",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_4",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_5",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_6",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_7",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_8",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_9",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_10",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Local Storage/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_11",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Local Storage\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_12",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Local Storage\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_13",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Local Storage\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCAL_STORAGE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_local_storage_14",
    name: "ChromeLocalStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Local Storage\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Local Storage files.

Chrome 60 and earlier versions used individual .sqlite files per origin for Local Storage, stored in the Local Storage directory root.
In Chrome 61, a leveldb directory was added inside the root Local Storage directory, and new origins saved Local Storage data in a single LevelDB there.

Existing .sqlite files are kept (not moved to leveldb), so it is possible for a single Chrome profile to use both SQLite and LevelDB for Local Storage.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLATFORM_NOTIFICATIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_platform_notifications",
    name: "ChromePlatformNotifications",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Platform Notifications/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome Platform Notifications LevelDB.

The Platform Notifications directory contains the files that comprise a LevelDB
database, which in turn holds platform notification data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLATFORM_NOTIFICATIONS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_platform_notifications_2",
    name: "ChromePlatformNotifications",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Platform Notifications/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome Platform Notifications LevelDB.

The Platform Notifications directory contains the files that comprise a LevelDB
database, which in turn holds platform notification data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLATFORM_NOTIFICATIONS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_platform_notifications_3",
    name: "ChromePlatformNotifications",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Platform Notifications\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome Platform Notifications LevelDB.

The Platform Notifications directory contains the files that comprise a LevelDB
database, which in turn holds platform notification data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_2",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_3",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_2",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Secure Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_4",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_3",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Secure Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_5",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_4",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Secure Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_6",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_5",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_7",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_6",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Secure Preferences",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_8",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_7",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_9",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_8",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_10",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_9",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_11",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_10",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_12",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SECURE_PREFERENCES_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_secure_preferences_11",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Secure Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFERENCES_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_preferences_13",
    name: "ChromePreferences",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Preferences"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Chrome Preferences file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#configuration"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Session Storage/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_2",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Session Storage/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_3",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Session Storage/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_4",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Session Storage/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Sessions/Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Sessions/Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_2",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Sessions/Session_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_2",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Sessions/Tabs_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_3",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Sessions/Session_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_3",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Sessions/Tabs_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_4",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Sessions/Session_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_4",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Sessions/Tabs_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_5",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Session Storage/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_6",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Session Storage/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_7",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Session Storage/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_8",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Session Storage/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_9",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Session Storage/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_10",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Session Storage/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_5",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Sessions/Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_5",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Sessions/Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_6",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Sessions/Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_6",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Sessions/Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_7",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Sessions/Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_8",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Sessions/Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_7",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Sessions/Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_8",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Sessions/Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_9",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Sessions/Session_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_9",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Sessions/Tabs_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_10",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Sessions/Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_10",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Sessions/Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_11",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Session Storage\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_12",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Session Storage\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_13",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Session Storage\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSION_STORAGE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_session_storage_14",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Session Storage\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_11",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Sessions\\Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_11",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Sessions\\Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_12",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Sessions\\Session_*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_12",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Sessions\\Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_13",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Sessions\\Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_13",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Sessions\\Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_SESSION_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_session_14",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Sessions\\Session_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SESSIONS_TABS_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sessions_tabs_14",
    name: "ChromeSessionStorage",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Sessions\\Tabs_*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Google Chrome, Beta, Canary and Chromium Sessions and Session Storage files.

The Sessions directory contains information for restoring tabs and windows
from a browsing session.

The Session Storage directory contains the files that comprise a LevelDB
database, which in turn holds the Session Storage data.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_6",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Application Cache\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_7",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Cache\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_8",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Application Cache\\Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_9",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_2",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Cache\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_2",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_2",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_10",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Application Cache\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_11",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_3",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Cache\\Cache_Data\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_3",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\GPUCache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_3",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Media Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_12",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Application Cache\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_13",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_4",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Cache\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_4",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_4",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_14",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Application Cache\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_15",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_5",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Cache\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_5",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_5",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_16",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Application Cache\\Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_17",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_6",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Cache\\Cache_Data\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_6",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_6",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_18",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Application Cache\\Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_19",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_7",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Cache\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_7",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_7",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_20",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Application Cache\\Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_21",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_8",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Cache\\Cache_Data\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_8",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_8",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_22",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Application Cache\\Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_23",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_9",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Cache\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_9",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_9",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_10",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Opera Software\\Opera Stable\\*\\Cache_Data\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_24",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Application Cache\\Cache\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_25",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_11",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Cache\\Cache_Data\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_10",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\GPUCache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_10",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Media Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_26",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Caches/Chromium/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_27",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Caches/Google/Chrome/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_28",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Caches/Google/Chrome Beta/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_29",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Caches/Google/Chrome Canary/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_30: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_30",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_31: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_31",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_11",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_11",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_2",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_32: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_32",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/*/Application Cache/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_33: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_33",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_34: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_34",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_12",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_12",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_2",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_3",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_35: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_35",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_36: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_36",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_13",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_13",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_3",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_4",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_37: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_37",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Application Cache/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_38: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_38",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_39: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_39",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_5",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_40: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_40",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Application Cache/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_41: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_41",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_42: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_42",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_14",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_14",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_4",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_6",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_43: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_43",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Application Cache/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_44: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_44",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_45: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_45",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_15",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_15",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_5",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_16",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_16",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_6",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_7",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_8",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_46: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_46",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_47: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_47",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_17",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_17",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_7",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_48: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_48",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_49: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_49",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_18",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_18",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_8",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_9",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_50: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_50",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_51: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_51",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_19",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_19",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_9",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_10",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Chromium/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_52: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_52",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Chromium/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_53: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_53",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Chromium/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_20",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Chromium/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_20",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Chromium/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_10",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Chromium/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_54: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_54",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_55: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_55",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_56: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_56",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Beta/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_57: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_57",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Beta/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_21",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Beta/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_11",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Beta/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_58: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_58",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Canary/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_59: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_59",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Canary/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_22",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome Canary/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_12",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Caches/Google/Chrome Canary/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_23",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_13",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Google/Chrome/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_12",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/BraveSoftware/Brave-Browser/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_13",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/BraveSoftware/Brave-Browser/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_60: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_60",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/*/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_61: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_61",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_14",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_24",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_14",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_62: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_62",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_63: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_63",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_15",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/*/Cache/Cache_Data/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_25",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_15",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_64: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_64",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chromium/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_65: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_65",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chromium/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_16",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chromium/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_26",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chromium/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_16",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/chromium/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_66: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_66",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/google-chrome/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_67: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_67",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/google-chrome/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_17",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/google-chrome/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_27",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/google-chrome/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_17",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/google-chrome/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_18",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/microsoft-edge/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_19",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/opera/*/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_11",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_68: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_68",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_69: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_69",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_21",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_28",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_18",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/BraveSoftware/Brave-Browser/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_12",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_70: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_70",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_71: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_71",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_20",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_22",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/GPUCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_29",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_19",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_13",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Application Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_72: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_72",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_73: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_73",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_21",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cache/Cache_Data/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_23",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_30: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_30",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Media Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_20",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/PnaclTranslationCache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_14",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_74: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_74",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_75: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_75",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_22",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_24",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_31: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_31",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_21",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_15",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_16",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_76: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_76",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_77: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_77",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_25",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_32: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_32",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_22",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_17",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_78: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_78",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_79: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_79",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_26",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_33: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_33",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_23",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_80: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_80",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_81: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_81",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_DATA_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_data_23",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Cache/Cache_Data/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_27",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_34: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_34",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_24",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_28",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_18",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_82: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_82",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_83: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_83",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_29",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_30: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_30",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_35: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_35",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_25",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_19",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_84: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_84",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_85: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_85",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_31: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_31",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_36: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_36",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_26",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPLICATION_CACHE_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_application_cache_20",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Application Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_86: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_86",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_87: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_87",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_GPUCACHE_32: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_gpucache_32",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/GPUCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MEDIA_CACHE_37: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_media_cache_37",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Media Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PNACLTRANSLATIONCACHE_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_pnacltranslationcache_27",
    name: "ChromiumBasedBrowsersCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/PnaclTranslationCache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Caches of multiple Chromium-based browsers (Google Chrome, Brave, Chromium,
Yandex, Opera, Edge, EdgeBeta).

Canary uses \"Chrome SxS\" on windows.

* Disk cache (or Cache)
* Media cache
* Application cache
* GPU shader cache
* PNaCl translation cache
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/ChromeCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Cookies",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_2",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_2",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_2",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_2",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_3",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_3",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_3",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_3",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_4",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_4",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_4",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_4",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_5",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_5",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_6",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_6",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_5",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_5",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_6",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cookies",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_6",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_7",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_7",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_7",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_7",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_8",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Cookies",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_8",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_8",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_8",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_9",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_9",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_9",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_9",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_10",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_10",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_10",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_10",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_11",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_11",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_11",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_11",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_12",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_12",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_12",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_12",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_COOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_cookies",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_COOKIES_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_cookies_journal",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_13",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_13",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_13",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Network/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_13",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/*/Network/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_14",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_14",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_14",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Cookies",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_14",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_15",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_15",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_15",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Cookies",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_15",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Cookies-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_16",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Cookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_journal_16",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_16",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Cookies",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_COOKIES_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_cookies_journal_16",
    name: "ChromiumBasedBrowsersCookiesDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Cookies-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Cookies database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#chromium-based-browsers", "https://forensics.wiki/google_chrome#extensions"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_2",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_3",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_4",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_5",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_6",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_7",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_8",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_9",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_10",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_11",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#chromium-based-browsers", "https://forensics.wiki/google_chrome#extensions"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_12",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Extensions/**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_13",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_14",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_15",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_16",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_17",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_18",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_19",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Extensions/**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_20",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_21",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_22",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_23",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_24",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_25",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_26",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_27",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Extensions\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_10_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_10_28",
    name: "ChromiumBasedBrowsersExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Extensions\\**10",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser extension files for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extensions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#chromium-based-browsers", "https://forensics.wiki/google_chrome#extension-activity-database"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_2",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_3",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_4",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_5",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_6",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_7",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_8",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_9",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#chromium-based-browsers", "https://forensics.wiki/google_chrome#extension-activity-database"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_10",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_11",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome#chromium-based-browsers", "https://forensics.wiki/google_chrome#extension-activity-database"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_12",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_13",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_14",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_15",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_16",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_17",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_18",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_19",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_20",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_21",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_22",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_23",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_24",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_25",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_26",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_27",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Extension Activity"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSION_ACTIVITY_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extension_activity_28",
    name: "ChromiumBasedBrowsersExtensionActivitySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Extension Activity",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browser Extension Activity SQLite database file for Chromium-based browsers,
such as Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
        "https://forensics.wiki/google_chrome#extension-activity-database",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_2",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_2",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_2",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_2",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_3",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_3",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_3",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_3",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_4",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_4",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_4",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_4",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_5",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_5",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_6",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_6",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_5",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_5",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_6",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_6",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_7",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_7",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_7",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_7",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_8",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_8",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_8",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_8",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_9",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_9",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_9",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_9",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_10",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_10",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_10",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_10",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_11",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_11",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_11",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_11",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_12",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_12",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_12",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_12",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_FAVICONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_favicons",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_FAVICONS_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_favicons_journal",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_13",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_13",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_13",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Network/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_13",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/*/Network/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_14",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_14",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_14",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_14",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_15",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_15",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_15",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_15",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Favicons-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_16",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Favicons"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICONS_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicons_journal_16",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_16",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Favicons",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_FAVICONS_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_favicons_journal_16",
    name: "ChromiumBasedBrowsersFaviconsDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Favicons-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Favicons database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/BraveSoftware/Brave-Browser/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_2",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_2",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/*/Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_2",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_2",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_3",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_3",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_3",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_3",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_4",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_4",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_4",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_4",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_5",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_5",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_5",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_5",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_6",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/Snapshots/*/*/History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_6",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/Snapshots/*/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_6",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_6",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_7",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_7",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge Beta/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_7",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_7",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/*/Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_8",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Microsoft Edge/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_8",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Microsoft Edge/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_8",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_8",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_9",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_9",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Yandex/YandexBrowser/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_9",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_9",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_10",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_10",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/com.operasoftware.Opera/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_10",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_10",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_11",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_11",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_11",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_11",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_12",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_12",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/google_chrome", "https://forensics.wiki/google_chrome#chromium-based-browsers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_12",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_12",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_13",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_13",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_13",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_13",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_14",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_14",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_14",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_14",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_15",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_15",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_15",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_15",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_16",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_16",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_16",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_16",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_17",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_17",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_18",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/Snapshots/*/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_18",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/Snapshots/*/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_17",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_17: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_17",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_19",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_19",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_18",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_18: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_18",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_20",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_20",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_19",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_19: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_19",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_21",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_21",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/yandex-browser-beta/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_20",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_20: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_20",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_22",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_22",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/chromium/common/chromium/*/History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_21",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_21: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_21",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_23",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_23",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Brave\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_24",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_24",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.appdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_22",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_22: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_22",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_25",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_25",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_23",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_23: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_23",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_26",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_26",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_24",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_24: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_24",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Archived History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_27",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_27",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_25",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_25: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_25",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_28",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_28",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_26",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_26: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_26",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_29",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_29",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_30: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_30",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\Snapshots\\*\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_30: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_30",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\Snapshots\\*\\*\\History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_27",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_27: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_27",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_31: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_31",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_31: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_31",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge Beta\\User Data\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_28",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Archived History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_28: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_28",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_32: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_32",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_32: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_32",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_29",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Archived History",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ARCHIVED_HISTORY_JOURNAL_29: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_archived_history_journal_29",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\Archived History-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_33: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_33",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_JOURNAL_33: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_journal_33",
    name: "ChromiumBasedBrowsersHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Yandex\\YandexBrowser\\User Data\\*\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Browsing history database file for multiple Chromium-based browsers, such as
Google Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://forensics.wiki/google_chrome",
        "https://forensics.wiki/google_chrome#chromium-based-browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_2",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_2",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_2",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_2",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_3",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_3",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_3",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_3",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_4",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_4",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_4",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_4",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_5",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_5",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_6",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_6",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_5",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_5",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_6",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_6",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_7",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_7",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_7",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_7",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_8",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_8",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_8",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_8",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_9",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_9",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_9",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_9",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_10",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_10",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_10",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_10",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_11",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_11",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/google-chrome-unstable/*/Network/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_11",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_11",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_12",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_12",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_12",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_12",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_LOGIN_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_login_data",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_LOGIN_DATA_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_login_data_journal",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_13",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_13",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_13",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Network/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_13",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/*/Network/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_14",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_14",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_14",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_14",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_15",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_15",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_15",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_15",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Login Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_16",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Login Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGIN_DATA_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_login_data_journal_16",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_16",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Login Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_login_data_journal_16",
    name: "ChromiumBasedBrowsersLoginDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Login Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Login Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\BraveSoftware\\Brave-Browser\\User Data\\*\\Network\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_2",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_2",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Chromium\\User Data\\*\\Network\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_2",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_2",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_3",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_3",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome SxS\\User Data\\*\\Network\\Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_3",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_3",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_4",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_4",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Google\\Chrome\\User Data\\*\\Network\\Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_4",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_4",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_5",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_5",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Edge\\User Data\\*\\Network\\Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_6",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_6",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\Network\\Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_5",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_5",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/BraveSoftware/Brave-Browser/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_6",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_6",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_7",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_7",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_7",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_7",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_8",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_8",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Network/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_8",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_8",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_9",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_9",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/chromium/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_9",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_9",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_10",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_10",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-beta/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_10",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_10",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_11",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_11",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome-unstable/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_11",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_11",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_12",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_12",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/google-chrome/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_12",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_12",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/microsoft-edge/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_WEB_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_web_data",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_WEB_DATA_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_web_data_journal",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.config/opera/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_13",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_13",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_13",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Chromium/*/Network/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_13: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_13",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Chromium/*/Network/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_14",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_14",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_14",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_14: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_14",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Beta/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_15",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_15",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_15",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_15: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_15",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Network/Web Data-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_16",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Google/Chrome/*/Web Data"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEB_DATA_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_web_data_journal_16",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_16",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Web Data",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NETWORK_WEB_DATA_JOURNAL_16: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_network_web_data_journal_16",
    name: "ChromiumBasedBrowsersWebDataDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Google/Chrome/*/Network/Web Data-journal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Web Data database file for multiple Chromium-based browsers, such as Google
Chrome, Brave, Chromium, Yandex, Opera, Edge, EdgeBeta.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_88: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_88",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/doomed/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/entries/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_89: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_89",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default-*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_2",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default-*/cache2/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_2",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default-*/cache2/doomed/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_2",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default-*/cache2/entries/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_90: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_90",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*.default/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_91: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_91",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_3",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default/cache2/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_3",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default/cache2/doomed/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_3",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default/cache2/entries/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_92: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_92",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default-*/Cache/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_4",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default-*/cache2/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_4",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default-*/cache2/doomed/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_4",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.cache/mozilla/firefox/*.default-*/cache2/entries/*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_93: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_93",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_5",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default/cache2/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_5",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default/cache2/doomed/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_5",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default/cache2/entries/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_94: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_94",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default-*/Cache/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_6",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default-*/cache2/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_6",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default-*/cache2/doomed/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_6",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/snap/firefox/common/.cache/mozilla/firefox/*.default-*/cache2/entries/*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_95: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_95",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_7",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default\\cache2\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_7",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default\\cache2\\doomed\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_7",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default\\cache2\\entries\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_96: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_96",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default-*\\Cache\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE2_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache2_8",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default-*\\cache2\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOOMED_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_doomed_8",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default-*\\cache2\\doomed\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENTRIES_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_entries_8",
    name: "FirefoxCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*.default-*\\cache2\\entries\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Mozilla Firefox browser caches.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/webbrowser/FirefoxCache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/cookies.sqlite",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_wal",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/cookies.sqlite-wal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_2",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/cookies.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_SHM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_shm",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/cookies.sqlite-shm"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_WAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_wal_2",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/cookies.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_3",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\cookies.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_WAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_wal_3",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\cookies.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_4",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\cookies.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_SQLITE_WAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_sqlite_wal_4",
    name: "FirefoxCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\cookies.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser cookies (cookies.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/downloads.sqlite",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_wal",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/downloads.sqlite-wal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_2",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/downloads.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_WAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_wal_2",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/downloads.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_3",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\downloads.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_WAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_wal_3",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\downloads.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_4",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\downloads.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADS_SQLITE_WAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloads_sqlite_wal_4",
    name: "FirefoxDownloads",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\downloads.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser downloads (downloads.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_wal",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite-wal",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_2",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/places.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_WAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_wal_2",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/places.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_3",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/firefox/common/.mozilla/firefox/*/places.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_WAL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_wal_3",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/snap/firefox/common/.mozilla/firefox/*/places.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_4",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\places.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_WAL_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_wal_4",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\places.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_5",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\places.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PLACES_SQLITE_WAL_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_places_sqlite_wal_5",
    name: "FirefoxHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\places.sqlite-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser history (places.sqlite).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/mozilla_firefox"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ADDONS_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_addons_json",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/addons.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_json",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/extensions.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEBAPPS_WEBAPPS_JSON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_webapps_webapps_json",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/webapps/webapps.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ADDONS_JSON_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_addons_json_2",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/addons.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_JSON_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_json_2",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/extensions.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEBAPPS_WEBAPPS_JSON_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_webapps_webapps_json_2",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.mozilla/firefox/*/webapps/webapps.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ADDONS_JSON_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_addons_json_3",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\addons.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_JSON_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_json_3",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\extensions.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEBAPPS_WEBAPPS_JSON_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_webapps_webapps_json_3",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Mozilla\\Firefox\\Profiles\\*\\webapps\\webapps.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ADDONS_JSON_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_addons_json_4",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\addons.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_JSON_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_json_4",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\extensions.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEBAPPS_WEBAPPS_JSON_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_webapps_webapps_json_4",
    name: "FirefoxAddOns",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Mozilla\\Firefox\\Profiles\\*\\webapps\\webapps.json"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Firefox browser add-ons/extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/osquery/osquery/blob/6969e075fd4118e36f6cab54b0956e53dde5ba3f/osquery/tables/applications/browser_firefox.cpp#"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_BROWSER_HELPER_OBJECTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_browser_helper_objects",
    name: "InternetExplorerBrowserHelperObjects",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Loaded on Internet Explorer startup",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://regenerus.com/malware-common-loadpoints/",
        "https://code.google.com/p/regripper/wiki/ASEPs",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_BROWSER_HELPER_OBJECTS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_browser_helper_objects_2",
    name: "InternetExplorerBrowserHelperObjects",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Loaded on Internet Explorer startup",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://regenerus.com/malware-common-loadpoints/", "https://code.google.com/p/regripper/wiki/ASEPs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__9: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__9",
    name: "InternetExplorerCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) browser cache.

* MSIE 4 - 9 Temporary Internet files.
* MSIE 10 INetCache files.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__10",
    name: "InternetExplorerCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) browser cache.

* MSIE 4 - 9 Temporary Internet files.
* MSIE 10 INetCache files.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__11",
    name: "InternetExplorerCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\INetCache\\IE\\*\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) browser cache.

* MSIE 4 - 9 Temporary Internet files.
* MSIE 10 INetCache files.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE__12: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file__12",
    name: "InternetExplorerCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\INetCache\\Low\\*\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) browser cache.

* MSIE 4 - 9 Temporary Internet files.
* MSIE 10 INetCache files.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_index_dat",
    name: "InternetExplorerCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\Cookies\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) browser cookies.

* MSIE 4 - 9 Cache files (index.dat)
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOW_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_low_index_dat",
    name: "InternetExplorerCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\Cookies\\Low\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) browser cookies.

* MSIE 4 - 9 Cache files (index.dat)
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WEBCACHE_WEBCACHEV_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_webcache_webcachev_dat",
    name: "InternetExplorerHistoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\WebCache\\WebCacheV*.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Microsoft Internet Explorer (MSIE) 10 browser history database file (WebCacheV*.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_IEDOWNLOADHISTORY_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_iedownloadhistory_index_dat",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\IEDownloadHistory\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FEEDS_CACHE_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_feeds_cache_index_dat",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Feeds Cache\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_index_dat",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Windows\\History\\History.IE5\\*\\index.dat",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_IE5_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_ie5_index_dat",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\History\\History.IE5\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEX_DAT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_index_dat_2",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Windows\\History\\Low\\History.IE5\\*\\index.dat",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_IE5_INDEX_DAT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_ie5_index_dat_2",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENT_IE5_INDEX_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_content_ie5_index_dat",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENT_IE5_INDEX_DAT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_content_ie5_index_dat_2",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HISTORY_IE5_INDEX_DAT_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_history_ie5_index_dat_3",
    name: "InternetExplorerIndexDatFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Local Settings\\History\\History.IE5\\index.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) 4 - 9 cache and history files (index.dat).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_INTERNET_EXPLORER_MAIN_NOPROTECTEDMODEBANNER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_internet_explorer_main_noprotectedmodebanner",
    name: "InternetExplorerProtectedModeDisable",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Internet Explorer\\Main\\NoProtectedModeBanner",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer (MSIE) Protected Mode Banner can be suppressed
by setting NoProtectedModeBanner.

* Applies to versions 7-11
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.blackforce.co.uk/2014/01/07/disable-protected-mode-is-turned-off-for-the-internet-zone-group-policy"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_INTERNET_EXPLORER_TYPEDURLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_internet_explorer_typedurls",
    name: "InternetExplorerTypedURLsKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Internet Explorer\\TypedURLs\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Microsoft Internet Explorer TypedUrls keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/internet_explorer#typed-urls"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_GLOBAL_HISTORY_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_global_history_dat",
    name: "OperaHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Opera/global_history.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Opera browser history (global_history.dat) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opera"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_GLOBAL_HISTORY_DAT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_global_history_dat_2",
    name: "OperaHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/.opera/global_history.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Opera browser history (global_history.dat) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opera"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_GLOBAL_HISTORY_DAT_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_global_history_dat_3",
    name: "OperaHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera\\Opera\\global_history.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Opera browser history (global_history.dat) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opera"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_STABLE_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_stable_history",
    name: "OperaHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Opera browser history (global_history.dat) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opera"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_OPERA_STABLE_HISTORY_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_opera_stable_history_journal",
    name: "OperaHistoryFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Opera Software\\Opera Stable\\History-journal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Opera browser history (global_history.dat) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opera"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_autofillcorrections_db",
    name: "SafariAutoFillCorrectionsSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/AutoFillCorrections.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser auto-fill corrections SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB_WAL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_safari_autofillcorrections_db_wal",
        name: "SafariAutoFillCorrectionsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Safari/AutoFillCorrections.db-wal"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Safari browser auto-fill corrections SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/apple_safari"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_COM_APPLE_SAFARI_CACHE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_safari_cache_db",
    name: "SafariCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/com.apple.Safari/Cache.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser cache (cache.db) SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_safari_cache_db_wal",
    name: "SafariCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/com.apple.Safari/Cache.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser cache (cache.db) SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_SAFARI_CACHE_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_safari_cache_db_2",
    name: "SafariCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Containers/com.apple.Safari/Data/Library/Caches/com.apple.Safari/Cache.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser cache (cache.db) SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_com_apple_safari_cache_db_wal_2",
    name: "SafariCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Containers/com.apple.Safari/Data/Library/Caches/com.apple.Safari/Cache.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser cache (cache.db) SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_CACHE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_cache_db",
    name: "SafariCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Apple Computer\\Safari\\cache.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser cache (cache.db) SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_safari_cloudautofillcorrections_db",
        name: "SafariCloudAutoFillCorrectionsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Safari/CloudAutoFillCorrections.db"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Safari browser cloud auto-fill corrections SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/apple_safari"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB_WAL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_safari_cloudautofillcorrections_db_wal",
        name: "SafariCloudAutoFillCorrectionsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Safari/CloudAutoFillCorrections.db-wal"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Safari browser cloud auto-fill corrections SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/apple_safari"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_COOKIES_COOKIES_BINARYCOOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_cookies_binarycookies",
    name: "SafariCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Cookies/Cookies.binarycookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari Cookies database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COOKIES_COOKIES_BINARYCOOKIES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cookies_cookies_binarycookies_2",
    name: "SafariCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari Cookies database.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_DOWNLOADS_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_downloads_plist",
    name: "SafariDownloadsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/Downloads.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari downloads history (Downloads.plist) property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_DOWNLOADS_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_downloads_plist_2",
    name: "SafariDownloadsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Apple Computer\\Safari\\Downloads.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari downloads history (Downloads.plist) property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_DOWNLOADS_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_downloads_plist_3",
    name: "SafariDownloadsPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Apple Computer\\Safari\\Downloads.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari downloads history (Downloads.plist) property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXTENSIONS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_extensions_3",
    name: "SafariExtensions",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/Extensions/**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser extensions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICON_CACHE_FAVICONS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicon_cache_favicons_db",
    name: "SafariFaviconsCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/Favicon Cache/favicons.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser favicons cache SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FAVICON_CACHE_FAVICONS_DB_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_favicon_cache_favicons_db_wal",
    name: "SafariFaviconsCacheSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/Favicon Cache/favicons.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser favicons cache SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_HISTORY_PLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_history_plist",
    name: "SafariHistoryPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/History.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser history (History.plist) property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_HISTORY_PLIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_history_plist_2",
    name: "SafariHistoryPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Apple Computer\\Safari\\History.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser history (History.plist) property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_HISTORY_PLIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_history_plist_3",
    name: "SafariHistoryPlistFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Apple Computer\\Safari\\History.plist"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Safari browser history (History.plist) property list (plist) file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_HISTORY_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_history_db",
    name: "SafariHistorySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/History.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser history SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_HISTORY_DB_WAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_history_db_wal",
    name: "SafariHistorySQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/History.db-wal"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser history SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_PERSITEPREFERENCES_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_safari_persitepreferences_db",
    name: "SafariPerSitePreferencesSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Safari/PerSitePreferences.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser per site preferences SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SAFARI_PERSITEPREFERENCES_DB_WAL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_safari_persitepreferences_db_wal",
        name: "SafariPerSitePreferencesSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.homedir%%/Library/Safari/PerSitePreferences.db-wal"),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Safari browser per site preferences SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/apple_safari"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_TABSNAPSHOTS_METADATA_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tabsnapshots_metadata_db",
    name: "SafariTabSnapshotsMetadataSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/Caches/com.apple.Safari/TabSnapshots/Metadata.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Safari browser tab snapshots metadata SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/apple_safari"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_touch_icons_cache_touchiconcachesettings_db",
        name: "SafariTouchIconCacheSettingsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Safari/Touch Icons Cache/TouchIconCacheSettings.db",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Safari browser touch icon cache settings SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/apple_safari"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB_WAL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_touch_icons_cache_touchiconcachesettings_db_wal",
        name: "SafariTouchIconCacheSettingsSQLiteDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%users.homedir%%/Library/Safari/Touch Icons Cache/TouchIconCacheSettings.db-wal",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::MacOS,
        decoder: Decoder::Identity,
        meaning: "Safari browser touch icon cache settings SQLite database file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/apple_safari"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_DATABASE_DATABASE_SQLITE3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_database_database_sqlite3",
    name: "WebKitPubSubSQLiteDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.homedir%%/Library/PubSub/Database/Database.sqlite3"),
    scope: DataScope::Mixed,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "WebKit RSS feed (PubSub) SQLite database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache_access_log",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE_ACCESS_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache_access_log_2",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache/access.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE2_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache2_access_log",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache2/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE2_ACCESS_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache2_access_log_2",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache2/access.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_apache2_other_vhosts_access_log",
        name: "ApacheAccessLogs",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/var/log/apache2/other_vhosts_access_log*"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Location where Apache access logs are stored",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_apache2_other_vhosts_access_log_2",
        name: "ApacheAccessLogs",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/var/log/apache2/other_vhosts_access.log*"),
        scope: DataScope::Mixed,
        os_scope: OsScope::All,
        decoder: Decoder::Identity,
        meaning: "Location where Apache access logs are stored",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_HTTPD_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_httpd_access_log",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/httpd/access_log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HTTPD_ACCESS_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_httpd_access_log_2",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/httpd/access.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ACCESS_LOG_11: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_access_log_11",
    name: "ApacheAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\**6\\logs\\access.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE2_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache2_conf",
    name: "ApacheConfigurationFolder",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apache2/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Apache keeps configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HTTPD_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_httpd_conf",
    name: "ApacheConfigurationFolder",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/httpd/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Apache keeps configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_D_CONF_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_d_conf_2",
    name: "ApacheConfigurationFolder",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/httpd/conf.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Apache keeps configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONF_MODULES_D_CONF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_conf_modules_d_conf",
    name: "ApacheConfigurationFolder",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/httpd/conf.modules.d/*.conf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where Apache keeps configuration files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SITES_AVAILABLE_000_DEFAULT_CONF: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_sites_available_000_default_conf",
        name: "ApacheDefaultSiteConfigurationFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("/etc/apache2/sites-available/000-default.conf"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Linux,
        decoder: Decoder::Identity,
        meaning: "Location where Apache keeps the default site configuration file.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_APACHE_ERROR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache_error",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache/error*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE_ERROR_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache_error_log",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache/error.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE2_ERROR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache2_error",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache2/error*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APACHE2_ERROR_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apache2_error_log",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/apache2/error.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HTTPD_ERROR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_httpd_error",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/httpd/error*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_HTTPD_ERROR_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_httpd_error_log",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/httpd/error.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ERROR_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_error_log",
    name: "ApacheErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\**6\\logs\\error.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where Apache error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NGINX_ACCESS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_nginx_access_log",
    name: "NginxAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/nginx/access.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where nginx access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_LOG_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_log_6",
    name: "NginxAccessLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\nginx\\logs\\*.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Location where nginx access logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NGINX_ERROR_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_nginx_error_log",
    name: "NginxErrorLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/nginx/error.log*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Location where nginx error logs are stored",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WP_CONFIG_PHP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wp_config_php",
    name: "WordpressConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/www/**/wp-config.php"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WordPress configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WWW_WP_CONFIG_PHP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_www_wp_config_php",
    name: "WordpressConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/private/var/www/wp-config.php"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WordPress configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WP_CONFIG_PHP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wp_config_php_2",
    name: "WordpressConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/www/**/wp-config.php"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WordPress configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WWW_WP_CONFIG_PHP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_www_wp_config_php_2",
    name: "WordpressConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/www/wp-config.php"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WordPress configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WP_WP_CONFIG_PHP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wp_wp_config_php",
    name: "WordpressConfigFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/wp/wp-config.php"),
    scope: DataScope::Mixed,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WordPress configuration file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGFILES_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logfiles_log",
    name: "MicrosoftIISLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\inetpub\\logs\\LogFiles\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Internet Information Services (IIS) web server's log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_W3SVC_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_w3svc_log",
    name: "MicrosoftIISLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\inetpub\\logs\\LogFiles\\W3SVC*\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Internet Information Services (IIS) web server's log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_W3SVC_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_w3svc_log_2",
    name: "MicrosoftIISLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_systemdrive%%\\Resources\\Directory\\*\\LogFiles\\Web\\W3SVC*\\*.log",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Internet Information Services (IIS) web server's log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_W3SVC_LOG_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_w3svc_log_3",
    name: "MicrosoftIISLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\LogFiles\\W3SVC*\\*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Internet Information Services (IIS) web server's log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_COMPONENTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_components",
    name: "WindowsActiveDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path:
        "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Internet Explorer\\Desktop\\Components\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Active Desktop settings and components.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ActiveDesktop.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_INTERNET_EXPLORER_DESKTOP_GENERAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_internet_explorer_desktop_general",
    name: "WindowsActiveDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Internet Explorer\\Desktop\\General",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Active Desktop settings and components.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ActiveDesktop.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NTDS_NTDS_DIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ntds_ntds_dit",
    name: "WindowsActiveDirectoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\ntds\\ntds.dit"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Active Directory database file (ntds.dit).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772829(v=ws.10)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NTDS_DIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ntds_dit",
    name: "WindowsActiveDirectoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\ServicePackFiles\\*\\ntds.dit*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Active Directory database file (ntds.dit).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772829(v=ws.10)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NTDS_DIT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ntds_dit_2",
    name: "WindowsActiveDirectoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\SoftwareDistribution\\Download\\*\\*\\ntds.dit*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Active Directory database file (ntds.dit).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772829(v=ws.10)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_NTDS_DIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_ntds_dit",
    name: "WindowsActiveDirectoryDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\ntds.dit"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Active Directory database file (ntds.dit).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772829(v=ws.10)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_windows_ce_services_autostartonconnect",
        name: "WindowsActiveSyncAutoStart",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Microsoft\\Windows CE Services\\AutoStartOnConnect\\*",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows ActiveSync AutoStart entries",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_windows_ce_services_autostartondisconnect",
        name: "WindowsActiveSyncAutoStart",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect\\*",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows ActiveSync AutoStart entries",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_windows_ce_services_autostartonconnect_2",
        name: "WindowsActiveSyncAutoStart",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Wow6432Node\\Microsoft\\Windows CE Services\\AutoStartOnConnect\\*",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows ActiveSync AutoStart entries",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_windows_ce_services_autostartondisconnect_2",
        name: "WindowsActiveSyncAutoStart",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Wow6432Node\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect\\*",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows ActiveSync AutoStart entries",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_L_USERS_USERNAME_ACTIVITIESCACHE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_l_users_username_activitiescache_db",
    name: "WindowsActivitiesCacheDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\ConnectedDevicesPlatform\\L.%%users.username%%\\ActivitiesCache.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "SQLite database containing the Windows activities cache.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ActivitiesCacheDatabase.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PROGRAMS_AMCACHE_HVE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_programs_amcache_hve",
    name: "WindowsAMCacheHveFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\AppCompat\\Programs\\Amcache.hve"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The AMCache file, stored in the Windows NT Registry file format.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/AMCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PROGRAMS_AMCACHE_HVE_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_programs_amcache_hve_log1",
    name: "WindowsAMCacheHveFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\AppCompat\\Programs\\Amcache.hve.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The AMCache file, stored in the Windows NT Registry file format.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/AMCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PROGRAMS_AMCACHE_HVE_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_programs_amcache_hve_log2",
    name: "WindowsAMCacheHveFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\AppCompat\\Programs\\Amcache.hve.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The AMCache file, stored in the Windows NT Registry file format.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/AMCache.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROL_SESSION_MANAGER_APPCERTDLLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_control_session_manager_appcertdlls",
    name: "WindowsAppCertDLLs",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Control\\Session Manager\\AppCertDLLs",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows AppCertDLLs persistence.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://blogs.technet.com/b/mmpc/archive/2011/03/19/how-to-defang-the-fake-defragmenter.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_APP_PATHS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_app_paths",
    name: "WindowsApplicationRegistration",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Registration (AppPath) Registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://github.com/keydet89/RegRipper2.8/blob/master/plugins/apppaths.pl",
        "http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/",
        "https://msdn.microsoft.com/en-us/library/windows/desktop/ee872121(v=vs.85).aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_APP_PATHS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_app_paths_2",
    name: "WindowsApplicationRegistration",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Registration (AppPath) Registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://github.com/keydet89/RegRipper2.8/blob/master/plugins/apppaths.pl",
        "http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/",
        "https://msdn.microsoft.com/en-us/library/windows/desktop/ee872121(v=vs.85).aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPPATCH_DRVMAIN_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apppatch_drvmain_sdb",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\drvmain.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPPATCH_FRXMAIN_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apppatch_frxmain_sdb",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\frxmain.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPPATCH_MSIMAIN_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apppatch_msimain_sdb",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\msimain.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPPATCH_PCAMAIN_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apppatch_pcamain_sdb",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\pcamain.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPPATCH_SYSMAIN_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apppatch_sysmain_sdb",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\sysmain.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CUSTOM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_custom",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\AppPatch64\\Custom\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CUSTOM_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_custom_2",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\Custom\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CUSTOM64: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_custom64",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\Custom\\Custom64\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CUSTOMSDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_customsdb",
    name: "WindowsApplicationCompatibilityInstalledShimDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AppPatch\\CustomSDB\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Application Compatibility Installed Shim Databases.

drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
shim database files (SDB files) that are provided by Windows, and contain
many predefined shims that address known application compatibility issues.
Note that these database files are not signed.

Windows also supports custom shim database. These are typically installed
by the sdbinst.exe utility. Note, that shim database files can also exist
elsewhere in the file system.

Windows application shims provide a way for the operating system to
apply patches to executables before they are run, ultimately providing
a lightweight mechanism for applying hot fixes and making modifications to
ensure compatibility across the various versions of Windows. This
functionality can also be leveraged maliciously to change how certain
programs operate, or to provide capabilities to malware, such as the
ability to bypass UAC, gain persistence by injecting loading into legitimate
processes, or avoid detection by disabling anti-virus software.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://countercept.com/blog/hunting-for-application-shim-databases/", "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_WINAPPXRT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_winappxrt_dll",
    name: "WindowsAppXRT",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\system32\\WinAppXRT.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMROOT_WINAPPXRT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemroot_winappxrt_dll",
    name: "WindowsAppXRT",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\WinAppXRT.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WBEM_WINAPPXRT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wbem_winappxrt_dll",
    name: "WindowsAppXRT",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\Wbem\\WinAppXRT.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_V1_0_WINAPPXRT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_v1_0_winappxrt_dll",
    name: "WindowsAppXRT",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\WindowsPowerShell\\v1.0\\WinAppXRT.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_AUTOEXEC_BAT: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_environ_systemdrive_autoexec_bat",
        name: "WindowsAutoexecBat",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemdrive%%\\autoexec.bat"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows autoexec.bat file",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ENVIRON_WINDIR_AUTOEXEC_NT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_autoexec_nt",
    name: "WindowsAutoexecBat",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\autoexec.nt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows autoexec.bat file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_AUTOEXCLUSIONLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_autoexclusionlist",
    name: "WindowsAutomaticDebuggingExclusionList",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\AutoExclusionList\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows automatic debugging (Aedebug) exclusion list",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/bb204634(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_AUTORUN_INF: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_environ_systemdrive_autorun_inf",
        name: "WindowsAutorun",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemdrive%%\\autorun.inf"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Filebased Tests.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::High,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_CURRENTVERSION_TIME_ZONES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_time_zones",
    name: "WindowsAvailableTimeZones",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Timezones available on a Windows system.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://github.com/libyal/winreg-kb/blob/main/documentation/Time%20zone%20keys.asciidoc",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_BAM_USERSETTINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_bam_usersettings",
    name: "WindowsBackgroundActivityModeratorKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\bam\\UserSettings\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://dfir.ru/2020/04/08/bam-internals/", "https://notes.qazeer.io/dfir/windows/_artefacts_overview"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_STATE_USERSETTINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_state_usersettings",
    name: "WindowsBackgroundActivityModeratorKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://dfir.ru/2020/04/08/bam-internals/", "https://notes.qazeer.io/dfir/windows/_artefacts_overview"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DAM_USERSETTINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_dam_usersettings",
    name: "WindowsBackgroundActivityModeratorKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\dam\\UserSettings\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://dfir.ru/2020/04/08/bam-internals/", "https://notes.qazeer.io/dfir/windows/_artefacts_overview"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_STATE_USERSETTINGS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_state_usersettings_2",
    name: "WindowsBackgroundActivityModeratorKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\dam\\State\\UserSettings\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://dfir.ru/2020/04/08/bam-internals/", "https://notes.qazeer.io/dfir/windows/_artefacts_overview"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADER_QMGR_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloader_qmgr_dat",
    name: "WindowsBITSQueueManagerDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersprofile%%\\Microsoft\\Network\\Downloader\\qmgr*.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Databases that contain the Windows BITS jobs definition and state.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://dfrws.org/2015/proceedings/presentations/DFRWS2015-pres3.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DOWNLOADER_QMGR_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_downloader_qmgr_db",
    name: "WindowsBITSQueueManagerDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersprofile%%\\Microsoft\\Network\\Downloader\\qmgr.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Databases that contain the Windows BITS jobs definition and state.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://dfrws.org/2015/proceedings/presentations/DFRWS2015-pres3.pdf"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\Boot\\BCD"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_log",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\Boot\\BCD.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_log1",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\Boot\\BCD.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_log2",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\Boot\\BCD.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_2",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Boot\\BCD"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_LOG_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_log_2",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Boot\\BCD.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_LOG1_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_log1_2",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Boot\\BCD.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_BOOT_BCD_LOG2_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_boot_bcd_log2_2",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Boot\\BCD.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECOVERY_BCD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recovery_bcd",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Recovery\\BCD"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECOVERY_BCD_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recovery_bcd_log",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Recovery\\BCD.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECOVERY_BCD_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recovery_bcd_log1",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Recovery\\BCD.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECOVERY_BCD_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recovery_bcd_log2",
    name: "WindowsBootConfigurationDataRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\EFI\\Microsoft\\Recovery\\BCD.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Boot Configuration Data (BCD) Windows Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_CIM_REP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_cim_rep",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\System\\Wbem\\Repository\\cim.rep"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_CIM_REC: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_cim_rec",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\CIM.REC"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_CIM_REP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_cim_rep_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\CIM.REP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_INDEX_BTR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_index_btr",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\INDEX.BTR"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_INDEX_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_index_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\INDEX.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_MAPPING_VER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_mapping_ver",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\MAPPING.VER"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_MAPPING_1_3_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_mapping_1_3_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\MAPPING[1-3].MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_OBJECTS_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_objects_data",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\OBJECTS.DATA"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_OBJECTS_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_objects_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\OBJECTS.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_INDEX_BTR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_index_btr",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\FS\\INDEX.BTR"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_INDEX_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_index_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\FS\\INDEX.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_MAPPING_VER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_mapping_ver",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\FS\\MAPPING.VER"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_MAPPING_1_2_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_mapping_1_2_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\FS\\MAPPING[1-2].MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_OBJECTS_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_objects_data",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\FS\\OBJECTS.DATA"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_OBJECTS_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_objects_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository\\FS\\OBJECTS.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_00_1_9_INDEX_BTR: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_00_1_9_index_btr",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\INDEX.BTR"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_00_1_9_INDEX_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_00_1_9_index_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\INDEX.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_00_1_9_MAPPING_VER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_00_1_9_mapping_ver",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\MAPPING.VER"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_00_1_9_MAPPING_1_3_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_00_1_9_mapping_1_3_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\MAPPING[1-3].MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_00_1_9_OBJECTS_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_00_1_9_objects_data",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\OBJECTS.DATA"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REPOSITORY_00_1_9_OBJECTS_MAP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_repository_00_1_9_objects_map",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\OBJECTS.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_INDEX_BTR_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_index_btr_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\FS\\INDEX.BTR"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_INDEX_MAP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_index_map_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\FS\\INDEX.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_MAPPING_VER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_mapping_ver_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\FS\\MAPPING.VER"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_MAPPING_1_2_MAP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_mapping_1_2_map_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\FS\\MAPPING[1-2].MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_OBJECTS_DATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_objects_data_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\FS\\OBJECTS.DATA"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FS_OBJECTS_MAP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_fs_objects_map_2",
    name: "WindowsCIMRepositoryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\wbem\\Repository.00[1-9]\\FS\\OBJECTS.MAP"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Common Information Model (CIM) repository.

Persistent database that holds the schema, also called the object repository or class store,
that models the managed environment and defines every piece of data exposed by WMI.

This definition does not specify the copies of the CIM repository that are stored in system restore points.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc", "https://forensics.wiki/wmi"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INTERNET_EXPLORER_SXS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_internet_explorer_sxs_dll",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfiles%%\\Internet Explorer\\sxs.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INTERNET_EXPLORER_SXS_DLL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_internet_explorer_sxs_dll_2",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programfilesx86%%\\Internet Explorer\\sxs.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_EXPLORER_EXE: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_environ_systemdrive_explorer_exe",
        name: "WindowsCommonFilePlacementAttacks",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemdrive%%\\explorer.exe"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning:
            "Common files associated with search order hijacking and other file placement attacks.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
            "https://www.mandiant.com/blog/fxsst/",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_PROGRAM_EXE: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_environ_systemdrive_program_exe",
        name: "WindowsCommonFilePlacementAttacks",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemdrive%%\\program.exe"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning:
            "Common files associated with search order hijacking and other file placement attacks.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
            "https://www.mandiant.com/blog/fxsst/",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ENVIRON_SYSTEMROOT_LINKINFO_DLL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_environ_systemroot_linkinfo_dll",
        name: "WindowsCommonFilePlacementAttacks",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemroot%%\\linkinfo.dll"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning:
            "Common files associated with search order hijacking and other file placement attacks.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
            "https://www.mandiant.com/blog/fxsst/",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ENVIRON_SYSTEMROOT_NTSHRUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemroot_ntshrui_dll",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\ntshrui.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_OCI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_oci_dll",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\oci.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSPREP_CRYPTBASE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysprep_cryptbase_dll",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\sysprep\\cryptbase.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSWOW64_OCI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_syswow64_oci_dll",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\SysWOW64\\oci.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSPREP_CRYPTBASE_DLL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sysprep_cryptbase_dll_2",
    name: "WindowsCommonFilePlacementAttacks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\SysWOW64\\sysprep\\cryptbase.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Common files associated with search order hijacking and other file placement attacks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf",
        "https://www.mandiant.com/blog/fxsst/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_CONFIG_SYS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemdrive_config_sys",
    name: "WindowsConfigSys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\config.sys"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows config.sys file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CONFIG_NT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_config_nt",
    name: "WindowsConfigSys",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\config.nt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows config.sys file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_CONTROL_PANEL_CPLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_control_panel_cpls",
    name: "WindowsControlPanelFilePaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLLs listed here will be run when the user opens the Windows Control Panel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127454(v=vs.85).aspx",
        "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm",
        "https://msdn.microsoft.com/en-us/library/windows/desktop/ms683844(v=vs.85).aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_CONTROL_PANEL_CPLS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_control_panel_cpls_2",
    name: "WindowsControlPanelFilePaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLLs listed here will be run when the user opens the Windows Control Panel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127454(v=vs.85).aspx",
        "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm",
        "https://msdn.microsoft.com/en-us/library/windows/desktop/ms683844(v=vs.85).aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_CONTROL_PANEL_CPLS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_control_panel_cpls_3",
    name: "WindowsControlPanelFilePaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLLs listed here will be run when the user opens the Windows Control Panel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127454(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm", "https://msdn.microsoft.com/en-us/library/windows/desktop/ms683844(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_CONTROL_PANEL_CPLS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_control_panel_cpls_4",
    name: "WindowsControlPanelFilePaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLLs listed here will be run when the user opens the Windows Control Panel.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127454(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm", "https://msdn.microsoft.com/en-us/library/windows/desktop/ms683844(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INDEXED_DB_INDEXEDDB_EDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_indexed_db_indexeddb_edb",
    name: "WindowsCortanaDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\Microsoft.Windows.Cortana_*\\AppData\\Indexed DB\\IndexedDB.edb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Cortana database",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/cortana"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ESEDATABASE_CORTANACOREINSTANCE_CORTANACOREDB_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_esedatabase_cortanacoreinstance_cortanacoredb_dat",
    name: "WindowsCortanaDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\Microsoft.Windows.Cortana_*\\LocalState\\ESEDatabase_CortanaCoreInstance\\CortanaCoreDb.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Cortana database",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/cortana"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wer",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersprofile%%\\Microsoft\\Windows\\WER\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMROOT_DMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemroot_dmp",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\*.dmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MINIDUMP_DMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_minidump_dmp",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Minidump\\*.dmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRASHDUMPS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_crashdumps",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\ServiceProfiles\\AppData\\Local\\CrashDumps\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_DMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_dmp",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\ServiceProfiles\\AppData\\Local\\Temp\\*.dmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRASHDUMPS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_crashdumps_2",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_systemroot%%\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\**",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_DMP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_dmp_2",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_systemroot%%\\System32\\config\\systemprofile\\AppData\\Local\\Temp\\*.dmp",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_DMP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_dmp_3",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Temp\\*.dmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CRASHDUMPS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_crashdumps_3",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\CrashDumps\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wer_2",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\WER\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_DMP_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_dmp_4",
    name: "WindowsCrashDumps",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Temp\\*.dmp"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Error Reporting (WER) files and crash dumps.

The files include information about the crashed processes and potentially
process dumps, whether auto-generated upon a crash or by a user. It's helpful
to analyze them to identify unexpected process executions or exploitation
attempts.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#crash-and-minidumps"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authentication_credential_provider_filters",
    name: "WindowsCredentialProviderFilters",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Provider Filters\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Credential Provider Filters",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authentication_credential_provider_filters_2",
    name: "WindowsCredentialProviderFilters",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Provider Filters\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Credential Provider Filters",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHENTICATION_CREDENTIAL_PROVIDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authentication_credential_providers",
    name: "WindowsCredentialProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs of applications to use as Credential Providers",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://blogs.technet.com/b/ad/archive/2009/05/26/thoughts-on-single-sign-on-and-credential-providers.aspx", "http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/", "https://www.sophos.com/en-us/support/knowledgebase/114190.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHENTICATION_CREDENTIAL_PROVIDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authentication_credential_providers_2",
    name: "WindowsCredentialProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs of applications to use as Credential Providers",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://blogs.technet.com/b/ad/archive/2009/05/26/thoughts-on-single-sign-on-and-credential-providers.aspx", "http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/", "https://www.sophos.com/en-us/support/knowledgebase/114190.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_METADATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_metadata",
    name: "WindowsCryptnetUrlCacheMetadata",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Metadata of a Windows cache of files downloaded from the internet.

Helpful when investigating the use of \"Living of the Land\" tools that allow
attackers to download arbitrary files from the internet, such as
\"certutil.exe\".
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#cryptnet-url-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_METADATA_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_metadata_2",
    name: "WindowsCryptnetUrlCacheMetadata",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Metadata of a Windows cache of files downloaded from the internet.

Helpful when investigating the use of \"Living of the Land\" tools that allow
attackers to download arbitrary files from the internet, such as
\"certutil.exe\".
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#cryptnet-url-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_METADATA_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_metadata_3",
    name: "WindowsCryptnetUrlCacheMetadata",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.userprofile%%\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Metadata of a Windows cache of files downloaded from the internet.

Helpful when investigating the use of \"Living of the Land\" tools that allow
attackers to download arbitrary files from the internet, such as
\"certutil.exe\".
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#cryptnet-url-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_content",
    name: "WindowsCryptnetUrlCacheContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Content of a Windows cache of files downloaded from the internet.

Helpful when investigating the use of \"Living of the Land\" tools that allow
attackers to download arbitrary files from the internet, such as
\"certutil.exe\".
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#cryptnet-url-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_content_2",
    name: "WindowsCryptnetUrlCacheContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Content of a Windows cache of files downloaded from the internet.

Helpful when investigating the use of \"Living of the Land\" tools that allow
attackers to download arbitrary files from the internet, such as
\"certutil.exe\".
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#cryptnet-url-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONTENT_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_content_3",
    name: "WindowsCryptnetUrlCacheContent",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.userprofile%%\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Content of a Windows cache of files downloaded from the internet.

Helpful when investigating the use of \"Living of the Land\" tools that allow
attackers to download arbitrary files from the internet, such as
\"certutil.exe\".
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#cryptnet-url-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DISALLOWED_CERTIFICATES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_disallowed_certificates",
    name: "WindowsDisallowedSystemCertificates",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\SystemCertificates\\Disallowed\\Certificates\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Disallowed System Certificates

Malware can add code-signing certificates associated with
antivirus programs to the disallowed list to prevent the
AV programs from running.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-misplacedcertificate/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DISALLOWED_CERTIFICATES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_disallowed_certificates_2",
    name: "WindowsDisallowedSystemCertificates",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Policies\\Microsoft\\SystemCertificates\\Disallowed\\Certificates\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Disallowed System Certificates

Malware can add code-signing certificates associated with
antivirus programs to the disallowed list to prevent the
AV programs from running.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-misplacedcertificate/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DISALLOWED_CERTIFICATES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_disallowed_certificates_3",
    name: "WindowsDisallowedSystemCertificates",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Policies\\Microsoft\\SystemCertificates\\Disallowed\\Certificates\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Disallowed System Certificates

Malware can add code-signing certificates associated with
antivirus programs to the disallowed list to prevent the
AV programs from running.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-misplacedcertificate/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DISALLOWED_CERTIFICATES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_disallowed_certificates_4",
    name: "WindowsDisallowedSystemCertificates",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Policies\\Microsoft\\SystemCertificates\\Disallowed\\Certificates\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Disallowed System Certificates

Malware can add code-signing certificates associated with
antivirus programs to the disallowed list to prevent the
AV programs from running.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://blog.malwarebytes.com/detections/pum-optional-misplacedcertificate/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_APPEVENT_EVT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_appevent_evt",
    name: "WindowsEventLogApplication",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\AppEvent.evt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Application Windows Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_WINEVT_PUBLISHERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_winevt_publishers",
    name: "WindowsEventLogPublishers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows EventLog publishers (or providers) Registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://winreg-kb.readthedocs.io/en/latest/sources/EventLog-keys.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_EVT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_evt",
    name: "WindowsEventLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\*.evt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Event logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_evtx",
    name: "WindowsEventLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\*.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Event logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SECEVENT_EVT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_secevent_evt",
    name: "WindowsEventLogSecurity",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SecEvent.evt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Security Windows Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EVENTLOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_eventlog",
    name: "WindowsEventLogSources",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\EventLog\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows EventLog sources Registry keys.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://winreg-kb.readthedocs.io/en/latest/sources/EventLog-keys.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SYSEVENT_EVT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_sysevent_evt",
    name: "WindowsEventLogSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SysEvent.evt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "System Windows Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SHUTDOWNLOGGER_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_shutdownlogger_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*.etl",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_COLLECTORS_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_collectors_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Microsoft\\DiagnosticLogCSP\\Collectors\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WFP_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wfp_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Microsoft\\Windows\\wfp\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\Microsoft\\Windows Security Health\\Logs\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersappdata%%\\USOShared\\Logs\\System\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PERSONAL_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_personal_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\OneDrive\\logs\\Personal\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXPLORER_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_explorer_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\Explorer\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOCALSTATE_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_localstate_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%users.localappdata%%\\Packages\\Microsoft.Windows.Photos_*\\LocalState\\*.etl",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Logs\\*\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PANTHER_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_panther_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Panther\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ETL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_etl_2",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Security\\Logs\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_ETL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_etl_3",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\DeliveryOptimization\\Logs\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WMI_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wmi_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\LogFiles\\WMI\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WMI_ETL_0: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_wmi_etl_0",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\LogFiles\\WMI\\*.etl.0*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RTBACKUP_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_rtbackup_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\LogFiles\\WMI\\RtBackup\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SLEEPSTUDY_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sleepstudy_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\SleepStudy\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SCREENON_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_screenon_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\SleepStudy\\ScreenOn\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGFILES_ETL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logfiles_etl",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\WDI\\LogFiles\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGFILES_ETL_0: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logfiles_etl_0",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\WDI\\LogFiles\\*.etl.0*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etl_2",
    name: "WindowsEventTracingLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_systemroot%%\\System32\\WDI\\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\\*\\*.etl",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Event Tracing for Windows (ETW) log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/event_tracing_for_windows_(etw)"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTOPLAYHANDLERS_HANDLERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_autoplayhandlers_handlers",
    name: "WindowsExplorerAutoplayHandlers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path:
        "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoplayHandlers\\Handlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Handlers for autoplay events in Windows Explorer.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa468474.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_COMMONPLACES_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_commonplaces_namespace",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_COMMONPLACES_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_commonplaces_namespace_2",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_COMMONPLACES_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_commonplaces_namespace_3",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_COMMONPLACES_NAMESPACE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_commonplaces_namespace_4",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_delegatefolders",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_delegatefolders_4",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CommonPlaces\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\CommonPlaces\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_2",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\CommonPlaces\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_delegatefolders_5",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\CommonPlaces\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_commonplaces_namespace_delegatefolders_6",
    name: "WindowsExplorerNamespaceCommonPlaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\CommonPlaces\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Common Places items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm", "http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_CONTROLPANEL_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_controlpanel_namespace",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx",
        "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_CONTROLPANEL_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_controlpanel_namespace_2",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_delegatefolders",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanel\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanel\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_explorer_controlpanelwow64_namespace",
        name: "WindowsExplorerNamespaceControlPanel",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path:
            "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanelWOW64\\NameSpace",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "CLSIDs listed here are used to populate the Control Panel items.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx",
            "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_controlpanelwow64_namespace_2",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanelWOW64\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACEWOW64_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespacewow64_delegatefolders",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpaceWOW64\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanelwow64_namespace_delegatefolders",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanelWOW64\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANELWOW64_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanelwow64_namespace",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanelWOW64\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanelwow64_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanelWOW64\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_CONTROLPANEL_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_controlpanel_namespace_3",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_CONTROLPANEL_NAMESPACE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_controlpanel_namespace_4",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_delegatefolders_4",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_delegatefolders_5",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_2",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanel\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanel_namespace_delegatefolders_6",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanel\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_controlpanelwow64_namespace_3",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanelWOW64\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_controlpanelwow64_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespaceControlPanel",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Wow6432Node\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\ControlPanelWOW64\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Control Panel items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_DESKTOP_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_desktop_namespace",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_DESKTOP_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_desktop_namespace_2",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_delegatefolders",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\Desktop\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\Desktop\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_DESKTOP_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_desktop_namespace_3",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_DESKTOP_NAMESPACE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_desktop_namespace_4",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_delegatefolders_4",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Wow6432Node\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_delegatefolders_5",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_2",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\Desktop\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_desktop_namespace_delegatefolders_6",
    name: "WindowsExplorerNamespaceDesktop",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\Desktop\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Desktop items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop", "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm", "https://support.microsoft.com/en-us/kb/321777"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_namespace",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_namespace_2",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_delegatefolders",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\MyComputer\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\MyComputer\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_namespace_3",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_NAMESPACE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_namespace_4",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_delegatefolders_4",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Wow6432Node\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_delegatefolders_5",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_2",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\MyComputer\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_mycomputer_namespace_delegatefolders_6",
    name: "WindowsExplorerNamespaceMyComputer",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\MyComputer\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the MyComputer items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm", "http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/", "http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_explorer_networkneighborhood_namespace",
        name: "WindowsExplorerNamespaceNetworkNeighborhood",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path:
            "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm",
            "http://www.lavasoft.com/mylavasoft/rogues/secretservice",
            "http://www.wikihow.com/Manually-Remove-Macatte-Malware",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_networkneighborhood_namespace_2",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_delegatefolders",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\NetworkNeighborhood\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\NetworkNeighborhood\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_networkneighborhood_namespace_3",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_networkneighborhood_namespace_4",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_delegatefolders_4",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_delegatefolders_5",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\NetworkNeighborhood\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_2",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\NetworkNeighborhood\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_networkneighborhood_namespace_delegatefolders_6",
    name: "WindowsExplorerNamespaceNetworkNeighborhood",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\NetworkNeighborhood\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Network Neighborhood items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm", "http://www.lavasoft.com/mylavasoft/rogues/secretservice", "http://www.wikihow.com/Manually-Remove-Macatte-Malware"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_printersandfaxes_namespace",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_printersandfaxes_namespace_2",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_delegatefolders",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_delegatefolders_2",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\PrintersAndFaxes\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_delegatefolders_3",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\PrintersAndFaxes\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_printersandfaxes_namespace_3",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_printersandfaxes_namespace_4",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_delegatefolders_4",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_delegatefolders_5",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PrintersAndFaxes\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_2",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\PrintersAndFaxes\\NameSpace",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_printersandfaxes_namespace_delegatefolders_6",
    name: "WindowsExplorerNamespacePrintersAndFaxes",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\*\\PrintersAndFaxes\\NameSpace\\DelegateFolders",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CLSIDs listed here are used to populate the Printer and Fax items.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_FIREWALL_PFIREWALL_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_firewall_pfirewall_log",
    name: "WindowsFirewallLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\logfiles\\firewall\\pfirewall.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall default logfile",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/configure-the-windows-firewall-log"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SCRIPTS_PSSCRIPTS_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_scripts_psscripts_ini",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\User\\Scripts\\psscripts.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SCRIPTS_SCRIPTS_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_scripts_scripts_ini",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\User\\Scripts\\scripts.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGOFF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logoff",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\User\\Scripts\\Logoff\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGON: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logon",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\User\\Scripts\\Logon\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SCRIPTS_PSSCRIPTS_INI_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_scripts_psscripts_ini_2",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_systemroot%%\\System32\\GroupPolicy\\Machine\\Scripts\\psscripts.ini",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SCRIPTS_SCRIPTS_INI_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_scripts_scripts_ini_2",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\Machine\\Scripts\\scripts.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SHUTDOWN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_shutdown",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\Machine\\Scripts\\Shutdown\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STARTUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_startup",
    name: "WindowsGroupPolicyScripts",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\GroupPolicy\\Machine\\Scripts\\Startup\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows group policy scripts",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHORIZEDAPPLICATIONS_LIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authorizedapplications_list",
    name: "WindowsFirewallAuthorizedApplications",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\AuthorizedApplications\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Authorized Applications

Malware can add paths to this list to more easily communicate
over the network on an infected machine. For instance, Emotet
modifies some these settings after gaining execution.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://threatvector.cylance.com/en_us/home/threat-spotlight-eyepyramid-malware.html", "https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHORIZEDAPPLICATIONS_LIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authorizedapplications_list_2",
    name: "WindowsFirewallAuthorizedApplications",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\WindowsFirewall\\StandardProfile\\AuthorizedApplications\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Authorized Applications

Malware can add paths to this list to more easily communicate
over the network on an infected machine. For instance, Emotet
modifies some these settings after gaining execution.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://threatvector.cylance.com/en_us/home/threat-spotlight-eyepyramid-malware.html", "https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHORIZEDAPPLICATIONS_LIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authorizedapplications_list_3",
    name: "WindowsFirewallAuthorizedApplications",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\AuthorizedApplications\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Authorized Applications

Malware can add paths to this list to more easily communicate
over the network on an infected machine. For instance, Emotet
modifies some these settings after gaining execution.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://threatvector.cylance.com/en_us/home/threat-spotlight-eyepyramid-malware.html", "https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHORIZEDAPPLICATIONS_LIST_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authorizedapplications_list_4",
    name: "WindowsFirewallAuthorizedApplications",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\\AuthorizedApplications\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Authorized Applications

Malware can add paths to this list to more easily communicate
over the network on an infected machine. For instance, Emotet
modifies some these settings after gaining execution.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://threatvector.cylance.com/en_us/home/threat-spotlight-eyepyramid-malware.html", "https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHORIZEDAPPLICATIONS_LIST_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authorizedapplications_list_5",
    name: "WindowsFirewallAuthorizedApplications",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Authorized Applications

Malware can add paths to this list to more easily communicate
over the network on an infected machine. For instance, Emotet
modifies some these settings after gaining execution.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://threatvector.cylance.com/en_us/home/threat-spotlight-eyepyramid-malware.html", "https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_GLOBALLYOPENPORTS_LIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_globallyopenports_list",
    name: "WindowsFirewallGloballyOpenPorts",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path:
        "Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\GloballyOpenPorts\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Globally Open Ports

Malware can add to the list of open ports to avoid
having to create Windows Firewall exceptions tied
to specific applications.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://qaforce.wordpress.com/2009/10/06/windows-firewall-registry-keys/",
        "https://github.com/steeve85/Malwares/wiki/Registry",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_GLOBALLYOPENPORTS_LIST_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_globallyopenports_list_2",
    name: "WindowsFirewallGloballyOpenPorts",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Policies\\Microsoft\\WindowsFirewall\\StandardProfile\\GloballyOpenPorts\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Globally Open Ports

Malware can add to the list of open ports to avoid
having to create Windows Firewall exceptions tied
to specific applications.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://qaforce.wordpress.com/2009/10/06/windows-firewall-registry-keys/", "https://github.com/steeve85/Malwares/wiki/Registry"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_GLOBALLYOPENPORTS_LIST_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_globallyopenports_list_3",
    name: "WindowsFirewallGloballyOpenPorts",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\GloballyOpenPorts\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Globally Open Ports

Malware can add to the list of open ports to avoid
having to create Windows Firewall exceptions tied
to specific applications.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://qaforce.wordpress.com/2009/10/06/windows-firewall-registry-keys/", "https://github.com/steeve85/Malwares/wiki/Registry"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_GLOBALLYOPENPORTS_LIST_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_globallyopenports_list_4",
    name: "WindowsFirewallGloballyOpenPorts",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\\GloballyOpenPorts\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Globally Open Ports

Malware can add to the list of open ports to avoid
having to create Windows Firewall exceptions tied
to specific applications.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://qaforce.wordpress.com/2009/10/06/windows-firewall-registry-keys/", "https://github.com/steeve85/Malwares/wiki/Registry"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_GLOBALLYOPENPORTS_LIST_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_globallyopenports_list_5",
    name: "WindowsFirewallGloballyOpenPorts",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Firewall Globally Open Ports

Malware can add to the list of open ports to avoid
having to create Windows Firewall exceptions tied
to specific applications.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://qaforce.wordpress.com/2009/10/06/windows-firewall-registry-keys/", "https://github.com/steeve85/Malwares/wiki/Registry"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_FONT_DRIVERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_font_drivers",
    name: "WindowsFontDrivers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\Font Drivers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows font drivers from the Registry.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATABASE_HCDATA_EDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_database_hcdata_edb",
    name: "WindowsHelpCenterDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\PCHEALTH\\HELPCTR\\Database\\HCdata.edb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Help Center database file (HCdata.edb).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_LMHOSTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_lmhosts",
    name: "WindowsHostsFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\Drivers\\etc\\Lmhosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Windows hosts and lmhosts file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ETC_HOSTS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_etc_hosts_3",
    name: "WindowsHostsFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\Drivers\\etc\\hosts"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Windows hosts and lmhosts file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_MAGNIFIER_EXE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_magnifier_exe",
    name: "WindowsHotkeyReplacement",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\magnifier.exe"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Hotkey executable replacement.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_SETHC_EXE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_sethc_exe",
    name: "WindowsHotkeyReplacement",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\sethc.exe"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Hotkey executable replacement.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_UTILMAN_EXE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_utilman_exe",
    name: "WindowsHotkeyReplacement",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\utilman.exe"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Hotkey executable replacement.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_EXPLORER_MAP_NETWORK_DRIVE_MRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_explorer_map_network_drive_mru",
    name: "WindowsMapNetworkDriveMRU",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Map Network Drive MRU",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Recently mapped network shares.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AC_INETCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ac_inetcache",
    name: "WindowsMetroApplicationCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\AC\\INetCache"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Metro application cache.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AC_INETCOOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ac_inetcookies",
    name: "WindowsMetroApplicationCookies",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\AC\\INetCookies"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Metro application cookies.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AC_INETHISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_ac_inethistory",
    name: "WindowsMetroApplicationHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\AC\\INetHistory"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Metro application history.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWS_ROAMINGTILES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windows_roamingtiles",
    name: "WindowsMetroUserPinnedFavoriteTiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\RoamingTiles"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Metro user-pinned favorite tiles.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SYSTEM_MOUNTEDDEVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_system_mounteddevices",
    name: "WindowsMountedDevices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\MountedDevices",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows mounted devices",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Mounted-devices.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MSDTC_MTXOCI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_msdtc_mtxoci",
    name: "WindowsMSDTCDLLs",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\MSDTC\\MTxOCI\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows MSDTC attempts to load these DLLs on start",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_MSDTC_MTXOCI_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_msdtc_mtxoci_2",
    name: "WindowsMSDTCDLLs",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\MSDTC\\MTxOCI\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows MSDTC attempts to load these DLLs on start",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_DRIVERS32: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_drivers32",
    name: "WindowsMultiMediaDrivers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Configured drivers for different multimedia filetypes.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://support.microsoft.com/en-us/kb/126054",
        "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_DRIVERS32_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_drivers32_2",
    name: "WindowsMultiMediaDrivers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path:
        "HKEY_USERS\\%%users.sid%%\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Configured drivers for different multimedia filetypes.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://support.microsoft.com/en-us/kb/126054",
        "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_DRIVERS32_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_drivers32_3",
    name: "WindowsMultiMediaDrivers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Configured drivers for different multimedia filetypes.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://support.microsoft.com/en-us/kb/126054",
        "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_DRIVERS32_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_drivers32_4",
    name: "WindowsMultiMediaDrivers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Configured drivers for different multimedia filetypes.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://support.microsoft.com/en-us/kb/126054", "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SOFTWARE_MICROSOFT_NETSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_software_microsoft_netsh",
    name: "WindowsNetworkShellHelpers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Netsh",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Network Shell (netsh) helpers are loaded on boot",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/242468"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_WOW6432NODE_MICROSOFT_NETSH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_wow6432node_microsoft_netsh",
    name: "WindowsNetworkShellHelpers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Netsh",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Network Shell (netsh) helpers are loaded on boot",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/242468"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_OPENSAVEMRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_opensavemru",
    name: "WindowsOpenSaveMRU",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDIg32\\OpenSaveMRU\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Information about files opened or saved in a Windows shell dialog.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opensavemru"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_OPENSAVEPIDLMRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_opensavepidlmru",
    name: "WindowsOpenSavePidlMRU",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Information about files opened or saved in a Windows shell dialog.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/opensavepidlmru"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHENTICATION_PLAP_PROVIDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authentication_plap_providers",
    name: "WindowsPLAPProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Authentication\\PLAP Providers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Pre-Logon Access Provider (PLAP) Providers",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/bb530584(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_AUTHENTICATION_PLAP_PROVIDERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_authentication_plap_providers_2",
    name: "WindowsPLAPProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\PLAP Providers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Pre-Logon Access Provider (PLAP) Providers",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/bb530584(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_DISALLOWRUN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_disallowrun",
    name: "WindowsPolicyDisallowRun",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Restrict users from running specific applications, typically used by malware to block AV.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/323525", "https://blog.malwarebytes.com/detections/pum-optional-disallowrun/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_DISALLOWRUN_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_disallowrun_2",
    name: "WindowsPolicyDisallowRun",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Restrict users from running specific applications, typically used by malware to block AV.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/323525", "https://blog.malwarebytes.com/detections/pum-optional-disallowrun/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_",
    name: "WindowsPortProxyConfiguration",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "SYSTEM\\CurrentControlSet\\Services\\PortProxy\\*\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows PortProxy registry keys (set by netsh portproxy command or manually).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", "https://adepts.of0x.cc/netsh-portproxy-code/", "https://www.dfirnotes.net/portproxy_detection/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_V1_0_PROFILE_PS1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_v1_0_profile_ps1",
    name: "WindowsPowerShellDefaultProfiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\system32\\WindowsPowerShell\\v1.0\\profile.ps1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Default PowerShell Profile files. These files are executed by default when PowerShell starts up.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010", "http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_V1_0_MICROSOFT_POWERSHELL_PROFILE_PS1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_v1_0_microsoft_powershell_profile_ps1",
    name: "WindowsPowerShellDefaultProfiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\system32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Default PowerShell Profile files. These files are executed by default when PowerShell starts up.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010", "http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWSPOWERSHELL_PROFILE_PS1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windowspowershell_profile_ps1",
    name: "WindowsPowerShellDefaultProfiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Documents\\WindowsPowerShell\\profile.ps1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Default PowerShell Profile files. These files are executed by default when PowerShell starts up.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010", "http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWSPOWERSHELL_MICROSOFT_POWERSHELL_PROFILE_PS1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windowspowershell_microsoft_powershell_profile_ps1",
    name: "WindowsPowerShellDefaultProfiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Default PowerShell Profile files. These files are executed by default when PowerShell starts up.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010", "http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PSREADLINE_CONSOLEHOST_HISTORY_TXT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_psreadline_consolehost_history_txt",
    name: "WindowsPowerShellHistory",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "History of commands executed in an interactive PowerShell session.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html", "https://docs.microsoft.com/en-us/powershell/module/psreadline/get-psreadlineoption?view=powershell-7.1"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFETCH_PF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_prefetch_pf",
    name: "WindowsPrefetchFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Prefetch\\*.pf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Prefetch files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/prefetch"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NOTIFICATIONS_WPNDATABASE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_notifications_wpndatabase_db",
    name: "WindowsPushNotificationDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\Notifications\\wpndatabase.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Windows Push Notification (WPN) database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_NOTIFICATIONS_WPNDATABASE_DB_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_notifications_wpndatabase_db_2",
    name: "WindowsPushNotificationDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Windows Push Notification (WPN) database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHE_97: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cache_97",
    name: "WindowsRDPClientBitmapCache",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Terminal Server Client\\Cache\\*.*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Artifacts of RDP connection contents",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#rdp-bitmap-cache"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PROGRAMS_RECENTFILECACHE_BCF: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_programs_recentfilecache_bcf",
    name: "WindowsRecentFileCacheBCF",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\AppCompat\\Programs\\RecentFileCache.bcf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "RecentFileCache.bcf — the Windows 7 Application Experience (ProgramDataUpdater) \
inventory of executables newly encountered on the system, the predecessor of Amcache.hve. On-disk it \
is a variable-length file header beginning with a 4-byte signature at offset 0, followed by a sequence \
of entry records, each a 4-byte UTF-16 character count (including the null terminator) plus a UTF-16LE \
full-path string (per libyal dtformats). It records no timestamps and no hashes.",
    mitre_techniques: &[],
    fields: &[
        FieldSchema {
            name: "entry_path",
            value_type: ValueType::Text,
            description: "UTF-16LE full path of an executable inventoried by Application Experience; the decoded record content (one per entry)",
            is_uid_component: true,
        },
        FieldSchema {
            name: "entry_char_count",
            value_type: ValueType::UnsignedInt,
            description: "UTF-16 character count of the entry's path string, including the null terminator (the 4-byte length prefix preceding each path)",
            is_uid_component: false,
        },
    ],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &["amcache_app_file"],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RecentFileCache.html",
        // libyal dtformats — RecentFileCache.bcf on-disk format (RE reference):
        "https://raw.githubusercontent.com/libyal/dtformats/main/documentation/RecentFileCache.bcf%20format.asciidoc",
        // ANSSI CoRIIN 2019 — Amcache analysis; RecentFileCache.bcf is the Win7 predecessor:
        "https://cyber.gouv.fr/uploads/2019/01/anssi-coriin_2019-analysis_amcache.pdf",
        // Eric Zimmerman — RecentFileCacheParser (tool source):
        "https://github.com/EricZimmerman/RecentFileCacheParser",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &[
        "Windows 7 only — replaced by Amcache.hve on Windows 8 and later; absence on Win8+ is expected, not evidentiary (os_scope is stored as Win7Plus for enum compatibility, but the artifact is Win7-specific)",
        "Contains no embedded timestamps and no hashes; only the file's own MFT/last-write time bounds the entries — individual entries cannot be independently dated",
        "Lists executables the Application Experience inventory newly encountered; presence is consistent with the file having existed / been inventoried on the system, not proof a user executed it",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "On-disk file in %SystemRoot%\\AppCompat\\Programs; persists until deleted",
};

pub(crate) static FA_FILE_RECYCLE_BIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recycle_bin",
    name: "WindowsRecycleBin",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\$Recycle.Bin\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Recycle Bin (Recyler, $Recycle.Bin) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#recycle-bin"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECYCLER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recycler",
    name: "WindowsRecycleBin",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\Recycler\\**"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Recycle Bin (Recyler, $Recycle.Bin) files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#recycle-bin"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_I: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_i",
    name: "WindowsRecycleBinMetadata",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\$Recycle.Bin\\*\\$I*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Recycle Bin (Recyler, $Recycle.Bin) metadata files only.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#recycle-bin"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INFO2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_info2",
    name: "WindowsRecycleBinMetadata",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\Recycler\\*\\INFO2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Recycle Bin (Recyler, $Recycle.Bin) metadata files only.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#recycle-bin"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM32_ROVER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system32_rover_dll",
    name: "WindowsRoverAutostartDLL",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\rover.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Rover autostart DLL.

The DLL loaded via the Windows Rover autostart mechanism.
If this file exists, and the Rover autostart Registry key is set,
userinit.exe will load this file and call its RunMonitor export.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CLSID_16D12736_7A9E_4765_BEC6_F301D679CAAA: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_clsid_16d12736_7a9e_4765_bec6_f301d679caaa",
    name: "WindowsRoverAutostartKey",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_CLASSES_ROOT\\CLSID\\{16d12736-7a9e-4765-bec6-f301d679caaa}",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Rover autostart Registry key.

When set userinit.exe will load the DLL at %SystemRoot%\\System32\\rover.dll and call its RunMonitor export.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_RUN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_run",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_RUNONCE_SETUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_runonce_setup",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_2",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_2",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_RUNONCE_SETUP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_runonce_setup_2",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_2",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_RUN_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_run_2",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path:
        "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_RUN_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_run_3",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx", "https://support.microsoft.com/en-us/kb/137367", "http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://technet.microsoft.com/en-us/magazine/ee851671.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_3",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_3",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_RUNONCE_SETUP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_runonce_setup_3",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path:
        "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_3",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path:
        "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx",
        "https://support.microsoft.com/en-us/kb/137367",
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "https://technet.microsoft.com/en-us/magazine/ee851671.aspx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_RUN_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_run_4",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx", "https://support.microsoft.com/en-us/kb/137367", "http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://technet.microsoft.com/en-us/magazine/ee851671.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_4",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx", "https://support.microsoft.com/en-us/kb/137367", "http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://technet.microsoft.com/en-us/magazine/ee851671.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_4",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx", "https://support.microsoft.com/en-us/kb/137367", "http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://technet.microsoft.com/en-us/magazine/ee851671.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_RUNONCE_SETUP_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_runonce_setup_4",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx", "https://support.microsoft.com/en-us/kb/137367", "http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://technet.microsoft.com/en-us/magazine/ee851671.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_4",
    name: "WindowsRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run and RunOnce keys.

Note users.sid will currently only expand to SIDs with profiles
on the system, not all SIDs.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx", "https://support.microsoft.com/en-us/kb/137367", "http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://technet.microsoft.com/en-us/magazine/ee851671.aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICESONCE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservicesonce",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservices",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICESONCE_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservicesonce_2",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICES_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservices_2",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServices\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICESONCE_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservicesonce_3",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICES_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservices_3",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICESONCE_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservicesonce_4",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNSERVICES_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runservices_4",
    name: "WindowsRunServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServices\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Run Services.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://support.microsoft.com/en-us/kb/179365", "https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TASKS_10: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tasks_10",
    name: "WindowsScheduledTasks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Tasks\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Scheduled Tasks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#scheduled-tasks"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TASKS_10_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tasks_10_2",
    name: "WindowsScheduledTasks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\Tasks\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Scheduled Tasks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#scheduled-tasks"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TASKS_10_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_tasks_10_3",
    name: "WindowsScheduledTasks",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\SysWow64\\Tasks\\**10"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Scheduled Tasks.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#scheduled-tasks"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWS_WINDOWS_EDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windows_windows_edb",
    name: "WindowsSearchDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersappdata%%\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Search database (Windows.edb).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows_desktop_search"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CONTROL_SECURITYPROVIDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_control_securityproviders",
    name: "WindowsSecurityProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Control\\SecurityProviders\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Security Providers DLLs",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://github.com/wmark/security-configuration/blob/master/Windows/disable-weak-ciphers-and-enable-TLS1.x.reg"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATABASE_SECEDIT_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_database_secedit_sdb",
    name: "WindowsSecuritySettingsDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\security\\Database\\secedit.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows security settings databases (secedit.sdb and spsecupd.sdb)",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMPLATES_SPSECUPD_SDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_templates_spsecupd_sdb",
    name: "WindowsSecuritySettingsDatabases",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\security\\templates\\spsecupd.sdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows security settings databases (secedit.sdb and spsecupd.sdb)",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTCONTROLSET_SERVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentcontrolset_services",
    name: "WindowsServices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows service and driver configurations.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHAREDTASKSCHEDULER: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_sharedtaskscheduler",
    name: "WindowsSharedTaskScheduler",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Runs on windows boot.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://www.bleepingcomputer.com/tutorials/windows-program-automatic-startup-locations/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHAREDTASKSCHEDULER_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_sharedtaskscheduler_2",
    name: "WindowsSharedTaskScheduler",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Runs on windows boot.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.bleepingcomputer.com/tutorials/windows-program-automatic-startup-locations/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHELLEXECUTEHOOKS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_shellexecutehooks",
    name: "WindowsShellExecuteHooks",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Shell execution hooks are called when ShellExecuteEx() is called.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://regenerus.com/malware-common-loadpoints/",
        "https://code.google.com/p/regripper/wiki/ASEPs",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHELLEXECUTEHOOKS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_shellexecutehooks_2",
    name: "WindowsShellExecuteHooks",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path:
        "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Shell execution hooks are called when ShellExecuteEx() is called.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://regenerus.com/malware-common-loadpoints/",
        "https://code.google.com/p/regripper/wiki/ASEPs",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_currentversion_shell_extensions_approved",
        name: "WindowsShellExtensions",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Approved extensions to the Windows Shell (explorer.exe).",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://msdn.microsoft.com/en-us/library/windows/desktop/cc144110(v=vs.85).aspx",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_currentversion_shell_extensions_approved_2",
        name: "WindowsShellExtensions",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path:
            "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Approved extensions to the Windows Shell (explorer.exe).",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://msdn.microsoft.com/en-us/library/windows/desktop/cc144110(v=vs.85).aspx",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_shell_extensions_approved_3",
    name: "WindowsShellExtensions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Approved extensions to the Windows Shell (explorer.exe).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/cc144110(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_shell_extensions_approved_4",
    name: "WindowsShellExtensions",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Approved extensions to the Windows Shell (explorer.exe).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/windows/desktop/cc144110(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COLUMNHANDLERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_columnhandlers",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\*\\ShellEx\\ColumnHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\*\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\*\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\*\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\*\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_2",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Directory\\Background\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_2",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Directory\\Background\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_2",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Directory\\Background\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_2",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Directory\\Background\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COLUMNHANDLERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_columnhandlers_2",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\*\\ShellEx\\ColumnHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_3",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\*\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_3",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\*\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_3",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\*\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_3",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\*\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_4",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_4",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_4",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_4",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COLUMNHANDLERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_columnhandlers_3",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\*\\ShellEx\\ColumnHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_5",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\*\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_5",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\*\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_5",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\*\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_5",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\*\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_6",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Directory\\Background\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_6",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Directory\\Background\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_6",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Directory\\Background\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_6",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Directory\\Background\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COLUMNHANDLERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_columnhandlers_4",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\*\\ShellEx\\ColumnHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_7",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\*\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_7",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\*\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_7",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\*\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_7",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\*\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_CONTEXTMENUHANDLERS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_contextmenuhandlers_8",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\ContextMenuHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_COPYHOOKHANDLERS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_copyhookhandlers_8",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\CopyHookHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_DRAGDROPHANDLERS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_dragdrophandlers_8",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\DragDropHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_SHELLEX_PROPERTYSHEETHANDLERS_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_shellex_propertysheethandlers_8",
    name: "WindowsShellHandlersRegistryKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Classes\\Wow6432Node\\Directory\\Background\\ShellEx\\PropertySheetHandlers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows registry values for shell handler artifacts.

ContextMenuHandlers are added to right-click menus.
CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
settings to trigger on these actions.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm", "http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_explorer_shelliconoverlayidentifiers",
        name: "WindowsShellIconOverlayIdentifiers",
        artifact_type: ArtifactLocation::RegistryKey,
        hive: Some(HiveTarget::HklmSoftware),
        key_path:
            "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers\\*",
        value_name: None,
        file_path: None,
        scope: DataScope::System,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Called to display custom icons.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
            "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127455(v=vs.85).aspx",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_shelliconoverlayidentifiers_2",
    name: "WindowsShellIconOverlayIdentifiers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Called to display custom icons.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127455(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_shelliconoverlayidentifiers_3",
    name: "WindowsShellIconOverlayIdentifiers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Called to display custom icons.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127455(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_shelliconoverlayidentifiers_4",
    name: "WindowsShellIconOverlayIdentifiers",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Called to display custom icons.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://msdn.microsoft.com/en-us/library/windows/desktop/hh127455(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_windows_currentversion_shellserviceobjectdelayload",
    name: "WindowsShellServiceObjects",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Shell (explorer.exe) service objects delayed load.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=TrojanClicker:Win32/Zirit.X#tab=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_windows_currentversion_shellserviceobjectdelayload_2",
    name: "WindowsShellServiceObjects",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Shell (explorer.exe) service objects delayed load.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=TrojanClicker:Win32/Zirit.X#tab=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_MESSAGESTORE_SMSINTERCEPTSTORE_DB: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_messagestore_smsinterceptstore_db",
        name: "WindowsSmsRouterInterceptStoreDatabaseFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%environ_programdata%%\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows SmsRouter intercept store database file (SmsInterceptStore.db)",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &["https://github.com/forensicartifacts/artifacts"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_ENVIRON_SYSTEMROOT_SETUPAPI_LOG: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_environ_systemroot_setupapi_log",
        name: "WindowsSetupApiLogs",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemroot%%\\setupapi.log"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows setup API logs.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://forensics.wiki/setup_api_logs"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_INF_SETUPAPI_APP_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_inf_setupapi_app_log",
    name: "WindowsSetupApiLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\inf\\setupapi.app.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows setup API logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/setup_api_logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INF_SETUPAPI_DEV_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_inf_setupapi_dev_log",
    name: "WindowsSetupApiLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\inf\\setupapi.dev.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows setup API logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/setup_api_logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_INF_SETUPAPI_OFFLINE_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_inf_setupapi_offline_log",
    name: "WindowsSetupApiLogs",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\inf\\setupapi.offline.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows setup API logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/setup_api_logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPREPOSITORY_STATEREPOSITORY_DEPLOYMENT_SRD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apprepository_staterepository_deployment_srd",
    name: "WindowsStateRepositoryDeploymentDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programdata%%\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The State Reposistory deployment database file (StateRepository-Deployment.srd).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_APPREPOSITORY_STATEREPOSITORY_MACHINE_SRD: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_apprepository_staterepository_machine_srd",
    name: "WindowsStateRepositoryMachineDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programdata%%\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The State Reposistory machine database file (StateRepository-Machine.srd).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STARTUP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_startup_2",
    name: "WindowsStartupFolders",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        "%%environ_allusersprofile%%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
    ),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows startup folder persistence.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STARTUP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_startup_3",
    name: "WindowsStartupFolders",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_allusersprofile%%\\Start Menu\\Programs\\Startup\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows startup folder persistence.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STARTUP_4: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_startup_4",
    name: "WindowsStartupFolders",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows startup folder persistence.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STARTUP_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_startup_5",
    name: "WindowsStartupFolders",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\Start Menu\\Programs\\Startup\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows startup folder persistence.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFETCH_AG_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_prefetch_ag_db",
    name: "WindowsSuperFetchFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Prefetch\\Ag*.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows SuperFetch files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/superfetch"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_PREFETCH_AG_DB_TRX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_prefetch_ag_db_trx",
    name: "WindowsSuperFetchFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Prefetch\\Ag*.db.trx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows SuperFetch files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/superfetch"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_SYSTEMDRIVE_SYSTEM_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_systemdrive_system_ini",
    name: "WindowsSystemIniFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\system.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system ini files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WIN_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_win_ini",
    name: "WindowsSystemIniFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\win.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system ini files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WININIT_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wininit_ini",
    name: "WindowsSystemIniFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wininit.ini"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system ini files",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SAM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_sam",
    name: "WindowsSystemRegistryFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SAM"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SECURITY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_security",
    name: "WindowsSystemRegistryFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SECURITY"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SOFTWARE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_software",
    name: "WindowsSystemRegistryFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SOFTWARE"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_system",
    name: "WindowsSystemRegistryFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SYSTEM"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SAM_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_sam_log",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SAM.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SAM_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_sam_log1",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SAM.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SAM_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_sam_log2",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SAM.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SECURITY_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_security_log",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SECURITY.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SECURITY_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_security_log1",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SECURITY.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SECURITY_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_security_log2",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SECURITY.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SOFTWARE_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_software_log",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SOFTWARE.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SOFTWARE_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_software_log1",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SOFTWARE.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SOFTWARE_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_software_log2",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SOFTWARE.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SYSTEM_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_system_log",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SYSTEM.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SYSTEM_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_system_log1",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SYSTEM.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_REGBACK_SYSTEM_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_regback_system_log2",
    name: "WindowsSystemRegistryTransactionLogFilesBackup",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\RegBack\\SYSTEM.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Backup of Windows system Registry transaction log files.

These files have been observed to be typically 0 byte in size.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_system_volume_information_syscache_hve",
        name: "WindowsSystemRegistryFiles",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemdrive%%\\System Volume Information\\Syscache.hve"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows system Registry files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Low,
        related_artifacts: &[],
        sources: &[
            "https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_CONFIG_SAM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_sam",
    name: "WindowsSystemRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SAM"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SECURITY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_security",
    name: "WindowsSystemRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SECURITY"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SOFTWARE: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_software",
    name: "WindowsSystemRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SOFTWARE"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_system",
    name: "WindowsSystemRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SYSTEM"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SAM_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_sam_log",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SAM.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SAM_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_sam_log1",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SAM.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SAM_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_sam_log2",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SAM.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SECURITY_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_security_log",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SECURITY.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SECURITY_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_security_log1",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SECURITY.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SECURITY_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_security_log2",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SECURITY.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SOFTWARE_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_software_log",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SOFTWARE.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SOFTWARE_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_software_log1",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SOFTWARE.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SOFTWARE_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_software_log2",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SOFTWARE.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SYSTEM_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_system_log",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SYSTEM.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SYSTEM_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_system_log1",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SYSTEM.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CONFIG_SYSTEM_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_config_system_log2",
    name: "WindowsSystemRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\config\\SYSTEM.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows system Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SRU_SRUDB_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sru_srudb_dat",
    name: "WindowsSystemResourceUsageMonitorDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\sru\\SRUDB.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows System Resource Usage Monitor (SRUM) database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/SystemResourceUsageMonitor.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_STARTUPINFO_XML: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_startupinfo_xml",
    name: "WindowsStartupInfo",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\WDI\\LogFiles\\StartupInfo\\*.xml"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "StartupInfo XML files.

The files include the user account's Security Identifier (SID) in the name
and there could be up to 5 per user account. They contain a list of processes
that were executed within the first 90 seconds from the time the user logged
in. The info includes start time, the full command line and the parent
process info, among other things.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#startup-info"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp",
    name: "WindowsTempDirectories",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemdrive%%\\Temp\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contents of the Windows temporary directories",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_2",
    name: "WindowsTempDirectories",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Temp\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contents of the Windows temporary directories",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_TEMP_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_temp_3",
    name: "WindowsTempDirectories",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Temp\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Contents of the Windows temporary directories",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_5",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_5",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunonceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_5: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_5",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_6",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_6",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunonceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_6: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_6",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_7",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_7",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunonceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_7: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_7",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCE_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonce_8",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUNONCEEX_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_runonceex_8",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunonceEx\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_CURRENTVERSION_RUN_8: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_currentversion_run_8",
    name: "WindowsTerminalServerRunKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Terminal Server Run keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_EXPLORER_THUMBCACHE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_explorer_thumbcache_db",
    name: "WindowsThumbcacheDatabaseFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\Explorer\\thumbcache_*.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows thumbcache_*.db files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/vista_thumbcache/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_BACKUPPATH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_backuppath",
    name: "WindowsToolPaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\BackupPath",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Paths to windows tools such as defrag, chkdsk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://www.liutilities.com/products/registrybooster/tweaklibrary/tweaks/11118/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_CHKDSKPATH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_chkdskpath",
    name: "WindowsToolPaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\ChkDskPath",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Paths to windows tools such as defrag, chkdsk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://www.liutilities.com/products/registrybooster/tweaklibrary/tweaks/11118/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_CLEANUPPATH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_cleanuppath",
    name: "WindowsToolPaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\cleanuppath",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Paths to windows tools such as defrag, chkdsk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://www.liutilities.com/products/registrybooster/tweaklibrary/tweaks/11118/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_MYCOMPUTER_DEFRAGPATH: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_mycomputer_defragpath",
    name: "WindowsToolPaths",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\DefragPath",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Paths to windows tools such as defrag, chkdsk.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "http://gladiator-antivirus.com/forum/index.php?showtopic=24610",
        "http://www.liutilities.com/products/registrybooster/tweaklibrary/tweaks/11118/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATABASE_VEDATAMODEL_EDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_database_vedatamodel_edb",
    name: "WindowsTileDataLayerDatabase",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\TileDataLayer\\Database\\vedatamodel.edb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows tile data layer database (vedatamodel.edb)

The tile data layer database is used to store information about Start Tiles.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/extensible_storage_engine_(ese)_database_file_(edb)_format#tile-data-layer-database"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_UNINSTALL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_uninstall",
    name: "WindowsUninstallKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Uninstall Registry keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_UNINSTALL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_uninstall_2",
    name: "WindowsUninstallKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Uninstall Registry keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_UNINSTALL_3: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_uninstall_3",
    name: "WindowsUninstallKeys",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path:
        "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Uninstall Registry keys",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CATDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_catdb",
    name: "WindowsUpdateCatalogDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\catroot2\\{*-*-*-*-*}\\catdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Update catalog package signatures database file (catdb).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_DATASTORE_DATASTORE_EDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_datastore_datastore_edb",
    name: "WindowsUpdateDataStoreDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SoftwareDistribution\\DataStore\\DataStore.edb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Update data store database file (DataStore.edb).",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SYSTEM_ETL_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_system_etl_2",
    name: "WindowsUpdateLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programdata%%\\USOShared\\Logs\\System\\*.etl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Update log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CBS_CBS_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cbs_cbs_log",
    name: "WindowsUpdateLogFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\Logs\\CBS\\CBS*.log"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Update log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-logs"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWSUPDATE_WINDOWSUPDATE_ETL: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_windowsupdate_windowsupdate_etl",
        name: "WindowsUpdateLogFile",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%environ_systemroot%%\\Logs\\WindowsUpdate\\WindowsUpdate*.etl"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows Update log files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-logs",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_UPDATESTORE_STORE_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_updatestore_store_db",
    name: "WindowsUpdateStoreDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_programdata%%\\USOPrivate\\UpdateStore\\store.db"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Update Service Orchestrator (USO) private update store database file.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_SUM_MDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_sum_mdb",
    name: "WindowsUserAccessLogging",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\LogFiles\\SUM\\*.mdb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "User Access Logging (UAL) databases.

UAL is a local data aggregation feature (enabled by default) on Windows
Servers 2012 and above, recording client usage by role and product on each
system providing the resource. It's typically between 2 and 4 extensible
storage engine (ESE) databases (\"Current.mdb\", \"SystemIdentity.mdb, and
\"<GUID>.mdb\").
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://forensics.wiki/windows#user-access-logging-ual"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_AUTOMATICDESTINATIONS_AUTOMATICDESTINATIONS_MS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_automaticdestinations_automaticdestinations_ms",
    name: "WindowsUserAutomaticDestinationsJumpLists",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.automaticDestinations-ms"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user AutomaticDestinations Jump Lists.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/JumpLists.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CUSTOMDESTINATIONS_CUSTOMDESTINATIONS_MS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_customdestinations_customdestinations_ms",
    name: "WindowsUserCustomDestinationsJumpLists",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.customDestinations-ms"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user CustomDestinations Jump Lists.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/JumpLists.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECENT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recent",
    name: "WindowsUserRecentFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Office\\Recent\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user specific recent files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_RECENT_2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_recent_2",
    name: "WindowsUserRecentFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.appdata%%\\Microsoft\\Windows\\Recent\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user specific recent files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_USERPROFILE_NTUSER_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_userprofile_ntuser_dat",
    name: "WindowsUserRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\NTUSER.DAT"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user specific Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_USERPROFILE_NTUSER_MAN: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_users_userprofile_ntuser_man",
    name: "WindowsUserRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.userprofile%%\\NTUSER.MAN"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user specific Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWS_USRCLASS_DAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windows_usrclass_dat",
    name: "WindowsUserRegistryFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\UsrClass.dat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user specific Registry files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_users_userprofile_ntuser_dat_log",
        name: "WindowsUserRegistryTransactionLogFiles",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.userprofile%%\\NTUSER.DAT.LOG"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows user Registry transaction log files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG1: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_users_userprofile_ntuser_dat_log1",
        name: "WindowsUserRegistryTransactionLogFiles",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.userprofile%%\\NTUSER.DAT.LOG1"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows user Registry transaction log files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG2: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_users_userprofile_ntuser_dat_log2",
        name: "WindowsUserRegistryTransactionLogFiles",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some("%%users.userprofile%%\\NTUSER.DAT.LOG2"),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "Windows user Registry transaction log files.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &[
            "https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html",
        ],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_WINDOWS_USRCLASS_DAT_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windows_usrclass_dat_log",
    name: "WindowsUserRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\UsrClass.dat.LOG"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWS_USRCLASS_DAT_LOG1: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windows_usrclass_dat_log1",
    name: "WindowsUserRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\UsrClass.dat.LOG1"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_WINDOWS_USRCLASS_DAT_LOG2: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_windows_usrclass_dat_log2",
    name: "WindowsUserRegistryTransactionLogFiles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Microsoft\\Windows\\UsrClass.dat.LOG2"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows user Registry transaction log files.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_SHELL_FOLDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_shell_folders",
    name: "WindowsUserShellFolders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Shell Folders information for Windows users.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_USERS_SID_ENVIRONMENT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_users_sid_environment",
    name: "WindowsUserShellFolders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Environment\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Shell Folders information for Windows users.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_USERS_SID_VOLATILE_ENVIRONMENT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_users_sid_volatile_environment",
    name: "WindowsUserShellFolders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Volatile Environment\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "The Shell Folders information for Windows users.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_CACHESTORAGE_CACHESTORAGE_EDB: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_cachestorage_cachestorage_edb",
    name: "WindowsWebCacheStorageQuotaDatabaseFile",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%users.localappdata%%\\Packages\\*\\AppData\\CacheStorage\\CacheStorage.edb"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows WebCache storage quota database file (CacheStorage.edb)",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_ALTERNATESHELLS_AVAILABLESHELLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_alternateshells_availableshells",
    name: "WindowsWinlogonAvailableShells",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AlternateShells\\AvailableShells\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Server Winlogon Available Shells

Used to specify an alternate shell application to be launched when
logging into Windows Server 2012 and later. Legitimate keys under
AvailableShells should just cause cmd.exe or explorer.exe to be executed,
whereas malicious programs may create keys that cause malware to be run
when a user logs in.
",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://andymorgan.wordpress.com/2012/03/30/changing-the-default-shell-of-windows-server-8-core/", "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINSTART_BAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_winstart_bat",
    name: "WindowsWinstart",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\winstart.bat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows winstart.bat file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DOSSTART_BAT: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dosstart_bat",
    name: "WindowsWinstart",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dosstart.bat"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows winstart.bat file",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_EXPLORER_WORDWHEELQUERY: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_explorer_wordwheelquery",
    name: "WindowsWordWheelQueryRegistryKey",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: None,
    key_path: "HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Keywords searched in from the Windows start menu, potentially resulting in files or folders access or program executions.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://github.com/forensicartifacts/artifacts"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_APPLICATION_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_application_evtx",
    name: "WindowsXMLEventLogApplication",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Application.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Application Windows XML Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4ADMIN_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_microsoft_windows_powershell_4admin_evtx",
    name: "WindowsXMLEventLogPowerShell",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Microsoft-Windows-PowerShell%4Admin.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "PowerShell Windows XML Event Logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4OPERATIONAL_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_microsoft_windows_powershell_4operational_evtx",
    name: "WindowsXMLEventLogPowerShell",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Microsoft-Windows-PowerShell%4Operational.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "PowerShell Windows XML Event Logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_POWERSHELLCORE_OPERATIONAL_EVTX: ArtifactDescriptor =
    ArtifactDescriptor {
        id: "fa_file_logs_powershellcore_operational_evtx",
        name: "WindowsXMLEventLogPowerShell",
        artifact_type: ArtifactLocation::File,
        hive: None,
        key_path: "",
        value_name: None,
        file_path: Some(
            "%%environ_systemroot%%\\System32\\winevt\\Logs\\PowerShellCore Operational.evtx",
        ),
        scope: DataScope::Mixed,
        os_scope: OsScope::Win7Plus,
        decoder: Decoder::Identity,
        meaning: "PowerShell Windows XML Event Logs.",
        mitre_techniques: &[],
        fields: &[],
        retention: None,
        triage_priority: TriagePriority::Medium,
        related_artifacts: &[],
        sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
        evidence_strength: None,
        evidence_caveats: &[],
        volatility: None,
        volatility_rationale: "",
    };

pub(crate) static FA_FILE_LOGS_WINDOWS_POWERSHELL_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_windows_powershell_evtx",
    name: "WindowsXMLEventLogPowerShell",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Windows PowerShell.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "PowerShell Windows XML Event Logs.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_SECURITY_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_security_evtx",
    name: "WindowsXMLEventLogSecurity",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Security.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Security Windows XML Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_MICROSOFT_WINDOWS_SYSMON_4OPERATIONAL_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_microsoft_windows_sysmon_4operational_evtx",
    name: "WindowsXMLEventLogSysmon",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Microsoft-Windows-Sysmon%4Operational.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Sysmon Windows XML Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_SYSTEM_EVTX: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_system_evtx",
    name: "WindowsXMLEventLogSystem",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\System.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "System Windows XML Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSION: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_logs_microsoft_windows_terminalservices_localsession",
    name: "WindowsXMLEventLogTerminalServices",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_systemroot%%\\System32\\winevt\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "TerminalServices Windows XML Event Log.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_protocol_catalog9_catalog_entries",
    name: "WinSock2LayeredServiceProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\\Catalog_Entries\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Used to filter TCP/IP traffic through WinSock2.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://en.wikipedia.org/wiki/Layered_Service_Provider", "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES64: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_protocol_catalog9_catalog_entries64",
    name: "WinSock2LayeredServiceProviders",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "System\\CurrentControlSet\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\\Catalog_Entries64\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Used to filter TCP/IP traffic through WinSock2.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["http://gladiator-antivirus.com/forum/index.php?showtopic=24610", "https://en.wikipedia.org/wiki/Layered_Service_Provider", "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_EXPLORERFRAME_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_explorerframe_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\EXPLORERFRAME.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DUSER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_duser_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\DUser.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DUI70_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dui70_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\DUI70.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_UXTHEME_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_uxtheme_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\UxTheme.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_POWRPROF_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_powrprof_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\POWRPROF.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DWMAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dwmapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dwmapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SLC_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_slc_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\slc.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_GDIPLUS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_gdiplus_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\gdiplus.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SECUR32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_secur32_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\Secur32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SSPICLI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sspicli_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SSPICLI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_PROPSYS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_propsys_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\PROPSYS.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINSTA_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_winsta_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WINSTA.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CRYPTBASE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cryptbase_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\CRYPTBASE.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINDOWSCODECS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_windowscodecs_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WindowsCodecs.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_PROFAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_profapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\profapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_APPHELP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_apphelp_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\apphelp.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_EHSTORSHELL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ehstorshell_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\EhStorShell.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CSCUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cscui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\cscui.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CSCDLL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cscdll_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\CSCDLL.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CSCAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cscapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\CSCAPI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NTSHRUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ntshrui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ntshrui.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SRVCLI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_srvcli_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\srvcli.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ICONCODECSERVICE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_iconcodecservice_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\IconCodecService.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CRYPTSP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cryptsp_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\CRYPTSP.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RSAENH_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rsaenh_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\rsaenh.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RPCRTREMOTE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rpcrtremote_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\RpcRtRemote.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SNDVOLSSO_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sndvolsso_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SndVolSSO.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_HID_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_hid_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\HID.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MMDEVAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_mmdevapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\MMDevApi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_TIMEDATE_CPL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_timedate_cpl",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\timedate.cpl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ATL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_atl_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ATL.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ACTXPRXY_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_actxprxy_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\actxprxy.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NTMARTA_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ntmarta_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ntmarta.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SHDOCVW_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_shdocvw_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\shdocvw.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_LINKINFO_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_linkinfo_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\LINKINFO.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_USERENV_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_userenv_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\USERENV.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SHACCT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_shacct_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\shacct.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_GAMEUX_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_gameux_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\gameux.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_XMLLITE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_xmllite_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\XmlLite.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wer_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wer.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SAMLIB_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_samlib_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SAMLIB.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSLS31_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msls31_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\msls31.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_TIPTSF_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_tiptsf_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\tiptsf.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_AUTHUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_authui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\authui.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CRYPTUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cryptui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\CRYPTUI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSILTCFG_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msiltcfg_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\msiltcfg.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_VERSION_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_version_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\VERSION.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\msi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NETWORKEXPLORER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_networkexplorer_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\NetworkExplorer.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINMM_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_winmm_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WINMM.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WDMAUD_DRV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wdmaud_drv",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wdmaud.drv"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_KSUSER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ksuser_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ksuser.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_AVRT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_avrt_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AVRT.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_AUDIOSES_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_audioses_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AUDIOSES.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSACM32_DRV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msacm32_drv",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\msacm32.drv"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSACM32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msacm32_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\MSACM32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MIDIMAP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_midimap_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\midimap.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NETUTILS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_netutils_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\netutils.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_STOBJECT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_stobject_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\stobject.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_BATMETER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_batmeter_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\BatMeter.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WTSAPI32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wtsapi32_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WTSAPI32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ES_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_es_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\es.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_PRNFLDR_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_prnfldr_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\prnfldr.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINSPOOL_DRV: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_winspool_drv",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WINSPOOL.DRV"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DXP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dxp_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dxp.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SYNCREG_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_syncreg_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\Syncreg.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NETSHELL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_netshell_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\netshell.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_IPHLPAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_iphlpapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\IPHLPAPI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINNSI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_winnsi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WINNSI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NLAAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_nlaapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\nlaapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ALTTAB_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_alttab_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\AltTab.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_PNIDUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_pnidui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\pnidui.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_QUTIL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_qutil_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\QUtil.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WEVTAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wevtapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wevtapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DHCPCSVC6_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dhcpcsvc6_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dhcpcsvc6.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DHCPCSVC_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dhcpcsvc_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dhcpcsvc.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CREDSSP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_credssp_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\credssp.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NPMPROXY_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_npmproxy_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\npmproxy.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_CSCOBJ_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_cscobj_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\cscobj.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WLANAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wlanapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\Wlanapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WLANUTIL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wlanutil_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wlanutil.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WWANAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wwanapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wwanapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WWAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wwapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wwapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_QAGENT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_qagent_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\QAgent.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SRCHADMIN_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_srchadmin_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\srchadmin.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSSPRXY_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_mssprxy_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\mssprxy.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_BTHPROPS_CPL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_bthprops_cpl",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\bthprops.cpl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_IEFRAME_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ieframe_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ieframe.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_OLEACC_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_oleacc_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\OLEACC.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SYNCCENTER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_synccenter_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SyncCenter.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ACTIONCENTER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_actioncenter_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\Actioncenter.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_IMAPI2_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_imapi2_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\imapi2.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SXS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sxs_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SXS.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_HGCPL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_hgcpl_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\hgcpl.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_PROVSVC_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_provsvc_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\provsvc.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WKSCLI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wkscli_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wkscli.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_FXSST_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_fxsst_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\fxsst.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_FXSAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_fxsapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\FXSAPI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_FXSRESM_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_fxsresm_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\FXSRESM.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_IEPROXY_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ieproxy_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ieproxy.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_THUMBCACHE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_thumbcache_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\thumbcache.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RASADHLP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rasadhlp_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\rasadhlp.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MPR_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_mpr_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\MPR.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_VMHGFS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_vmhgfs_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\vmhgfs.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DRPROV_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_drprov_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\drprov.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NTLANMAN_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ntlanman_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ntlanman.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DAVCLNT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_davclnt_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\davclnt.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DAVHLPR_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_davhlpr_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\DAVHLPR.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_STRUCTUREDQUERY_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_structuredquery_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\StructuredQuery.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_UIANIMATION_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_uianimation_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\UIAnimation.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DEVRTL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_devrtl_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\DEVRTL.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MLANG_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_mlang_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\MLANG.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WSCINTEROP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wscinterop_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wscinterop.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WSCAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wscapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WSCAPI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WSCUI_CPL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wscui_cpl",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wscui.cpl"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WERCONCPL_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_werconcpl_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\werconcpl.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_FRAMEDYNOS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_framedynos_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\framedynos.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WERCPLSUPPORT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wercplsupport_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\wercplsupport.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSXML6_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msxml6_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\msxml6.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_HCPROVIDERS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_hcproviders_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\hcproviders.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ZIPFLDR_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_zipfldr_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\zipfldr.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RAREXT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rarext_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\rarext.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_7_ZIP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_7_zip_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\7-zip.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_TWEXT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_twext_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\twext.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_WINCDEMUCONTEXTMENU_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_wincdemucontextmenu_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\WinCDEmuContextMenu.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SYNCUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_syncui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\syncui.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SYNCENG_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_synceng_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SYNCENG.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SHLEXT010_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_shlext010_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\shlext010.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ATL90_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_atl90_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ATL90.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ACPPAGE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_acppage_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\acppage.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SFC_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sfc_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\sfc.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SFC_OS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sfc_os_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\sfc_os.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DSROLE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dsrole_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dsrole.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_ACLUI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_aclui_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\ACLUI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NTDSAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ntdsapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\NTDSAPI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_PHOTOBASE_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_photobase_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\PhotoBase.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SBDROP_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sbdrop_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\sbdrop.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_TQUERY_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_tquery_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\tquery.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_EHSTORAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_ehstorapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\EhStorAPI.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SEARCHFOLDER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_searchfolder_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\SearchFolder.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NATURALLANGUAGE6_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_naturallanguage6_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\NaturalLanguage6.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NLSDATA0009_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_nlsdata0009_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\NLSData0009.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_NLSLEXICONS0009_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_nlslexicons0009_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\NLSLexicons0009.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_MSFTEDIT_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_msftedit_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\MsftEdit.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_DNSAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_dnsapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\dnsapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RASAPI32_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rasapi32_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\RASAPI32.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RASMAN_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rasman_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\rasman.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_RTUTILS_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_rtutils_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\rtutils.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static FA_FILE_ENVIRON_WINDIR_SENSAPI_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "fa_file_environ_windir_sensapi_dll",
    name: "DLLHijackLocations",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%%environ_windir%%\\sensapi.dll"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DLL search order hijacking locations collected from base Windows 7.",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Generated entries (2597) ─────────────────────────────────────────────────
// pub(crate) static GENERATED_FA_ENTRIES: &[&ArtifactDescriptor] = &[
//     &FA_FILE_PARITY_AGENT_CACHE,
//     &FA_FILE_QUARANTINE,
//     &FA_FILE_QUARANTINE_2,
//     &FA_FILE_QUARANTINE_3,
//     &FA_FILE_CS_REGISTRY_BASE,
//     &FA_FILE_QUARANTINE_4,
//     &FA_FILE_LOGS,
//     &FA_FILE_QUARANTINE_5,
//     &FA_FILE_QUARANTINE_6,
//     &FA_FILE_SUPPORT_MPDETECTION_LOG,
//     &FA_FILE_SUPPORT_MPLOG_LOG,
//     &FA_FILE_DETECTIONHISTORY,
//     &FA_FILE_SUPPORT_MPDETECTION_LOG_2,
//     &FA_FILE_SUPPORT_MPLOG_LOG_2,
//     &FA_FILE_TEMP_MPCMDRUN_LOG,
//     &FA_FILE_TEMP_MPCMDRUN_LOG_2,
//     &FA_FILE_USERS_TEMP_MPCMDRUN_LOG,
//     &FA_FILE_,
//     &FA_EXCLUSIONS_PATHS,
//     &FA_EXCLUSIONS_PROCESSES,
//     &FA_EXCLUSIONS_EXTENSIONS,
//     &FA_EXCLUSIONS_TEMPORARYPATHS,
//     &FA_EXCLUSIONS_PATHS_2,
//     &FA_EXCLUSIONS_PROCESSES_2,
//     &FA_EXCLUSIONS_EXTENSIONS_2,
//     &FA_EXCLUSIONS_TEMPORARYPATHS_2,
//     &FA_FILE_SANTA,
//     &FA_FILE_SANTA_2,
//     &FA_FILE_LOGS_SOPHOS_LOG,
//     &FA_FILE_LOGS_2,
//     &FA_FILE_INFECTED,
//     &FA_FILE_INFECTED_2,
//     &FA_FILE_LOGS_LOG,
//     &FA_FILE_AV_LOG,
//     &FA_FILE_AV_LOG_2,
//     &FA_FILE_LOGS_LOG_2,
//     &FA_FILE_5_VBN,
//     &FA_FILE_QUARANTINE_7,
//     &FA_FILE_QUARANTINE_8,
//     &FA_FILE_CCSUBSDK,
//     &FA_FILE_EVOLUTION,
//     &FA_FILE_EVOLUTION_2,
//     &FA_FILE_EVOLUTION_3,
//     &FA_FILE_WORD,
//     &FA_FILE_EXCEL,
//     &FA_FILE_POWERPOINT,
//     &FA_FILE_PUBLISHER,
//     &FA_FILE_PREFERENCES_COM_MICROSOFT_OFFICE_PLIST,
//     &FA_FILE_PREFERENCES_COM_MICROSOFT_SECUREBOOKMARKS_PLIST,
//     &FA_FILE_OUTLOOK_PAB,
//     &FA_FILE_OUTLOOK_FILES_PAB,
//     &FA_FILE_OUTLOOK_PST,
//     &FA_FILE_OUTLOOK_FILES_PST,
//     &FA_FILE_OUTLOOK_OST,
//     &FA_FILE_OUTLOOK_FILES_OST,
//     &FA_FILE_NPM,
//     &FA_FILE_NPM_CACHE,
//     &FA_FILE_LOG_ERRORLOG,
//     &FA_FILE_LOG_ERRORLOG_2,
//     &FA_FILE_THUNDERBIRD,
//     &FA_FILE_DROPBOX_DB,
//     &FA_FILE_DROPBOX_DB_2,
//     &FA_FILE_INSTANCE_SYNC_HISTORY_DB,
//     &FA_FILE_DROPBOX_DB_3,
//     &FA_FILE_INSTANCE_SYNC_HISTORY_DB_2,
//     &FA_FILE_DRIVE_SNAPSHOT_DB,
//     &FA_FILE_DRIVE_SYNC_CONFIG_DB,
//     &FA_FILE_DRIVE_SYNC_CONFIG_LOG,
//     &FA_FILE_USER_DEFAULT_SNAPSHOT_DB,
//     &FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB,
//     &FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG,
//     &FA_FILE_USER_DEFAULT_SYNC_LOG_LOG,
//     &FA_FILE_DRIVE_SNAPSHOT_DB_2,
//     &FA_FILE_DRIVE_SYNC_CONFIG_DB_2,
//     &FA_FILE_DRIVE_SYNC_CONFIG_LOG_2,
//     &FA_FILE_USER_DEFAULT_SNAPSHOT_DB_2,
//     &FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB_2,
//     &FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG_2,
//     &FA_FILE_LOGS_LOG_3,
//     &FA_FILE_LOGS_LOG_4,
//     &FA_FILE_SETTINGS_APPLICATIONSETTINGS_XML,
//     &FA_FILE_SETTINGS_DAT,
//     &FA_FILE_SETTINGS_INI,
//     &FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY,
//     &FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_2,
//     &FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_3,
//     &FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_4,
//     &FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_5,
//     &FA_FILE_ETC_EXPORTS,
//     &FA_FILE_ETC_EXPORTS_2,
//     &FA_FILE_ETC_EXPORTS_3,
//     &FA_FILE_CONF_REDIS_WINDOWS_CONF,
//     &FA_FILE_CONF_REDIS_CONF,
//     &FA_FILE_REDIS_REDIS_CONF,
//     &FA_FILE_REDIS_REDIS_CONF_2,
//     &FA_FILE_REDIS_REDIS_CONF_3,
//     &FA_FILE_SAMBA_SMB_CONF,
//     &FA_FILE_SSH_SSHD_CONFIG,
//     &FA_FILE_SSH_SSHD_CONFIG_2,
//     &FA_FILE_SSH_SSHD_CONFIG_3,
//     &FA_FILE_SSH_CONFIG,
//     &FA_FILE_CONTAINERD_CONFIG_TOML,
//     &FA_FILE_IO_CONTAINERD_METADATA_V1_BOLT_META_DB,
//     &FA_FILE_IO_CONTAINERD_SNAPSHOTTER_V1_OVERLAYFS_METADATA_DB,
//     &FA_FILE_CONFIG_JSON,
//     &FA_FILE_OPTIONS_JSON,
//     &FA_FILE_LOG_JSON,
//     &FA_FILE_LOG_DAEMON_LOG,
//     &FA_FILE_LOG_DAEMON_LOG_GZ,
//     &FA_FILE_LOG_SYSLOG,
//     &FA_FILE_LOG_MESSAGE,
//     &FA_FILE_ELASTICSEARCH_ACCESS_LOG,
//     &FA_FILE_ELASTICSEARCH_AUDIT_JSON,
//     &FA_FILE_ELASTICSEARCH_AUDIT_LOG,
//     &FA_FILE_ELASTICSEARCH_GC_LOG,
//     &FA_FILE_ELASTICSEARCH_GC_LOG_0_9,
//     &FA_FILE_ELASTICSEARCH_LOG,
//     &FA_FILE_ELASTICSEARCH_JSON,
//     &FA_FILE_ELASTICSEARCH_JSON_GZ,
//     &FA_FILE_ELASTICSEARCH_SERVER_JSON,
//     &FA_FILE_ELASTICSEARCH_JSON_2,
//     &FA_FILE_ELASTICSEARCH_JSON_GZ_2,
//     &FA_FILE_ETC_MONGOD_CONF,
//     &FA_FILE_ETC_MONGOD_CONF_2,
//     &FA_FILE_ETC_MONGOD_CONF_3,
//     &FA_FILE_MONGODB,
//     &FA_FILE_DB,
//     &FA_FILE_MONGODB_MONGOD_LOG,
//     &FA_FILE_ETC_MY_CNF,
//     &FA_FILE_MYSQL_CONF_D_MYSQLD_CNF,
//     &FA_FILE_MYSQL_MYSQL_IBD,
//     &FA_FILE_MYSQL,
//     &FA_FILE__2,
//     &FA_FILE_MYSQL_ERROR_LOG,
//     &FA_FILE_LOG_MYSQL_LOG,
//     &FA_FILE_LOG_LOG,
//     &FA_FILE_OPENSEARCH_LOG,
//     &FA_FILE_OPENSEARCH_JSON,
//     &FA_FILE_POSTGRESQL_CONF,
//     &FA_FILE_PG_HBA_CONF,
//     &FA_FILE_PG_IDENT_CONF,
//     &FA_FILE_PGSQL_POSTGRESQL_CONF,
//     &FA_FILE_PGSQL_PG_HBA_CONF,
//     &FA_FILE_PGSQL_PG_IDENT_CONF,
//     &FA_FILE_DATA_POSTGRESQL_CONF,
//     &FA_FILE_DATA_PG_HBA_CONF,
//     &FA_FILE_DATA_PG_IDENT_CONF,
//     &FA_FILE_DATA,
//     &FA_FILE_DATA_OLD,
//     &FA_FILE__3,
//     &FA_FILE__4,
//     &FA_FILE_POSTGRESQL_POSTGRESQL_LOG,
//     &FA_FILE_POSTGRESQL_POSTGRESQL_CSV,
//     &FA_FILE_POSTGRESQL_POSTGRESQL_LOG_2,
//     &FA_FILE_POSTGRESQL_POSTGRESQL_CSV_2,
//     &FA_FILE_POSTGRESQL_POSTGRESQL_LOG_3,
//     &FA_FILE_POSTGRESQL_POSTGRESQL_CSV_3,
//     &FA_FILE_LOG_POSTGRESQL_LOG,
//     &FA_FILE_LOG_POSTGRESQL_CSV,
//     &FA_FILE_LOG_POSTGRESQL_LOG_2,
//     &FA_FILE_LOG_POSTGRESQL_CSV_2,
//     &FA_FILE_LOG_POSTGRESQL_LOG_3,
//     &FA_FILE_LOG_POSTGRESQL_CSV_3,
//     &FA_FILE_REDIS,
//     &FA_FILE_INIT_D_REDIS,
//     &FA_FILE_REDIS_2,
//     &FA_FILE__5,
//     &FA_FILE_REDIS_REDIS_LOG,
//     &FA_FILE_LOG_REDIS_LOG,
//     &FA_FILE_CONFIG_V2_JSON,
//     &FA_FILE_CONFIG_JSON_2,
//     &FA_FILE_JSON_LOG,
//     &FA_FILE_LOG_ESXAPIADAPTER_LOG,
//     &FA_FILE_LOG_ATTESTD_LOG,
//     &FA_FILE_LOG_AUTH_LOG,
//     &FA_FILE_LOG_HOSTD_LOG,
//     &FA_FILE_LOG_KMXD_LOG,
//     &FA_FILE_LOG_LOADESX_LOG,
//     &FA_FILE_LOG_SHELL_LOG,
//     &FA_FILE_LOG,
//     &FA_FILE_LOG_SYSLOG_LOG,
//     &FA_FILE_LOG_ESXTOKEND_LOG,
//     &FA_FILE_LOG_KMXA_LOG,
//     &FA_FILE_LOG_VMKERNEL_LOG,
//     &FA_FILE_LOG_VMKSUMMARYLOG_LOG,
//     &FA_FILE_LOG_VMKWARNING_LOG,
//     &FA_FILE_LOG_VXPA_LOG,
//     &FA_FILE_LOGS_3,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_LOGFILE,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_MFT,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_MFTMIRR,
//     &FA_FILE_EXTEND_USNJRNL,
//     &FA_FILE_LOGS_4,
//     &FA_FILE_CONTAINER,
//     &FA_FILE_LOGS_5,
//     &FA_FILE_CONTAINER_2,
//     &FA_FILE_APPLICATION_APPLICATION,
//     &FA_FILE_APPLICATION_APPLICATION_2,
//     &FA_FILE_APPLICATION_APPLICATION_3,
//     &FA_FILE_APPLICATION_APPLICATION_4,
//     &FA_FILE_LEVELDB_TIMELINE_STORE_LDB,
//     &FA_FILE_LEVELDB_TIMELINE_STORE_LDB_2,
//     &FA_FILE_LEVELDB_TIMELINE_STORE_LDB_3,
//     &FA_FILE_LEVELDB_TIMELINE_STORE_LDB_4,
//     &FA_FILE_DIAGNOSE,
//     &FA_FILE_DIAGNOSIS,
//     &FA_FILE_DIAGNOSE_2,
//     &FA_FILE_DIAGNOSIS_2,
//     &FA_FILE_SECURITYCONTROLLER,
//     &FA_FILE_LOGFILES,
//     &FA_FILE_SETUP,
//     &FA_FILE_LOGS_6,
//     &FA_FILE_DIST_INFO,
//     &FA_FILE_DIST_INFO_2,
//     &FA_FILE_DIST_INFO_3,
//     &FA_FILE_DIST_INFO_4,
//     &FA_FILE_DIST_INFO_5,
//     &FA_FILE_DIST_INFO_6,
//     &FA_FILE_DIST_INFO_7,
//     &FA_FILE_DIST_INFO_8,
//     &FA_FILE_DIST_INFO_9,
//     &FA_FILE_DIST_INFO_10,
//     &FA_FILE_SITE_PACKAGES_EGG,
//     &FA_FILE_SITE_PACKAGES_EGG_INFO,
//     &FA_FILE_PIP_EGG,
//     &FA_FILE_PIP_EGG_INFO,
//     &FA_FILE_DIST_PACKAGES_EGG,
//     &FA_FILE_DIST_PACKAGES_EGG_INFO,
//     &FA_FILE_SITE_PACKAGES_EGG_2,
//     &FA_FILE_SITE_PACKAGES_EGG_INFO_2,
//     &FA_FILE_DIST_PACKAGES_EGG_2,
//     &FA_FILE_DIST_PACKAGES_EGG_INFO_2,
//     &FA_FILE_SITE_PACKAGES_EGG_3,
//     &FA_FILE_SITE_PACKAGES_EGG_INFO_3,
//     &FA_FILE_DIST_PACKAGES_EGG_3,
//     &FA_FILE_DIST_PACKAGES_EGG_INFO_3,
//     &FA_FILE_SITE_PACKAGES_EGG_4,
//     &FA_FILE_SITE_PACKAGES_EGG_INFO_4,
//     &FA_FILE_DIST_PACKAGES_EGG_4,
//     &FA_FILE_DIST_PACKAGES_EGG_INFO_4,
//     &FA_FILE_SITE_PACKAGES_EGG_5,
//     &FA_FILE_SITE_PACKAGES_EGG_INFO_5,
//     &FA_FILE_PYSHARED_EGG,
//     &FA_FILE_PYSHARED_EGG_INFO,
//     &FA_FILE_EGG,
//     &FA_FILE_EGG_INFO,
//     &FA_FILE_EGG_2,
//     &FA_FILE_EGG_INFO_2,
//     &FA_FILE_EGG_3,
//     &FA_FILE_EGG_INFO_3,
//     &FA_FILE_EGG_4,
//     &FA_FILE_EGG_INFO_4,
//     &FA_FILE_EGG_5,
//     &FA_FILE_EGG_INFO_5,
//     &FA_FILE_EGG_6,
//     &FA_FILE_EGG_INFO_6,
//     &FA_FILE_EGG_7,
//     &FA_FILE_EGG_INFO_7,
//     &FA_FILE_EGG_8,
//     &FA_FILE_EGG_INFO_8,
//     &FA_FILE_EGG_9,
//     &FA_FILE_EGG_INFO_9,
//     &FA_FILE_EGG_10,
//     &FA_FILE_EGG_INFO_10,
//     &FA_FILE_EGG_11,
//     &FA_FILE_EGG_INFO_11,
//     &FA_FILE_PYTHON_WHEELS_WHL,
//     &FA_FILE_WHEELS_WHL,
//     &FA_FILE_2_GEMSPEC,
//     &FA_FILE_2_GEMSPEC_2,
//     &FA_FILE_2_GEMSPEC_3,
//     &FA_FILE_ATTACHMENTS_NOINDEX,
//     &FA_FILE_CACHE,
//     &FA_FILE_LOGS_7,
//     &FA_FILE_ORG_SIGNAL_SIGNAL_CONFIG_JSON,
//     &FA_FILE_ORG_SIGNAL_SIGNAL_DB_SQLITE,
//     &FA_FILE_CHATSYNC,
//     &FA_FILE_MAIN_DB,
//     &FA_FILE_PREFERENCES_COM_SKYPE_SKYPE_PLIST,
//     &FA_FILE__6,
//     &FA_FILE_XCHATLOGS_LOG,
//     &FA_FILE_LOG_2,
//     &FA_FILE_CACHE_2,
//     &FA_FILE_CACHE_3,
//     &FA_FILE_CACHE_4,
//     &FA_FILE_CACHE_5,
//     &FA_FILE_DS_STORE_APP_10,
//     &FA_FILE_LAUNCHAGENTS_COM_APPLE_LAUNCHPORT_PLIST,
//     &FA_FILE_SYSTEM32_AWCODC32_DLL,
//     &FA_FILE_SYSTEM32_AWVIEW32_DLL,
//     &FA_FILE_SYSTEM32_C_50225_NLS,
//     &FA_FILE_SYSTEM32_C_50227_NLS,
//     &FA_FILE_SYSTEM32_C_50229_NLS,
//     &FA_FILE_SYSTEM32_C_51932_NLS,
//     &FA_FILE_SYSTEM32_C_51936_NLS,
//     &FA_FILE_SYSTEM32_C_51949_NLS,
//     &FA_FILE_SYSTEM32_C_51950_NLS,
//     &FA_FILE_SYSTEM32_C_57002_NLS,
//     &FA_FILE_SYSTEM32_C_57006_NLS,
//     &FA_FILE_SYSTEM32_C_57008_NLS,
//     &FA_FILE_SYSTEM32_C_57010_NLS,
//     &FA_FILE_SYSTEM32_CDGEXT32_DLL,
//     &FA_FILE_SYSTEM32_CDLLAIT32_DLL,
//     &FA_FILE_SYSTEM32_CDLLAIT64_DLL,
//     &FA_FILE_SYSTEM32_CDLLUNINSTALLSGH32_DLL,
//     &FA_FILE_SYSTEM32_CDLLUNINSTALLSGH64_DLL,
//     &FA_FILE_SYSTEM32_CDLLUNINSTALLWS32_DLL,
//     &FA_FILE_SYSTEM32_CDLLUNINSTALLWS64_DLL,
//     &FA_FILE_SYSTEM32_CFGBKMGRS_DLL,
//     &FA_FILE_SYSTEM32_CFGMGR64_DLL,
//     &FA_FILE_SYSTEM32_COMSVRPCS_DLL,
//     &FA_FILE_SYSTEM32_D3DX8_20_DLL,
//     &FA_FILE_SYSTEM32_DLLCOMM_DLL,
//     &FA_FILE_DRIVERS_WMIMGR_SYS,
//     &FA_FILE_SYSTEM32_DRVINFO_BIN,
//     &FA_FILE_SYSTEM32_FCACHE_BIN,
//     &FA_FILE_SYSTEM32_FFEXTENDEDCOMMAND_DLL,
//     &FA_FILE_SYSTEM32_GPKTCSP32_DLL,
//     &FA_FILE_SYSTEM32_HPQUEUE_BIN,
//     &FA_FILE_SYSTEM32_LPQUEUE_BIN,
//     &FA_FILE_SYSTEM32_MDWMNSP_DLL,
//     &FA_FILE_SYSTEM32_MFCN30_DLL,
//     &FA_FILE_SYSTEM32_NMWCDLOG_DLL,
//     &FA_FILE_SYSTEM32_OBJFRAME_DLL,
//     &FA_FILE_SYSTEM32_RPCDIST_DLL,
//     &FA_FILE_SYSTEM32_SCSVRFT_DLL,
//     &FA_FILE_SYSTEM32_SDPTBW_DLL,
//     &FA_FILE_SYSTEM32_SHLINK32_DLL,
//     &FA_FILE_SYSTEM32_SHLINK64_DLL,
//     &FA_FILE_SYSTEM32_SIIW9X_DLL,
//     &FA_FILE_SYSTEM32_SKYPEIE6PLUGIN_DLL,
//     &FA_FILE_SYSTEM32_SLBKBW_DLL,
//     &FA_FILE_SYSTEM32_WIFISCAN_DLL,
//     &FA_FILE_SYSTEM32_WMSPDMGR_DLL,
//     &FA_FILE_MICROSOFT_C_27803_NLS,
//     &FA_FILE_MICROSOFT_OBJFRAME_DLL,
//     &FA_FILE_MICROSOFT_SHMGR_DLL,
//     &FA_FILE_USERS_TEMP_DF01AC74D8BE15EE01_TMP,
//     &FA_FILE_USERS_TEMP_DF23BF45A473C42B56_TMP,
//     &FA_FILE_USERS_TEMP_DF8471938479DA49221_TMP,
//     &FA_FILE_USERS_TEMP_DFA0528CD81300F372_TMP,
//     &FA_FILE_KUBERNETES_ADMIN_CONF,
//     &FA_FILE_KUBERNETES_CONTROLLER_MANAGER_CONF,
//     &FA_FILE_KUBERNETES_KUBELET_CONF,
//     &FA_FILE_KUBERNETES_SCHEDULER_CONF,
//     &FA_FILE_SNAP_DB,
//     &FA_FILE_KUBELET_CONFIG_YAML,
//     &FA_FILE_KUBERNETES_KUBELET_CONF_2,
//     &FA_FILE_MANIFESTS_YAML,
//     &FA_FILE_LOG_3,
//     &FA_FILE_LOG_SYSLOG_2,
//     &FA_CURRENTVERSION_PROFILELIST_PROFILESDIRECTORY,
//     &FA_CURRENTVERSION_PROFILELIST_ALLUSERSPROFILE,
//     &FA_FILE_ETC_ENTERPRISE_RELEASE,
//     &FA_FILE_ETC_LSB_RELEASE,
//     &FA_FILE_ETC_ORACLE_RELEASE,
//     &FA_FILE_ETC_REDHAT_RELEASE,
//     &FA_FILE_ETC_SYSTEM_RELEASE,
//     &FA_FILE_ETC_ANACRONTAB,
//     &FA_FILE_CRON_DAILY,
//     &FA_FILE_CRON_HOURLY,
//     &FA_FILE_CRON_MONTHLY,
//     &FA_FILE_CRON_WEEKLY,
//     &FA_FILE_ANACRON_CRON_DAILY,
//     &FA_FILE_ANACRON_CRON_HOURLY,
//     &FA_FILE_ANACRON_CRON_MONTHLY,
//     &FA_FILE_ANACRON_CRON_WEEKLY,
//     &FA_FILE_LOG_APTITUDE,
//     &FA_FILE_APT_SOURCES_LIST,
//     &FA_FILE_SOURCES_LIST_D_LIST,
//     &FA_FILE_APT_TRUSTED_GPG,
//     &FA_FILE_TRUSTED_GPG_D_GPG,
//     &FA_FILE_APT_TRUSTDB_GPG,
//     &FA_FILE_KEYRINGS_GPG,
//     &FA_FILE_ETC_CRON_ALLOW,
//     &FA_FILE_ETC_CRON_DENY,
//     &FA_FILE_ETC_AT_ALLOW,
//     &FA_FILE_ETC_AT_DENY,
//     &FA_FILE_LOG_DPKG_LOG,
//     &FA_FILE_APT_HISTORY_LOG,
//     &FA_FILE_APT_TERM_LOG,
//     &FA_FILE_DPKG_STATUS,
//     &FA_FILE_ETC_DEBIAN_VERSION,
//     &FA_FILE_ETC_RESOLV_CONF,
//     &FA_FILE_GNOME_SHELL_APPLICATION_STATE,
//     &FA_FILE_INFO_TRASHINFO,
//     &FA_FILE_FILES,
//     &FA_FILE_TRACKER,
//     &FA_FILE_DATA_2,
//     &FA_FILE_SHARE_RECENTLY_USED_XBEL,
//     &FA_FILE_ETC_HOSTS_ALLOW,
//     &FA_FILE_ETC_HOSTS_DENY,
//     &FA_FILE_ETC_MODULES_CONF,
//     &FA_FILE_MODPROBE_D,
//     &FA_FILE_USERS_HOMEDIR_LESSHST,
//     &FA_FILE_AT,
//     &FA_FILE_SPOOL,
//     &FA_FILE_ATSPOOL,
//     &FA_FILE_AUDIT,
//     &FA_FILE_LOG_AUTH,
//     &FA_FILE_LOG_SECURE,
//     &FA_FILE_ETC_CA_CERTIFICATES_CONF,
//     &FA_FILE_CERTS_CA_CERTIFICATES_CRT,
//     &FA_FILE_CA_CERTIFICATES,
//     &FA_FILE_CA_CERTIFICATES_2,
//     &FA_FILE_LOG_CRON_LOG,
//     &FA_FILE_ETC_CRONTAB,
//     &FA_FILE_CRON_D,
//     &FA_FILE_CRON,
//     &FA_FILE_LOG_DAEMON,
//     &FA_FILE_DHCP_DHCP_CONF,
//     &FA_FILE_ETC_CENTOS_RELEASE,
//     &FA_FILE_ETC_ENTERPRISE_RELEASE_2,
//     &FA_FILE_ETC_ORACLE_RELEASE_2,
//     &FA_FILE_ETC_REDHAT_RELEASE_2,
//     &FA_FILE_ETC_ROCKY_RELEASE,
//     &FA_FILE_ETC_SUSE_RELEASE,
//     &FA_FILE_ETC_SYSTEM_RELEASE_2,
//     &FA_FILE_TABLES_DSDT,
//     &FA_FILE_ETC_FSTAB,
//     &FA_FILE_GRUB_GRUB_CFG,
//     &FA_FILE_GRUB2_GRUB_CFG,
//     &FA_FILE_ETC_HOSTNAME,
//     &FA_FILE_IF_UP_D,
//     &FA_FILE_IF_DOWN_D,
//     &FA_FILE_BOOT_INITRAMFS,
//     &FA_FILE_BOOT_INITRD,
//     &FA_FILE_ETC_ISSUE,
//     &FA_FILE_ETC_ISSUE_NET,
//     &FA_FILE_ETC_KRB5_CONF,
//     &FA_FILE_LOG_KERN,
//     &FA_FILE_LOG_LASTLOG,
//     &FA_FILE_ETC_LD_SO_PRELOAD,
//     &FA_FILE_INIT_D,
//     &FA_FILE_ETC_INSSERV_CONF,
//     &FA_FILE_INSSERV_CONF_D,
//     &FA_FILE_ETC_LOCALTIME,
//     &FA_FILE_ETC_LSB_RELEASE_2,
//     &FA_FILE_LOG_MESSAGES,
//     &FA_FILE_CONF_D_NAME_CONF,
//     &FA_FILE_NETWORKMANAGER_NETWORKMANAGER_CONF,
//     &FA_FILE_NETWORKMANAGER_SYSTEM_CONNECTIONS,
//     &FA_FILE_CONF_D_NAME_CONF_2,
//     &FA_FILE_CONF_D_NAME_CONF_3,
//     &FA_FILE_NETWORKMANAGER_NETWORKMANAGER_INTERN_CONF,
//     &FA_FILE_NETWORKMANAGER,
//     &FA_FILE_ETC_PASSWD_CACHE,
//     &FA_FILE_ETC_PAM_CONF,
//     &FA_FILE_ETC_PAM_D,
//     &FA_FILE_PAM_D_COMMON_PASSWORD,
//     &FA_FILE_PAM_D,
//     &FA_FILE_ETC_PASSWD,
//     &FA_FILE_ETC_RSYSLOG_CONF,
//     &FA_FILE_ETC_RSYSLOG_D,
//     &FA_FILE_RSYSLOG_D,
//     &FA_FILE_TABLES_SSDT,
//     &FA_FILE_SUDO_IO,
//     &FA_FILE_SYSCTL_D_CONF,
//     &FA_FILE_SYSCTL_D_CONF_2,
//     &FA_FILE_SYSCTL_D_CONF_3,
//     &FA_FILE_SYSCTL_D_CONF_4,
//     &FA_FILE_SYSCTL_D_CONF_5,
//     &FA_FILE_ETC_SYSCTL_CON,
//     &FA_FILE_LOG_SYSLOG_3,
//     &FA_FILE_SYSLOG_NG_SYSLOG_NG_CONF,
//     &FA_FILE_CONF_D_CONF,
//     &FA_FILE_SYSTEMD_JOURNALD_CONF,
//     &FA_FILE_JOURNAL,
//     &FA_FILE_JOURNAL_2,
//     &FA_FILE_ETC_OS_RELEASE,
//     &FA_FILE_LIB_OS_RELEASE,
//     &FA_FILE_SYSTEM_CONTROL_SERVICE,
//     &FA_FILE_SYSTEMD_ATTACHED_SERVICE,
//     &FA_FILE_SYSTEM_SERVICE,
//     &FA_FILE_USER_SERVICE,
//     &FA_FILE_SYSTEM_SERVICE_2,
//     &FA_FILE_USER_SERVICE_2,
//     &FA_FILE_GENERATOR_EARLY_SERVICE,
//     &FA_FILE_GENERATOR_LATE_SERVICE,
//     &FA_FILE_GENERATOR_SERVICE,
//     &FA_FILE_SYSTEM_CONTROL_SERVICE_2,
//     &FA_FILE_SYSTEMD_ATTACHED_SERVICE_2,
//     &FA_FILE_SYSTEM_SERVICE_3,
//     &FA_FILE_TRANSIENT_SERVICE,
//     &FA_FILE_USER_SERVICE_3,
//     &FA_FILE_GENERATOR_EARLY_SERVICE_2,
//     &FA_FILE_GENERATOR_LATE_SERVICE_2,
//     &FA_FILE_GENERATOR_SERVICE_2,
//     &FA_FILE_TRANSIENT_SERVICE_2,
//     &FA_FILE_USER_CONTROL_SERVICE,
//     &FA_FILE_USER_SERVICE_4,
//     &FA_FILE_SYSTEM_SERVICE_4,
//     &FA_FILE_USER_SERVICE_5,
//     &FA_FILE_USER_CONTROL_SERVICE_2,
//     &FA_FILE_USER_SERVICE_6,
//     &FA_FILE_USER_SERVICE_7,
//     &FA_FILE_SYSTEM_CONTROL_TIMER,
//     &FA_FILE_SYSTEMD_ATTACHED_TIMER,
//     &FA_FILE_SYSTEM_TIMER,
//     &FA_FILE_USER_TIMER,
//     &FA_FILE_SYSTEM_TIMER_2,
//     &FA_FILE_USER_TIMER_2,
//     &FA_FILE_GENERATOR_EARLY_TIMER,
//     &FA_FILE_GENERATOR_LATE_TIMER,
//     &FA_FILE_GENERATOR_TIMER,
//     &FA_FILE_SYSTEM_CONTROL_TIMER_2,
//     &FA_FILE_SYSTEMD_ATTACHED_TIMER_2,
//     &FA_FILE_SYSTEM_TIMER_3,
//     &FA_FILE_TRANSIENT_TIMER,
//     &FA_FILE_USER_TIMER_3,
//     &FA_FILE_GENERATOR_EARLY_TIMER_2,
//     &FA_FILE_GENERATOR_LATE_TIMER_2,
//     &FA_FILE_GENERATOR_TIMER_2,
//     &FA_FILE_TRANSIENT_TIMER_2,
//     &FA_FILE_USER_CONTROL_TIMER,
//     &FA_FILE_USER_TIMER_4,
//     &FA_FILE_SYSTEM_TIMER_4,
//     &FA_FILE_USER_TIMER_5,
//     &FA_FILE_USER_CONTROL_TIMER_2,
//     &FA_FILE_USER_TIMER_6,
//     &FA_FILE_USER_TIMER_7,
//     &FA_FILE_ETC_RC_LOCAL,
//     &FA_FILE_ETC_RC_D,
//     &FA_FILE_RC_D,
//     &FA_FILE_RC_D_2,
//     &FA_FILE_INIT_D_2,
//     &FA_FILE_ETC_TIMEZONE,
//     &FA_FILE_RULES_D,
//     &FA_FILE_RULES_D_2,
//     &FA_FILE_LOG_BTMP,
//     &FA_FILE_LOG_WTMP,
//     &FA_FILE_RUN_UTMP,
//     &FA_FILE_LOG_WTMP_2,
//     &FA_FILE_ETC_XINETD_CONF,
//     &FA_FILE_XINETD_D,
//     &FA_FILE_MLOCATE_MLOCATE_DB,
//     &FA_FILE_ETC_UPDATEDB_CONF,
//     &FA_FILE_ETC_NETGROUP,
//     &FA_FILE_ETC_NSSWITCH_CONF,
//     &FA_FILE_ETC_PASSWD_2,
//     &FA_FILE_ETC_SHADOW,
//     &FA_FILE_SECURITY_ACCESS_CONF,
//     &FA_FILE_ROOT_K5LOGIN,
//     &FA_FILE_MYSQL_HISTORY,
//     &FA_FILE_ROOT_MYSQL_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_MYSQL_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_NANO_HISTORY,
//     &FA_FILE_ETC_NETGROUP_2,
//     &FA_FILE_ETC_NTP_CONF,
//     &FA_FILE_VENDOR,
//     &FA_FILE_DEVICE,
//     &FA_FILE_CLASS,
//     &FA_FILE_CONFIG,
//     &FA_FILE_PSQL_HISTORY,
//     &FA_FILE_ROOT_PSQL_HISTORY,
//     &FA_FILE_POSTGRESQL_PSQL_HISTORY,
//     &FA_FILE_PGSQL_PSQL_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_PSQL_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_PYTHON_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_RHOSTS,
//     &FA_FILE_SAMBA_LOG,
//     &FA_FILE_SECRETS_SECRETS_LDB,
//     &FA_FILE_SECRETS_SECRETS_MKEY,
//     &FA_FILE_USERS_HOMEDIR_SQLITE_HISTORY,
//     &FA_FILE_SSH_AUTHORIZED_KEYS,
//     &FA_FILE_SSH_AUTHORIZED_KEYS2,
//     &FA_FILE_SSH_SSH_HOST_KEY_PUB,
//     &FA_FILE_SSH_KNOWN_HOSTS,
//     &FA_FILE_SSH_KNOWN_HOSTS_2,
//     &FA_FILE_THUMBNAILS_3,
//     &FA_FILE_DEFAULT_UFW,
//     &FA_FILE_UFW_SYSCTL_CONF,
//     &FA_FILE_UFW_RULES,
//     &FA_FILE_APPLICATIONS_D,
//     &FA_FILE_LOG_UFW_LOG,
//     &FA_FILE_USERS_HOMEDIR_VIMINFO,
//     &FA_FILE_USERS_HOMEDIR_WGET_HSTS,
//     &FA_FILE_AUTOSTART_DESKTOP,
//     &FA_FILE_AUTOSTART_DESKTOP_2,
//     &FA_FILE_ETC_YUM_CONF,
//     &FA_FILE_YUM_REPOS_D_REPO,
//     &FA_FILE_ZEITGEIST_ACTIVITY_SQLITE,
//     &FA_FILE_ZEITGEIST_ACTIVITY_SQLITE_WAL,
//     &FA_FILE_KERNEL_RANDOMIZE_VA_SPACE,
//     &FA_FILE_IPV4_ICMP_ECHO_IGNORE_BROADCASTS,
//     &FA_FILE_KERNEL_BOOTLOADER_TYPE,
//     &FA_FILE_KERNEL_BOOTLOADER_VERSION,
//     &FA_FILE_KERNEL_KEXEC_LOAD_DISABLED,
//     &FA_FILE_KERNEL_MODULES_DISABLED,
//     &FA_FILE_KERNEL_TAINTED,
//     &FA_FILE_FORWARDING,
//     &FA_FILE_MC_FORWARDING,
//     &FA_FILE_IPV4_IP_FORWARD,
//     &FA_FILE_ACCEPT_SOURCE_ROUTE,
//     &FA_FILE_RP_FILTER,
//     &FA_FILE_LOG_MARTIANS,
//     &FA_FILE_ACCEPT_REDIRECTS,
//     &FA_FILE_SECURE_REDIRECTS,
//     &FA_FILE_SEND_REDIRECTS,
//     &FA_FILE_NET_ARP,
//     &FA_FILE_PROC_MOUNTS,
//     &FA_FILE_KERNEL_DMESG_RESTRICT,
//     &FA_FILE_KERNEL_KPTR_RESTRICT,
//     &FA_FILE_FS_PROTECTED_HARDLINKS,
//     &FA_FILE_FS_PROTECTED_SYMLINKS,
//     &FA_FILE_FS_SUID_DUMPABLE,
//     &FA_FILE_IPV4_TCP_SYNCOOKIES,
//     &FA_FILE_LOGS_8,
//     &FA_FILE_LOGS_CONTROLLER_LOG,
//     &FA_FILE_LOGS_KAFKA_LOG,
//     &FA_FILE_LOGS_SERVER_LOG,
//     &FA_FILE_LOGS_STATE_CHANGE_LOG,
//     &FA_FILE_HAPROXY,
//     &FA_FILE_LOG_HAPROXY_LOG,
//     &FA_FILE_LOG_HAPROXY_TRAFFIC_LOG,
//     &FA_FILE_LOG_HAPROXY_ADMIN_LOG,
//     &FA_FILE_JENKINS_JENKINS_LOG,
//     &FA_FILE_OSQUERY_OSQUERYD_RESULTS_LOG,
//     &FA_FILE_OSQUERY_OSQUERYD_SNAPSHOTS_LOG,
//     &FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB,
//     &FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB_2,
//     &FA_FILE_SYSTEMCONFIGURATION_COM_APPLE_AIRPORT_PREFERENCES_PL,
//     &FA_FILE_APPLEPUSHSERVICE_APS_DB,
//     &FA_FILE_DB_APPLESETUPDONE,
//     &FA_FILE_DB_APPLESETUPDONE_2,
//     &FA_FILE_ASL_ASL,
//     &FA_FILE_DIAGNOSTICMESSAGES_ASL,
//     &FA_FILE_ASL_ASL_2,
//     &FA_FILE_DIAGNOSTICMESSAGES_ASL_2,
//     &FA_FILE_CACHE_DB,
//     &FA_FILE_LPROJ_STRINGS,
//     &FA_FILE_LPROJ_STRINGS_2,
//     &FA_FILE_COM_APPLE_ASSETCACHE_ASSETINFO_DB,
//     &FA_FILE_DB_AUTH_DB,
//     &FA_FILE_DB_AUTH_DB_2,
//     &FA_FILE_CALENDARS_CALENDAR_CACHE,
//     &FA_FILE_CALLHISTORYDB_CALLHISTORY_STOREDATA,
//     &FA_FILE_PREFERENCES_LSSHAREDFILELIST_PLIST,
//     &FA_FILE_JOBS,
//     &FA_FILE_AUDIT_0_9_0_9,
//     &FA_FILE_AUDIT_0_9_0_9_2,
//     &FA_FILE_PREFERENCES_COM_APPLE_BLUETOOTH_PLIST,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_2,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_3,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_4,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_5,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_6,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_7,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_8,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_9,
//     &FA_FILE_CODESIGNATURE_CODERESOURCES_10,
//     &FA_FILE_CONTENTS_INFO_PLIST,
//     &FA_FILE_CONTENTS_INFO_PLIST_2,
//     &FA_FILE_CONTENTS_INFO_PLIST_3,
//     &FA_FILE_CONTENTS_INFO_PLIST_4,
//     &FA_FILE_CONTENTS_INFO_PLIST_5,
//     &FA_FILE_CONTENTS_INFO_PLIST_6,
//     &FA_FILE_CONTENTS_INFO_PLIST_7,
//     &FA_FILE_CONTENTS_INFO_PLIST_8,
//     &FA_FILE_KEXT_INFO_PLIST,
//     &FA_FILE_CONTENTS_INFO_PLIST_9,
//     &FA_FILE_CONTENTS_INFO_PLIST_10,
//     &FA_FILE_RESOURCES_INFO_PLIST,
//     &FA_FILE_CONTENTS_INFO_PLIST_11,
//     &FA_FILE_CONTENTS_VERSION_PLIST,
//     &FA_FILE_CONTENTS_VERSION_PLIST_2,
//     &FA_FILE_CONTENTS_VERSION_PLIST_3,
//     &FA_FILE_CONTENTS_VERSION_PLIST_4,
//     &FA_FILE_CONTENTS_VERSION_PLIST_5,
//     &FA_FILE_CONTENTS_VERSION_PLIST_6,
//     &FA_FILE_CONTENTS_VERSION_PLIST_7,
//     &FA_FILE_CONTENTS_VERSION_PLIST_8,
//     &FA_FILE_KEXT_VERSION_PLIST,
//     &FA_FILE_CONTENTS_VERSION_PLIST_9,
//     &FA_FILE_CONTENTS_VERSION_PLIST_10,
//     &FA_FILE_RESOURCES_VERSION_PLIST,
//     &FA_FILE_CONTENTS_VERSION_PLIST_11,
//     &FA_FILE_DIAGNOSTICREPORTS_CORE_ANALYTICS,
//     &FA_FILE_AGGREGATES,
//     &FA_FILE_AGGREGATES_2,
//     &FA_FILE_ETC_CRONTAB_2,
//     &FA_FILE_ETC_CRONTAB_3,
//     &FA_FILE_TABS,
//     &FA_FILE_TABS_2,
//     &FA_FILE_TABS_3,
//     &FA_FILE_TABS_4,
//     &FA_FILE_TABS_5,
//     &FA_FILE_PREFERENCES_COM_APPLE_DOCK_PLIST,
//     &FA_FILE_DEFAULT_SQLINDEX,
//     &FA_FILE_DEFAULT_SQLINDEX_2,
//     &FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB,
//     &FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB_2,
//     &FA_FILE_PEOPLE_INTERACTIONC_DB,
//     &FA_FILE_PEOPLE_INTERACTIONC_DB_2,
//     &FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB,
//     &FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_2,
//     &FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_3,
//     &FA_FILE_COREDUET_COREDUETD_DB,
//     &FA_FILE_COREDUET_COREDUETD_DB_2,
//     &FA_FILE_COREDUET_COREDUETD_DB_3,
//     &FA_FILE_COREDUET_COREDUETD_DB_4,
//     &FA_FILE_FSEVENTSD,
//     &FA_FILE_DATA_FSEVENTSD,
//     &FA_FILE_RESOURCES_GKOPAQUE_DB,
//     &FA_FILE_RESOURCES_GKOPAQUE_DB_2,
//     &FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST,
//     &FA_FILE_ACCOUNTS,
//     &FA_FILE_PREFERENCES_MOBILEMEACCOUNTS_PLIST,
//     &FA_FILE_IDENTITYSERVICES_IDS_DB,
//     &FA_FILE_PREFERENCES_COM_APPLE_IPOD_PLIST,
//     &FA_FILE_RECEIPTS_INSTALLHISTORY_PLIST,
//     &FA_FILE_LOG_INSTALL_LOG,
//     &FA_FILE_LOG_INSTALL_LOG_2,
//     &FA_FILE_LPROJ_ITXIB,
//     &FA_FILE_INFO_PLIST,
//     &FA_FILE_MANIFEST_PLIST,
//     &FA_FILE_MANIFEST_MDBD,
//     &FA_FILE_BACKUP,
//     &FA_FILE_STATUS_PLIST,
//     &FA_FILE_EXTENSIONS,
//     &FA_FILE_EXTENSIONS_2,
//     &FA_FILE_PREFERENCES_COM_APPLE_HITOOLBOX_PLIST,
//     &FA_FILE_LOG_LASTLOG_2,
//     &FA_FILE_LOG_LASTLOG_3,
//     &FA_FILE_LAUNCHAGENTS_PLIST,
//     &FA_FILE_LAUNCHAGENTS_PLIST_2,
//     &FA_FILE_LAUNCHAGENTS_PLIST_3,
//     &FA_FILE_LAUNCHDAEMONS_PLIST,
//     &FA_FILE_LAUNCHDAEMONS_PLIST_2,
//     &FA_FILE_LAUNCHDAEMONS_PLIST_3,
//     &FA_FILE_LOGS_9,
//     &FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST,
//     &FA_FILE_PREFERENCES_LOGINWINDOW_PLIST,
//     &FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST,
//     &FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST_2,
//     &FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_2,
//     &FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_3,
//     &FA_FILE_MAILDATA_ACCOUNTS_PLIST,
//     &FA_FILE_MAILDATA_BACKUPTOC_PLIST,
//     &FA_FILE_MAILBOXES,
//     &FA_FILE_MAIL_DOWNLOADS,
//     &FA_FILE_MAILDATA_ENVELOPE_INDEX,
//     &FA_FILE_IMAP,
//     &FA_FILE_V_0_9,
//     &FA_FILE_MAILDATA_OPENEDATTACHMENTSV2_PLIST,
//     &FA_FILE_POP,
//     &FA_FILE_PREFERENCES_COM_APPLE_MAIL_PLIST,
//     &FA_FILE_ADDRESSBOOK_MAILRECENTS_V4_ABCDMR,
//     &FA_FILE_SIGNATURES,
//     &FA_FILE_MESSAGES_CHAT_DB,
//     &FA_FILE_NETWORKD_NETUSAGE_SQLITE,
//     &FA_FILE_NETWORKD_NETUSAGE_SQLITE_2,
//     &FA_FILE_NOTES_NOTESV_STOREDATA,
//     &FA_FILE_NOTIFICATIONCENTER_DB,
//     &FA_FILE_DB_DB,
//     &FA_FILE_DB2_DB,
//     &FA_FILE_DB_DB_2,
//     &FA_FILE_DB2_DB_2,
//     &FA_FILE_DAILY_LOCAL,
//     &FA_FILE_DEFAULTS_PERIODIC_CONF,
//     &FA_FILE_MONTHLY_LOCAL,
//     &FA_FILE_PERIODIC_2,
//     &FA_FILE_ETC_PERIODIC_CONF,
//     &FA_FILE_ETC_PERIODIC_CONF_LOCAL,
//     &FA_FILE_DAILY,
//     &FA_FILE_MONTHLY,
//     &FA_FILE_WEEKLY,
//     &FA_FILE_WEEKLY_LOCAL,
//     &FA_FILE_DAILY_LOCAL_2,
//     &FA_FILE_DEFAULTS_PERIODIC_CONF_2,
//     &FA_FILE_MONTHLY_LOCAL_2,
//     &FA_FILE_PERIODIC_2_2,
//     &FA_FILE_ETC_PERIODIC_CONF_2,
//     &FA_FILE_ETC_PERIODIC_CONF_LOCAL_2,
//     &FA_FILE_DAILY_2,
//     &FA_FILE_MONTHLY_2,
//     &FA_FILE_WEEKLY_2,
//     &FA_FILE_WEEKLY_LOCAL_2,
//     &FA_FILE_PERIODIC_2_3,
//     &FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT,
//     &FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT_2,
//     &FA_FILE_PREFERENCES_COM_APPLE_RECENTITEMS_PLIST,
//     &FA_FILE_CLIENTCACHES,
//     &FA_FILE_RMDB_RMDB_SQLITE3,
//     &FA_FILE_CLIENTCACHES_2,
//     &FA_FILE_RMDB_RMDB_SQLITE3_2,
//     &FA_FILE_CACHES_APPUSAGE_PLIST,
//     &FA_FILE_CACHES_APPUSAGE_PLIST_2,
//     &FA_FILE_CACHES_USERACCT_TMP,
//     &FA_FILE_CACHES_USERACCT_TMP_2,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_2,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_3,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_4,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_5,
//     &FA_FILE_RESOURCES_INFOPLIST_STRINGS,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_6,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_7,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_8,
//     &FA_FILE_LPROJ_INFOPLIST_STRINGS_9,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_2,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_3,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_4,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_5,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_6,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_7,
//     &FA_FILE_LPROJ_LOCALIZABLE_STRINGS_8,
//     &FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST,
//     &FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST_2,
//     &FA_FILE_ASSISTANT_SIRIANALYTICS_DB,
//     &FA_FILE_SUGGESTIONS_ENTITIES_DB,
//     &FA_FILE_SUGGESTIONS_ENTITIES_DB_WAL,
//     &FA_FILE_PENDING_QUEUE_DB,
//     &FA_FILE_PENDING_QUEUE_DB_WAL,
//     &FA_FILE_SUGGESTIONS_SNIPPETS_DB,
//     &FA_FILE_SUGGESTIONS_SNIPPETS_DB_WAL,
//     &FA_FILE_VM_SLEEPIMAGE,
//     &FA_FILE_VM_SLEEPIMAGE_2,
//     &FA_FILE_PREFERENCES_COM_APPLE_SOFTWAREUPDATE_PLIST,
//     &FA_FILE_STORE_V1_VOLUMECONFIG_PLIST,
//     &FA_FILE_SPOTLIGHT_V100_VOLUMECONFIGURATION_PLIST,
//     &FA_FILE_PLIST,
//     &FA_FILE_PLIST_2,
//     &FA_FILE_VM_SWAPFILE_0_9,
//     &FA_FILE_VM_SWAPFILE_0_9_2,
//     &FA_FILE_SYSTEMCONFIGURATION_PREFERENCES_PLIST,
//     &FA_FILE_LOG_4,
//     &FA_FILE_LOG_5,
//     &FA_FILE_DB_SYSTEMPOLICY,
//     &FA_FILE_DB_SYSTEMPOLICY_2,
//     &FA_FILE_PLIST_3,
//     &FA_FILE_CORESERVICES_SYSTEMVERSION_PLIST,
//     &FA_FILE_COM_APPLE_TCC_TCC_DB,
//     &FA_FILE_COM_APPLE_TCC_TCC_DB_2,
//     &FA_FILE_KEYBOARDSERVICES_TEXTREPLACEMENTS_DB,
//     &FA_FILE_PREFERENCES_COM_APPLE_TIMEMACHINE_PLIST,
//     &FA_FILE_DIAGNOSTICS_TRACEV3,
//     &FA_FILE_TRACEV3,
//     &FA_FILE__7,
//     &FA_FILE_DIAGNOSTICS_TRACEV3_2,
//     &FA_FILE_TRACEV3_2,
//     &FA_FILE__8,
//     &FA_FILE_LOGS_LOG_5,
//     &FA_FILE_DOCK_DESKTOPPICTURE_DB,
//     &FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST_2,
//     &FA_FILE_KEYCHAINS_KEYCHAIN,
//     &FA_FILE_OCSPCACHE_SQLITE3,
//     &FA_FILE_USER_DB,
//     &FA_FILE_KEYCHAIN_2_DB,
//     &FA_FILE_PREFERENCES_COM_APPLE_LOGINITEMS_PLIST,
//     &FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENTAGENT_BACKGROUNDIT,
//     &FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V,
//     &FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V_2,
//     &FA_FILE_USERS_PLIST,
//     &FA_FILE_USERS_PLIST_2,
//     &FA_FILE_PREFERENCES,
//     &FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE,
//     &FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE_WAL,
//     &FA_FILE_TRASH,
//     &FA_FILE_RUN_UTMPX,
//     &FA_FILE_RUN_UTMPX_2,
//     &FA_FILE_PASSES_PASSES23_SQLITE,
//     &FA_FILE_AWDD_PERSISTENT_DB,
//     &FA_FILE_AWDD_PERSISTENT_DB_2,
//     &FA_FILE_IOS_DEVICE_LOGS_IOS_DEVICE_LOGS_DB,
//     &FA_FILE_USERS_HOMEDIR_BASH_LOGOUT,
//     &FA_FILE_USERS_HOMEDIR_BASH_PROFILE,
//     &FA_FILE_USERS_HOMEDIR_BASHRC,
//     &FA_FILE_ETC_BASH_BASHRC,
//     &FA_FILE_ETC_BASHRC,
//     &FA_FILE_ETC_BASH_BASHRC_2,
//     &FA_FILE_ETC_BASHRC_2,
//     &FA_FILE_BASH_LOGOUT,
//     &FA_FILE_BASH_PROFILE,
//     &FA_FILE_BASHRC,
//     &FA_FILE_USERS_HOMEDIR_BASH_HISTORY,
//     &FA_FILE_BASH_HISTORY,
//     &FA_FILE_BASH_SESSIONS,
//     &FA_FILE_USERS_HOMEDIR_SH_HISTORY,
//     &FA_FILE_SH_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_CSHRC,
//     &FA_FILE_ETC_CSH_CSHRC,
//     &FA_FILE_ETC_CSH_LOGIN,
//     &FA_FILE_ETC_CSH_LOGOUT,
//     &FA_FILE_ETC_CSH_CSHRC_2,
//     &FA_FILE_ETC_CSH_LOGIN_2,
//     &FA_FILE_ETC_CSH_LOGOUT_2,
//     &FA_FILE_CSHRC,
//     &FA_FILE_CONF_D_CONFIG_FISH,
//     &FA_FILE_CONF_D_FISH,
//     &FA_FILE_FISH_CONFIG_FISH,
//     &FA_FILE_FISH_CONFIG_FISH_2,
//     &FA_FILE_FISH_FISH_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_KSH,
//     &FA_FILE_ETC_KSHRC,
//     &FA_FILE_ETC_KSHRC_2,
//     &FA_FILE_KSH,
//     &FA_FILE_ROOT_BASH_LOGOUT,
//     &FA_FILE_ROOT_BASH_PROFILE,
//     &FA_FILE_ROOT_BASHRC,
//     &FA_FILE_ROOT_CSHRC,
//     &FA_FILE_ROOT_KSH,
//     &FA_FILE_FISH_CONFIG_FISH_3,
//     &FA_FILE_ROOT_LOGOUT,
//     &FA_FILE_ROOT_PROFILE,
//     &FA_FILE_ROOT_TCSH,
//     &FA_FILE_ROOT_ZLOGIN,
//     &FA_FILE_ROOT_ZLOGOUT,
//     &FA_FILE_ROOT_ZPROFILE,
//     &FA_FILE_ROOT_BASH_HISTORY,
//     &FA_FILE_FISH_FISH_HISTORY_2,
//     &FA_FILE_ROOT_SH_HISTORY,
//     &FA_FILE_ROOT_ZHISTORY,
//     &FA_FILE_ROOT_ZSH_HISTORY,
//     &FA_FILE_USERS_HOMEDIR_LOGOUT,
//     &FA_FILE_LOGOUT,
//     &FA_FILE_USERS_HOMEDIR_PROFILE,
//     &FA_FILE_ETC_PROFILE,
//     &FA_FILE_ETC_PROFILE_2,
//     &FA_FILE_PROFILE,
//     &FA_FILE_USERS_HOMEDIR_TCSH,
//     &FA_FILE_TCSH,
//     &FA_FILE_USERS_HOMEDIR_ZLOGIN,
//     &FA_FILE_USERS_HOMEDIR_ZLOGOUT,
//     &FA_FILE_USERS_HOMEDIR_ZPROFILE,
//     &FA_FILE_ETC_ZSHENV,
//     &FA_FILE_ETC_ZSHRC,
//     &FA_FILE_ZSH_ZLOGIN,
//     &FA_FILE_ZSH_ZLOGOUT,
//     &FA_FILE_ZSH_ZPROFILE,
//     &FA_FILE_ZSH_ZSHENV,
//     &FA_FILE_ZSH_ZSHRC,
//     &FA_FILE_ETC_ZSHENV_2,
//     &FA_FILE_ETC_ZSHRC_2,
//     &FA_FILE_ZSH_ZLOGIN_2,
//     &FA_FILE_ZSH_ZLOGOUT_2,
//     &FA_FILE_ZSH_ZPROFILE_2,
//     &FA_FILE_ZSH_ZSHENV_2,
//     &FA_FILE_ZSH_ZSHRC_2,
//     &FA_FILE_ZLOGIN,
//     &FA_FILE_ZLOGOUT,
//     &FA_FILE_ZPROFILE,
//     &FA_FILE_USERS_HOMEDIR_ZHISTORY,
//     &FA_FILE_USERS_HOMEDIR_ZSH_HISTORY,
//     &FA_FILE_ZHISTORY,
//     &FA_FILE_ZSH_HISTORY,
//     &FA_FILE_ACCESS_LOG,
//     &FA_FILE_LOGS_ACCESS_LOG,
//     &FA_FILE_CATALINA_OUT,
//     &FA_FILE_LOGS_CATALINA_OUT,
//     &FA_FILE_ACCESS_LOG_2,
//     &FA_FILE_LOGS_ACCESS_LOG_2,
//     &FA_FILE_CATALINA_OUT_2,
//     &FA_FILE_LOGS_CATALINA_OUT_2,
//     &FA_FILE_ACCESS_LOG_3,
//     &FA_FILE_LOGS_ACCESS_LOG_3,
//     &FA_FILE_CATALINA_OUT_3,
//     &FA_FILE_LOGS_CATALINA_OUT_3,
//     &FA_FILE_ACCESS_LOG_4,
//     &FA_FILE_LOGS_ACCESS_LOG_4,
//     &FA_FILE_CATALINA_OUT_4,
//     &FA_FILE_LOGS_CATALINA_OUT_4,
//     &FA_FILE_ACCESS_LOG_5,
//     &FA_FILE_LOGS_ACCESS_LOG_5,
//     &FA_FILE_CATALINA_OUT_5,
//     &FA_FILE_LOGS_CATALINA_OUT_5,
//     &FA_FILE_ACCESS_LOG_6,
//     &FA_FILE_LOGS_ACCESS_LOG_6,
//     &FA_FILE_CATALINA_OUT_6,
//     &FA_FILE_LOGS_CATALINA_OUT_6,
//     &FA_FILE_ACCESS_LOG_7,
//     &FA_FILE_LOGS_ACCESS_LOG_7,
//     &FA_FILE_CATALINA_OUT_7,
//     &FA_FILE_LOGS_CATALINA_OUT_7,
//     &FA_FILE_ACCESS_LOG_8,
//     &FA_FILE_LOGS_ACCESS_LOG_8,
//     &FA_FILE_CATALINA_OUT_8,
//     &FA_FILE_LOGS_CATALINA_OUT_8,
//     &FA_FILE_ACCESS_LOG_9,
//     &FA_FILE_LOGS_ACCESS_LOG_9,
//     &FA_FILE_CATALINA_OUT_9,
//     &FA_FILE_LOGS_CATALINA_OUT_9,
//     &FA_FILE_ACCESS_LOG_10,
//     &FA_FILE_LOGS_ACCESS_LOG_10,
//     &FA_FILE_CATALINA_OUT_10,
//     &FA_FILE_LOGS_CATALINA_OUT_10,
//     &FA_FILE_CONF_TOMCAT_USERS_XML,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_2,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_3,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_4,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_5,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_6,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_7,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_8,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_9,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_10,
//     &FA_FILE_CONF_TOMCAT_USERS_XML_11,
//     &FA_FILE_ETC_GROUP,
//     &FA_FILE_ETC_GROUP_2,
//     &FA_FILE_ETC_HOSTS,
//     &FA_FILE_ETC_HOSTS_2,
//     &FA_FILE_ETC_LOCALTIME_2,
//     &FA_FILE_ETC_LOCALTIME_3,
//     &FA_FILE_ETC_PASSWD_3,
//     &FA_FILE_ETC_PASSWD_4,
//     &FA_FILE_ETC_SHADOW_2,
//     &FA_FILE_ETC_SHADOW_3,
//     &FA_FILE_ETC_SHADOW_4,
//     &FA_FILE_ETC_SHADOW_5,
//     &FA_FILE_ETC_SUDOERS,
//     &FA_FILE_ETC_SUDOERS_2,
//     &FA_FILE_LOG_BTMP_2,
//     &FA_FILE_LOG_WTMP_3,
//     &FA_FILE_RUN_UTMP_2,
//     &FA_FILE_LOG_BTMP_3,
//     &FA_FILE_LOG_WTMP_4,
//     &FA_FILE_RUN_UTMP_3,
//     &FA_CHROME_EXTENSIONS_5,
//     &FA_CHROME_EXTENSIONS_5_2,
//     &FA_FILE_FILE_SYSTEM_5,
//     &FA_FILE_FILE_SYSTEM_5_2,
//     &FA_FILE_FILE_SYSTEM_5_3,
//     &FA_FILE_FILE_SYSTEM_5_4,
//     &FA_FILE_FILE_SYSTEM_5_5,
//     &FA_FILE_FILE_SYSTEM_5_6,
//     &FA_FILE_FILE_SYSTEM_5_7,
//     &FA_FILE_FILE_SYSTEM_5_8,
//     &FA_FILE_FILE_SYSTEM_5_9,
//     &FA_FILE_FILE_SYSTEM_5_10,
//     &FA_FILE_FILE_SYSTEM_5_11,
//     &FA_FILE_FILE_SYSTEM_5_12,
//     &FA_FILE_FILE_SYSTEM_5_13,
//     &FA_FILE_FILE_SYSTEM_5_14,
//     &FA_FILE_INDEXEDDB_5,
//     &FA_FILE_INDEXEDDB_5_2,
//     &FA_FILE_INDEXEDDB_5_3,
//     &FA_FILE_INDEXEDDB_5_4,
//     &FA_FILE_INDEXEDDB_5_5,
//     &FA_FILE_INDEXEDDB_5_6,
//     &FA_FILE_INDEXEDDB_5_7,
//     &FA_FILE_INDEXEDDB_5_8,
//     &FA_FILE_INDEXEDDB_5_9,
//     &FA_FILE_INDEXEDDB_5_10,
//     &FA_FILE_INDEXEDDB_5_11,
//     &FA_FILE_INDEXEDDB_5_12,
//     &FA_FILE_INDEXEDDB_5_13,
//     &FA_FILE_INDEXEDDB_5_14,
//     &FA_FILE_LOCAL_STORAGE,
//     &FA_FILE_LOCAL_STORAGE_2,
//     &FA_FILE_LOCAL_STORAGE_3,
//     &FA_FILE_LOCAL_STORAGE_4,
//     &FA_FILE_LOCAL_STORAGE_5,
//     &FA_FILE_LOCAL_STORAGE_6,
//     &FA_FILE_LOCAL_STORAGE_7,
//     &FA_FILE_LOCAL_STORAGE_8,
//     &FA_FILE_LOCAL_STORAGE_9,
//     &FA_FILE_LOCAL_STORAGE_10,
//     &FA_FILE_LOCAL_STORAGE_11,
//     &FA_FILE_LOCAL_STORAGE_12,
//     &FA_FILE_LOCAL_STORAGE_13,
//     &FA_FILE_LOCAL_STORAGE_14,
//     &FA_FILE_PLATFORM_NOTIFICATIONS,
//     &FA_FILE_PLATFORM_NOTIFICATIONS_2,
//     &FA_FILE_PLATFORM_NOTIFICATIONS_3,
//     &FA_FILE_PREFERENCES_2,
//     &FA_FILE_SECURE_PREFERENCES,
//     &FA_FILE_PREFERENCES_3,
//     &FA_FILE_SECURE_PREFERENCES_2,
//     &FA_FILE_PREFERENCES_4,
//     &FA_FILE_SECURE_PREFERENCES_3,
//     &FA_FILE_PREFERENCES_5,
//     &FA_FILE_SECURE_PREFERENCES_4,
//     &FA_FILE_PREFERENCES_6,
//     &FA_FILE_SECURE_PREFERENCES_5,
//     &FA_FILE_PREFERENCES_7,
//     &FA_FILE_SECURE_PREFERENCES_6,
//     &FA_FILE_PREFERENCES_8,
//     &FA_FILE_SECURE_PREFERENCES_7,
//     &FA_FILE_PREFERENCES_9,
//     &FA_FILE_SECURE_PREFERENCES_8,
//     &FA_FILE_PREFERENCES_10,
//     &FA_FILE_SECURE_PREFERENCES_9,
//     &FA_FILE_PREFERENCES_11,
//     &FA_FILE_SECURE_PREFERENCES_10,
//     &FA_FILE_PREFERENCES_12,
//     &FA_FILE_SECURE_PREFERENCES_11,
//     &FA_FILE_PREFERENCES_13,
//     &FA_FILE_SESSION_STORAGE,
//     &FA_FILE_SESSION_STORAGE_2,
//     &FA_FILE_SESSION_STORAGE_3,
//     &FA_FILE_SESSION_STORAGE_4,
//     &FA_FILE_SESSIONS_SESSION,
//     &FA_FILE_SESSIONS_TABS,
//     &FA_FILE_SESSIONS_SESSION_2,
//     &FA_FILE_SESSIONS_TABS_2,
//     &FA_FILE_SESSIONS_SESSION_3,
//     &FA_FILE_SESSIONS_TABS_3,
//     &FA_FILE_SESSIONS_SESSION_4,
//     &FA_FILE_SESSIONS_TABS_4,
//     &FA_FILE_SESSION_STORAGE_5,
//     &FA_FILE_SESSION_STORAGE_6,
//     &FA_FILE_SESSION_STORAGE_7,
//     &FA_FILE_SESSION_STORAGE_8,
//     &FA_FILE_SESSION_STORAGE_9,
//     &FA_FILE_SESSION_STORAGE_10,
//     &FA_FILE_SESSIONS_SESSION_5,
//     &FA_FILE_SESSIONS_TABS_5,
//     &FA_FILE_SESSIONS_SESSION_6,
//     &FA_FILE_SESSIONS_TABS_6,
//     &FA_FILE_SESSIONS_SESSION_7,
//     &FA_FILE_SESSIONS_SESSION_8,
//     &FA_FILE_SESSIONS_TABS_7,
//     &FA_FILE_SESSIONS_TABS_8,
//     &FA_FILE_SESSIONS_SESSION_9,
//     &FA_FILE_SESSIONS_TABS_9,
//     &FA_FILE_SESSIONS_SESSION_10,
//     &FA_FILE_SESSIONS_TABS_10,
//     &FA_FILE_SESSION_STORAGE_11,
//     &FA_FILE_SESSION_STORAGE_12,
//     &FA_FILE_SESSION_STORAGE_13,
//     &FA_FILE_SESSION_STORAGE_14,
//     &FA_FILE_SESSIONS_SESSION_11,
//     &FA_FILE_SESSIONS_TABS_11,
//     &FA_FILE_SESSIONS_SESSION_12,
//     &FA_FILE_SESSIONS_TABS_12,
//     &FA_FILE_SESSIONS_SESSION_13,
//     &FA_FILE_SESSIONS_TABS_13,
//     &FA_FILE_SESSIONS_SESSION_14,
//     &FA_FILE_SESSIONS_TABS_14,
//     &FA_FILE_CACHE_6,
//     &FA_FILE_CACHE_7,
//     &FA_FILE_CACHE_DATA,
//     &FA_FILE_GPUCACHE,
//     &FA_FILE_MEDIA_CACHE,
//     &FA_FILE_CACHE_8,
//     &FA_FILE_CACHE_9,
//     &FA_FILE_CACHE_DATA_2,
//     &FA_FILE_GPUCACHE_2,
//     &FA_FILE_MEDIA_CACHE_2,
//     &FA_FILE_CACHE_10,
//     &FA_FILE_CACHE_11,
//     &FA_FILE_CACHE_DATA_3,
//     &FA_FILE_GPUCACHE_3,
//     &FA_FILE_MEDIA_CACHE_3,
//     &FA_FILE_CACHE_12,
//     &FA_FILE_CACHE_13,
//     &FA_FILE_CACHE_DATA_4,
//     &FA_FILE_GPUCACHE_4,
//     &FA_FILE_MEDIA_CACHE_4,
//     &FA_FILE_CACHE_14,
//     &FA_FILE_CACHE_15,
//     &FA_FILE_CACHE_DATA_5,
//     &FA_FILE_GPUCACHE_5,
//     &FA_FILE_MEDIA_CACHE_5,
//     &FA_FILE_CACHE_16,
//     &FA_FILE_CACHE_17,
//     &FA_FILE_CACHE_DATA_6,
//     &FA_FILE_GPUCACHE_6,
//     &FA_FILE_MEDIA_CACHE_6,
//     &FA_FILE_CACHE_18,
//     &FA_FILE_CACHE_19,
//     &FA_FILE_CACHE_DATA_7,
//     &FA_FILE_GPUCACHE_7,
//     &FA_FILE_MEDIA_CACHE_7,
//     &FA_FILE_CACHE_20,
//     &FA_FILE_CACHE_21,
//     &FA_FILE_CACHE_DATA_8,
//     &FA_FILE_GPUCACHE_8,
//     &FA_FILE_MEDIA_CACHE_8,
//     &FA_FILE_CACHE_22,
//     &FA_FILE_CACHE_23,
//     &FA_FILE_CACHE_DATA_9,
//     &FA_FILE_GPUCACHE_9,
//     &FA_FILE_MEDIA_CACHE_9,
//     &FA_FILE_CACHE_DATA_10,
//     &FA_FILE_CACHE_24,
//     &FA_FILE_CACHE_25,
//     &FA_FILE_CACHE_DATA_11,
//     &FA_FILE_GPUCACHE_10,
//     &FA_FILE_MEDIA_CACHE_10,
//     &FA_FILE_CACHE_26,
//     &FA_FILE_CACHE_27,
//     &FA_FILE_CACHE_28,
//     &FA_FILE_CACHE_29,
//     &FA_FILE_APPLICATION_CACHE,
//     &FA_FILE_CACHE_30,
//     &FA_FILE_CACHE_31,
//     &FA_FILE_GPUCACHE_11,
//     &FA_FILE_MEDIA_CACHE_11,
//     &FA_FILE_PNACLTRANSLATIONCACHE,
//     &FA_FILE_APPLICATION_CACHE_2,
//     &FA_FILE_CACHE_32,
//     &FA_FILE_CACHE_33,
//     &FA_FILE_CACHE_34,
//     &FA_FILE_GPUCACHE_12,
//     &FA_FILE_MEDIA_CACHE_12,
//     &FA_FILE_PNACLTRANSLATIONCACHE_2,
//     &FA_FILE_APPLICATION_CACHE_3,
//     &FA_FILE_CACHE_35,
//     &FA_FILE_CACHE_36,
//     &FA_FILE_GPUCACHE_13,
//     &FA_FILE_MEDIA_CACHE_13,
//     &FA_FILE_PNACLTRANSLATIONCACHE_3,
//     &FA_FILE_APPLICATION_CACHE_4,
//     &FA_FILE_CACHE_37,
//     &FA_FILE_CACHE_38,
//     &FA_FILE_CACHE_39,
//     &FA_FILE_APPLICATION_CACHE_5,
//     &FA_FILE_CACHE_40,
//     &FA_FILE_CACHE_41,
//     &FA_FILE_CACHE_42,
//     &FA_FILE_GPUCACHE_14,
//     &FA_FILE_MEDIA_CACHE_14,
//     &FA_FILE_PNACLTRANSLATIONCACHE_4,
//     &FA_FILE_APPLICATION_CACHE_6,
//     &FA_FILE_CACHE_43,
//     &FA_FILE_CACHE_44,
//     &FA_FILE_CACHE_45,
//     &FA_FILE_GPUCACHE_15,
//     &FA_FILE_MEDIA_CACHE_15,
//     &FA_FILE_PNACLTRANSLATIONCACHE_5,
//     &FA_FILE_GPUCACHE_16,
//     &FA_FILE_MEDIA_CACHE_16,
//     &FA_FILE_PNACLTRANSLATIONCACHE_6,
//     &FA_FILE_APPLICATION_CACHE_7,
//     &FA_FILE_APPLICATION_CACHE_8,
//     &FA_FILE_CACHE_46,
//     &FA_FILE_CACHE_47,
//     &FA_FILE_GPUCACHE_17,
//     &FA_FILE_MEDIA_CACHE_17,
//     &FA_FILE_PNACLTRANSLATIONCACHE_7,
//     &FA_FILE_CACHE_48,
//     &FA_FILE_CACHE_49,
//     &FA_FILE_GPUCACHE_18,
//     &FA_FILE_MEDIA_CACHE_18,
//     &FA_FILE_PNACLTRANSLATIONCACHE_8,
//     &FA_FILE_APPLICATION_CACHE_9,
//     &FA_FILE_CACHE_50,
//     &FA_FILE_CACHE_51,
//     &FA_FILE_GPUCACHE_19,
//     &FA_FILE_MEDIA_CACHE_19,
//     &FA_FILE_PNACLTRANSLATIONCACHE_9,
//     &FA_FILE_APPLICATION_CACHE_10,
//     &FA_FILE_CACHE_52,
//     &FA_FILE_CACHE_53,
//     &FA_FILE_GPUCACHE_20,
//     &FA_FILE_MEDIA_CACHE_20,
//     &FA_FILE_PNACLTRANSLATIONCACHE_10,
//     &FA_FILE_CACHE_54,
//     &FA_FILE_CACHE_55,
//     &FA_FILE_CACHE_56,
//     &FA_FILE_CACHE_57,
//     &FA_FILE_MEDIA_CACHE_21,
//     &FA_FILE_PNACLTRANSLATIONCACHE_11,
//     &FA_FILE_CACHE_58,
//     &FA_FILE_CACHE_59,
//     &FA_FILE_MEDIA_CACHE_22,
//     &FA_FILE_PNACLTRANSLATIONCACHE_12,
//     &FA_FILE_MEDIA_CACHE_23,
//     &FA_FILE_PNACLTRANSLATIONCACHE_13,
//     &FA_FILE_CACHE_DATA_12,
//     &FA_FILE_CACHE_DATA_13,
//     &FA_FILE_CACHE_60,
//     &FA_FILE_CACHE_61,
//     &FA_FILE_CACHE_DATA_14,
//     &FA_FILE_MEDIA_CACHE_24,
//     &FA_FILE_PNACLTRANSLATIONCACHE_14,
//     &FA_FILE_CACHE_62,
//     &FA_FILE_CACHE_63,
//     &FA_FILE_CACHE_DATA_15,
//     &FA_FILE_MEDIA_CACHE_25,
//     &FA_FILE_PNACLTRANSLATIONCACHE_15,
//     &FA_FILE_CACHE_64,
//     &FA_FILE_CACHE_65,
//     &FA_FILE_CACHE_DATA_16,
//     &FA_FILE_MEDIA_CACHE_26,
//     &FA_FILE_PNACLTRANSLATIONCACHE_16,
//     &FA_FILE_CACHE_66,
//     &FA_FILE_CACHE_67,
//     &FA_FILE_CACHE_DATA_17,
//     &FA_FILE_MEDIA_CACHE_27,
//     &FA_FILE_PNACLTRANSLATIONCACHE_17,
//     &FA_FILE_CACHE_DATA_18,
//     &FA_FILE_CACHE_DATA_19,
//     &FA_FILE_APPLICATION_CACHE_11,
//     &FA_FILE_CACHE_68,
//     &FA_FILE_CACHE_69,
//     &FA_FILE_GPUCACHE_21,
//     &FA_FILE_MEDIA_CACHE_28,
//     &FA_FILE_PNACLTRANSLATIONCACHE_18,
//     &FA_FILE_APPLICATION_CACHE_12,
//     &FA_FILE_CACHE_70,
//     &FA_FILE_CACHE_71,
//     &FA_FILE_CACHE_DATA_20,
//     &FA_FILE_GPUCACHE_22,
//     &FA_FILE_MEDIA_CACHE_29,
//     &FA_FILE_PNACLTRANSLATIONCACHE_19,
//     &FA_FILE_APPLICATION_CACHE_13,
//     &FA_FILE_CACHE_72,
//     &FA_FILE_CACHE_73,
//     &FA_FILE_CACHE_DATA_21,
//     &FA_FILE_GPUCACHE_23,
//     &FA_FILE_MEDIA_CACHE_30,
//     &FA_FILE_PNACLTRANSLATIONCACHE_20,
//     &FA_FILE_APPLICATION_CACHE_14,
//     &FA_FILE_CACHE_74,
//     &FA_FILE_CACHE_75,
//     &FA_FILE_CACHE_DATA_22,
//     &FA_FILE_GPUCACHE_24,
//     &FA_FILE_MEDIA_CACHE_31,
//     &FA_FILE_PNACLTRANSLATIONCACHE_21,
//     &FA_FILE_APPLICATION_CACHE_15,
//     &FA_FILE_APPLICATION_CACHE_16,
//     &FA_FILE_CACHE_76,
//     &FA_FILE_CACHE_77,
//     &FA_FILE_GPUCACHE_25,
//     &FA_FILE_MEDIA_CACHE_32,
//     &FA_FILE_PNACLTRANSLATIONCACHE_22,
//     &FA_FILE_APPLICATION_CACHE_17,
//     &FA_FILE_CACHE_78,
//     &FA_FILE_CACHE_79,
//     &FA_FILE_GPUCACHE_26,
//     &FA_FILE_MEDIA_CACHE_33,
//     &FA_FILE_PNACLTRANSLATIONCACHE_23,
//     &FA_FILE_CACHE_80,
//     &FA_FILE_CACHE_81,
//     &FA_FILE_CACHE_DATA_23,
//     &FA_FILE_GPUCACHE_27,
//     &FA_FILE_MEDIA_CACHE_34,
//     &FA_FILE_PNACLTRANSLATIONCACHE_24,
//     &FA_FILE_GPUCACHE_28,
//     &FA_FILE_APPLICATION_CACHE_18,
//     &FA_FILE_CACHE_82,
//     &FA_FILE_CACHE_83,
//     &FA_FILE_GPUCACHE_29,
//     &FA_FILE_GPUCACHE_30,
//     &FA_FILE_MEDIA_CACHE_35,
//     &FA_FILE_PNACLTRANSLATIONCACHE_25,
//     &FA_FILE_APPLICATION_CACHE_19,
//     &FA_FILE_CACHE_84,
//     &FA_FILE_CACHE_85,
//     &FA_FILE_GPUCACHE_31,
//     &FA_FILE_MEDIA_CACHE_36,
//     &FA_FILE_PNACLTRANSLATIONCACHE_26,
//     &FA_FILE_APPLICATION_CACHE_20,
//     &FA_FILE_CACHE_86,
//     &FA_FILE_CACHE_87,
//     &FA_FILE_GPUCACHE_32,
//     &FA_FILE_MEDIA_CACHE_37,
//     &FA_FILE_PNACLTRANSLATIONCACHE_27,
//     &FA_FILE_NETWORK_COOKIES,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL,
//     &FA_FILE_COOKIES,
//     &FA_FILE_COOKIES_JOURNAL,
//     &FA_FILE_NETWORK_COOKIES_2,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_2,
//     &FA_FILE_COOKIES_2,
//     &FA_FILE_COOKIES_JOURNAL_2,
//     &FA_FILE_NETWORK_COOKIES_3,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_3,
//     &FA_FILE_COOKIES_3,
//     &FA_FILE_COOKIES_JOURNAL_3,
//     &FA_FILE_NETWORK_COOKIES_4,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_4,
//     &FA_FILE_COOKIES_4,
//     &FA_FILE_COOKIES_JOURNAL_4,
//     &FA_FILE_NETWORK_COOKIES_5,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_5,
//     &FA_FILE_NETWORK_COOKIES_6,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_6,
//     &FA_FILE_COOKIES_5,
//     &FA_FILE_COOKIES_JOURNAL_5,
//     &FA_FILE_COOKIES_6,
//     &FA_FILE_COOKIES_JOURNAL_6,
//     &FA_FILE_NETWORK_COOKIES_7,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_7,
//     &FA_FILE_COOKIES_7,
//     &FA_FILE_COOKIES_JOURNAL_7,
//     &FA_FILE_NETWORK_COOKIES_8,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_8,
//     &FA_FILE_COOKIES_8,
//     &FA_FILE_COOKIES_JOURNAL_8,
//     &FA_FILE_NETWORK_COOKIES_9,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_9,
//     &FA_FILE_COOKIES_9,
//     &FA_FILE_COOKIES_JOURNAL_9,
//     &FA_FILE_NETWORK_COOKIES_10,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_10,
//     &FA_FILE_COOKIES_10,
//     &FA_FILE_COOKIES_JOURNAL_10,
//     &FA_FILE_NETWORK_COOKIES_11,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_11,
//     &FA_FILE_COOKIES_11,
//     &FA_FILE_COOKIES_JOURNAL_11,
//     &FA_FILE_NETWORK_COOKIES_12,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_12,
//     &FA_FILE_COOKIES_12,
//     &FA_FILE_COOKIES_JOURNAL_12,
//     &FA_FILE_OPERA_COOKIES,
//     &FA_FILE_OPERA_COOKIES_JOURNAL,
//     &FA_FILE_COOKIES_13,
//     &FA_FILE_COOKIES_JOURNAL_13,
//     &FA_FILE_NETWORK_COOKIES_13,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_13,
//     &FA_FILE_COOKIES_14,
//     &FA_FILE_COOKIES_JOURNAL_14,
//     &FA_FILE_NETWORK_COOKIES_14,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_14,
//     &FA_FILE_COOKIES_15,
//     &FA_FILE_COOKIES_JOURNAL_15,
//     &FA_FILE_NETWORK_COOKIES_15,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_15,
//     &FA_FILE_COOKIES_16,
//     &FA_FILE_COOKIES_JOURNAL_16,
//     &FA_FILE_NETWORK_COOKIES_16,
//     &FA_FILE_NETWORK_COOKIES_JOURNAL_16,
//     &FA_FILE_EXTENSIONS_10,
//     &FA_FILE_EXTENSIONS_10_2,
//     &FA_FILE_EXTENSIONS_10_3,
//     &FA_FILE_EXTENSIONS_10_4,
//     &FA_FILE_EXTENSIONS_10_5,
//     &FA_FILE_EXTENSIONS_10_6,
//     &FA_FILE_EXTENSIONS_10_7,
//     &FA_FILE_EXTENSIONS_10_8,
//     &FA_FILE_EXTENSIONS_10_9,
//     &FA_FILE_EXTENSIONS_10_10,
//     &FA_FILE_EXTENSIONS_10_11,
//     &FA_FILE_EXTENSIONS_10_12,
//     &FA_FILE_EXTENSIONS_10_13,
//     &FA_FILE_EXTENSIONS_10_14,
//     &FA_FILE_EXTENSIONS_10_15,
//     &FA_FILE_EXTENSIONS_10_16,
//     &FA_FILE_EXTENSIONS_10_17,
//     &FA_FILE_EXTENSIONS_10_18,
//     &FA_FILE_EXTENSIONS_10_19,
//     &FA_FILE_EXTENSIONS_10_20,
//     &FA_FILE_EXTENSIONS_10_21,
//     &FA_FILE_EXTENSIONS_10_22,
//     &FA_FILE_EXTENSIONS_10_23,
//     &FA_FILE_EXTENSIONS_10_24,
//     &FA_FILE_EXTENSIONS_10_25,
//     &FA_FILE_EXTENSIONS_10_26,
//     &FA_FILE_EXTENSIONS_10_27,
//     &FA_FILE_EXTENSIONS_10_28,
//     &FA_FILE_EXTENSION_ACTIVITY,
//     &FA_FILE_EXTENSION_ACTIVITY_2,
//     &FA_FILE_EXTENSION_ACTIVITY_3,
//     &FA_FILE_EXTENSION_ACTIVITY_4,
//     &FA_FILE_EXTENSION_ACTIVITY_5,
//     &FA_FILE_EXTENSION_ACTIVITY_6,
//     &FA_FILE_EXTENSION_ACTIVITY_7,
//     &FA_FILE_EXTENSION_ACTIVITY_8,
//     &FA_FILE_EXTENSION_ACTIVITY_9,
//     &FA_FILE_EXTENSION_ACTIVITY_10,
//     &FA_FILE_EXTENSION_ACTIVITY_11,
//     &FA_FILE_EXTENSION_ACTIVITY_12,
//     &FA_FILE_EXTENSION_ACTIVITY_13,
//     &FA_FILE_EXTENSION_ACTIVITY_14,
//     &FA_FILE_EXTENSION_ACTIVITY_15,
//     &FA_FILE_EXTENSION_ACTIVITY_16,
//     &FA_FILE_EXTENSION_ACTIVITY_17,
//     &FA_FILE_EXTENSION_ACTIVITY_18,
//     &FA_FILE_EXTENSION_ACTIVITY_19,
//     &FA_FILE_EXTENSION_ACTIVITY_20,
//     &FA_FILE_EXTENSION_ACTIVITY_21,
//     &FA_FILE_EXTENSION_ACTIVITY_22,
//     &FA_FILE_EXTENSION_ACTIVITY_23,
//     &FA_FILE_EXTENSION_ACTIVITY_24,
//     &FA_FILE_EXTENSION_ACTIVITY_25,
//     &FA_FILE_EXTENSION_ACTIVITY_26,
//     &FA_FILE_EXTENSION_ACTIVITY_27,
//     &FA_FILE_EXTENSION_ACTIVITY_28,
//     &FA_FILE_NETWORK_FAVICONS,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL,
//     &FA_FILE_FAVICONS,
//     &FA_FILE_FAVICONS_JOURNAL,
//     &FA_FILE_NETWORK_FAVICONS_2,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_2,
//     &FA_FILE_FAVICONS_2,
//     &FA_FILE_FAVICONS_JOURNAL_2,
//     &FA_FILE_NETWORK_FAVICONS_3,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_3,
//     &FA_FILE_FAVICONS_3,
//     &FA_FILE_FAVICONS_JOURNAL_3,
//     &FA_FILE_NETWORK_FAVICONS_4,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_4,
//     &FA_FILE_FAVICONS_4,
//     &FA_FILE_FAVICONS_JOURNAL_4,
//     &FA_FILE_NETWORK_FAVICONS_5,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_5,
//     &FA_FILE_NETWORK_FAVICONS_6,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_6,
//     &FA_FILE_FAVICONS_5,
//     &FA_FILE_FAVICONS_JOURNAL_5,
//     &FA_FILE_FAVICONS_6,
//     &FA_FILE_FAVICONS_JOURNAL_6,
//     &FA_FILE_NETWORK_FAVICONS_7,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_7,
//     &FA_FILE_FAVICONS_7,
//     &FA_FILE_FAVICONS_JOURNAL_7,
//     &FA_FILE_NETWORK_FAVICONS_8,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_8,
//     &FA_FILE_FAVICONS_8,
//     &FA_FILE_FAVICONS_JOURNAL_8,
//     &FA_FILE_NETWORK_FAVICONS_9,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_9,
//     &FA_FILE_FAVICONS_9,
//     &FA_FILE_FAVICONS_JOURNAL_9,
//     &FA_FILE_NETWORK_FAVICONS_10,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_10,
//     &FA_FILE_FAVICONS_10,
//     &FA_FILE_FAVICONS_JOURNAL_10,
//     &FA_FILE_NETWORK_FAVICONS_11,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_11,
//     &FA_FILE_FAVICONS_11,
//     &FA_FILE_FAVICONS_JOURNAL_11,
//     &FA_FILE_NETWORK_FAVICONS_12,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_12,
//     &FA_FILE_FAVICONS_12,
//     &FA_FILE_FAVICONS_JOURNAL_12,
//     &FA_FILE_OPERA_FAVICONS,
//     &FA_FILE_OPERA_FAVICONS_JOURNAL,
//     &FA_FILE_FAVICONS_13,
//     &FA_FILE_FAVICONS_JOURNAL_13,
//     &FA_FILE_NETWORK_FAVICONS_13,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_13,
//     &FA_FILE_FAVICONS_14,
//     &FA_FILE_FAVICONS_JOURNAL_14,
//     &FA_FILE_NETWORK_FAVICONS_14,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_14,
//     &FA_FILE_FAVICONS_15,
//     &FA_FILE_FAVICONS_JOURNAL_15,
//     &FA_FILE_NETWORK_FAVICONS_15,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_15,
//     &FA_FILE_FAVICONS_16,
//     &FA_FILE_FAVICONS_JOURNAL_16,
//     &FA_FILE_NETWORK_FAVICONS_16,
//     &FA_FILE_NETWORK_FAVICONS_JOURNAL_16,
//     &FA_FILE_ARCHIVED_HISTORY,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL,
//     &FA_FILE_HISTORY,
//     &FA_FILE_HISTORY_JOURNAL,
//     &FA_FILE_ARCHIVED_HISTORY_2,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_2,
//     &FA_FILE_HISTORY_2,
//     &FA_FILE_HISTORY_JOURNAL_2,
//     &FA_FILE_ARCHIVED_HISTORY_3,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_3,
//     &FA_FILE_HISTORY_3,
//     &FA_FILE_HISTORY_JOURNAL_3,
//     &FA_FILE_ARCHIVED_HISTORY_4,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_4,
//     &FA_FILE_HISTORY_4,
//     &FA_FILE_HISTORY_JOURNAL_4,
//     &FA_FILE_ARCHIVED_HISTORY_5,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_5,
//     &FA_FILE_HISTORY_5,
//     &FA_FILE_HISTORY_JOURNAL_5,
//     &FA_FILE_HISTORY_6,
//     &FA_FILE_HISTORY_JOURNAL_6,
//     &FA_FILE_ARCHIVED_HISTORY_6,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_6,
//     &FA_FILE_HISTORY_7,
//     &FA_FILE_HISTORY_JOURNAL_7,
//     &FA_FILE_ARCHIVED_HISTORY_7,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_7,
//     &FA_FILE_HISTORY_8,
//     &FA_FILE_HISTORY_JOURNAL_8,
//     &FA_FILE_ARCHIVED_HISTORY_8,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_8,
//     &FA_FILE_HISTORY_9,
//     &FA_FILE_HISTORY_JOURNAL_9,
//     &FA_FILE_ARCHIVED_HISTORY_9,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_9,
//     &FA_FILE_HISTORY_10,
//     &FA_FILE_HISTORY_JOURNAL_10,
//     &FA_FILE_ARCHIVED_HISTORY_10,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_10,
//     &FA_FILE_HISTORY_11,
//     &FA_FILE_HISTORY_JOURNAL_11,
//     &FA_FILE_ARCHIVED_HISTORY_11,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_11,
//     &FA_FILE_HISTORY_12,
//     &FA_FILE_HISTORY_JOURNAL_12,
//     &FA_FILE_ARCHIVED_HISTORY_12,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_12,
//     &FA_FILE_HISTORY_13,
//     &FA_FILE_HISTORY_JOURNAL_13,
//     &FA_FILE_ARCHIVED_HISTORY_13,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_13,
//     &FA_FILE_HISTORY_14,
//     &FA_FILE_HISTORY_JOURNAL_14,
//     &FA_FILE_ARCHIVED_HISTORY_14,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_14,
//     &FA_FILE_HISTORY_15,
//     &FA_FILE_HISTORY_JOURNAL_15,
//     &FA_FILE_ARCHIVED_HISTORY_15,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_15,
//     &FA_FILE_HISTORY_16,
//     &FA_FILE_HISTORY_JOURNAL_16,
//     &FA_FILE_ARCHIVED_HISTORY_16,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_16,
//     &FA_FILE_HISTORY_17,
//     &FA_FILE_HISTORY_JOURNAL_17,
//     &FA_FILE_HISTORY_18,
//     &FA_FILE_HISTORY_JOURNAL_18,
//     &FA_FILE_ARCHIVED_HISTORY_17,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_17,
//     &FA_FILE_HISTORY_19,
//     &FA_FILE_HISTORY_JOURNAL_19,
//     &FA_FILE_ARCHIVED_HISTORY_18,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_18,
//     &FA_FILE_HISTORY_20,
//     &FA_FILE_HISTORY_JOURNAL_20,
//     &FA_FILE_ARCHIVED_HISTORY_19,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_19,
//     &FA_FILE_HISTORY_21,
//     &FA_FILE_HISTORY_JOURNAL_21,
//     &FA_FILE_ARCHIVED_HISTORY_20,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_20,
//     &FA_FILE_HISTORY_22,
//     &FA_FILE_HISTORY_JOURNAL_22,
//     &FA_FILE_ARCHIVED_HISTORY_21,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_21,
//     &FA_FILE_HISTORY_23,
//     &FA_FILE_HISTORY_JOURNAL_23,
//     &FA_FILE_HISTORY_24,
//     &FA_FILE_HISTORY_JOURNAL_24,
//     &FA_FILE_ARCHIVED_HISTORY_22,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_22,
//     &FA_FILE_HISTORY_25,
//     &FA_FILE_HISTORY_JOURNAL_25,
//     &FA_FILE_ARCHIVED_HISTORY_23,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_23,
//     &FA_FILE_HISTORY_26,
//     &FA_FILE_HISTORY_JOURNAL_26,
//     &FA_FILE_ARCHIVED_HISTORY_24,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_24,
//     &FA_FILE_HISTORY_27,
//     &FA_FILE_HISTORY_JOURNAL_27,
//     &FA_FILE_ARCHIVED_HISTORY_25,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_25,
//     &FA_FILE_HISTORY_28,
//     &FA_FILE_HISTORY_JOURNAL_28,
//     &FA_FILE_ARCHIVED_HISTORY_26,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_26,
//     &FA_FILE_HISTORY_29,
//     &FA_FILE_HISTORY_JOURNAL_29,
//     &FA_FILE_HISTORY_30,
//     &FA_FILE_HISTORY_JOURNAL_30,
//     &FA_FILE_ARCHIVED_HISTORY_27,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_27,
//     &FA_FILE_HISTORY_31,
//     &FA_FILE_HISTORY_JOURNAL_31,
//     &FA_FILE_ARCHIVED_HISTORY_28,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_28,
//     &FA_FILE_HISTORY_32,
//     &FA_FILE_HISTORY_JOURNAL_32,
//     &FA_FILE_ARCHIVED_HISTORY_29,
//     &FA_FILE_ARCHIVED_HISTORY_JOURNAL_29,
//     &FA_FILE_HISTORY_33,
//     &FA_FILE_HISTORY_JOURNAL_33,
//     &FA_FILE_NETWORK_LOGIN_DATA,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL,
//     &FA_FILE_LOGIN_DATA,
//     &FA_FILE_LOGIN_DATA_JOURNAL,
//     &FA_FILE_NETWORK_LOGIN_DATA_2,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_2,
//     &FA_FILE_LOGIN_DATA_2,
//     &FA_FILE_LOGIN_DATA_JOURNAL_2,
//     &FA_FILE_NETWORK_LOGIN_DATA_3,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_3,
//     &FA_FILE_LOGIN_DATA_3,
//     &FA_FILE_LOGIN_DATA_JOURNAL_3,
//     &FA_FILE_NETWORK_LOGIN_DATA_4,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_4,
//     &FA_FILE_LOGIN_DATA_4,
//     &FA_FILE_LOGIN_DATA_JOURNAL_4,
//     &FA_FILE_NETWORK_LOGIN_DATA_5,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_5,
//     &FA_FILE_NETWORK_LOGIN_DATA_6,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_6,
//     &FA_FILE_LOGIN_DATA_5,
//     &FA_FILE_LOGIN_DATA_JOURNAL_5,
//     &FA_FILE_LOGIN_DATA_6,
//     &FA_FILE_LOGIN_DATA_JOURNAL_6,
//     &FA_FILE_NETWORK_LOGIN_DATA_7,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_7,
//     &FA_FILE_LOGIN_DATA_7,
//     &FA_FILE_LOGIN_DATA_JOURNAL_7,
//     &FA_FILE_NETWORK_LOGIN_DATA_8,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_8,
//     &FA_FILE_LOGIN_DATA_8,
//     &FA_FILE_LOGIN_DATA_JOURNAL_8,
//     &FA_FILE_NETWORK_LOGIN_DATA_9,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_9,
//     &FA_FILE_LOGIN_DATA_9,
//     &FA_FILE_LOGIN_DATA_JOURNAL_9,
//     &FA_FILE_NETWORK_LOGIN_DATA_10,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_10,
//     &FA_FILE_LOGIN_DATA_10,
//     &FA_FILE_LOGIN_DATA_JOURNAL_10,
//     &FA_FILE_NETWORK_LOGIN_DATA_11,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_11,
//     &FA_FILE_LOGIN_DATA_11,
//     &FA_FILE_LOGIN_DATA_JOURNAL_11,
//     &FA_FILE_NETWORK_LOGIN_DATA_12,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_12,
//     &FA_FILE_LOGIN_DATA_12,
//     &FA_FILE_LOGIN_DATA_JOURNAL_12,
//     &FA_FILE_OPERA_LOGIN_DATA,
//     &FA_FILE_OPERA_LOGIN_DATA_JOURNAL,
//     &FA_FILE_LOGIN_DATA_13,
//     &FA_FILE_LOGIN_DATA_JOURNAL_13,
//     &FA_FILE_NETWORK_LOGIN_DATA_13,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_13,
//     &FA_FILE_LOGIN_DATA_14,
//     &FA_FILE_LOGIN_DATA_JOURNAL_14,
//     &FA_FILE_NETWORK_LOGIN_DATA_14,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_14,
//     &FA_FILE_LOGIN_DATA_15,
//     &FA_FILE_LOGIN_DATA_JOURNAL_15,
//     &FA_FILE_NETWORK_LOGIN_DATA_15,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_15,
//     &FA_FILE_LOGIN_DATA_16,
//     &FA_FILE_LOGIN_DATA_JOURNAL_16,
//     &FA_FILE_NETWORK_LOGIN_DATA_16,
//     &FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_16,
//     &FA_FILE_NETWORK_WEB_DATA,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL,
//     &FA_FILE_WEB_DATA,
//     &FA_FILE_WEB_DATA_JOURNAL,
//     &FA_FILE_NETWORK_WEB_DATA_2,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_2,
//     &FA_FILE_WEB_DATA_2,
//     &FA_FILE_WEB_DATA_JOURNAL_2,
//     &FA_FILE_NETWORK_WEB_DATA_3,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_3,
//     &FA_FILE_WEB_DATA_3,
//     &FA_FILE_WEB_DATA_JOURNAL_3,
//     &FA_FILE_NETWORK_WEB_DATA_4,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_4,
//     &FA_FILE_WEB_DATA_4,
//     &FA_FILE_WEB_DATA_JOURNAL_4,
//     &FA_FILE_NETWORK_WEB_DATA_5,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_5,
//     &FA_FILE_NETWORK_WEB_DATA_6,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_6,
//     &FA_FILE_WEB_DATA_5,
//     &FA_FILE_WEB_DATA_JOURNAL_5,
//     &FA_FILE_WEB_DATA_6,
//     &FA_FILE_WEB_DATA_JOURNAL_6,
//     &FA_FILE_NETWORK_WEB_DATA_7,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_7,
//     &FA_FILE_WEB_DATA_7,
//     &FA_FILE_WEB_DATA_JOURNAL_7,
//     &FA_FILE_NETWORK_WEB_DATA_8,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_8,
//     &FA_FILE_WEB_DATA_8,
//     &FA_FILE_WEB_DATA_JOURNAL_8,
//     &FA_FILE_NETWORK_WEB_DATA_9,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_9,
//     &FA_FILE_WEB_DATA_9,
//     &FA_FILE_WEB_DATA_JOURNAL_9,
//     &FA_FILE_NETWORK_WEB_DATA_10,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_10,
//     &FA_FILE_WEB_DATA_10,
//     &FA_FILE_WEB_DATA_JOURNAL_10,
//     &FA_FILE_NETWORK_WEB_DATA_11,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_11,
//     &FA_FILE_WEB_DATA_11,
//     &FA_FILE_WEB_DATA_JOURNAL_11,
//     &FA_FILE_NETWORK_WEB_DATA_12,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_12,
//     &FA_FILE_WEB_DATA_12,
//     &FA_FILE_WEB_DATA_JOURNAL_12,
//     &FA_FILE_OPERA_WEB_DATA,
//     &FA_FILE_OPERA_WEB_DATA_JOURNAL,
//     &FA_FILE_WEB_DATA_13,
//     &FA_FILE_WEB_DATA_JOURNAL_13,
//     &FA_FILE_NETWORK_WEB_DATA_13,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_13,
//     &FA_FILE_WEB_DATA_14,
//     &FA_FILE_WEB_DATA_JOURNAL_14,
//     &FA_FILE_NETWORK_WEB_DATA_14,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_14,
//     &FA_FILE_WEB_DATA_15,
//     &FA_FILE_WEB_DATA_JOURNAL_15,
//     &FA_FILE_NETWORK_WEB_DATA_15,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_15,
//     &FA_FILE_WEB_DATA_16,
//     &FA_FILE_WEB_DATA_JOURNAL_16,
//     &FA_FILE_NETWORK_WEB_DATA_16,
//     &FA_FILE_NETWORK_WEB_DATA_JOURNAL_16,
//     &FA_FILE_CACHE_88,
//     &FA_FILE_CACHE2,
//     &FA_FILE_DOOMED,
//     &FA_FILE_ENTRIES,
//     &FA_FILE_CACHE_89,
//     &FA_FILE_CACHE2_2,
//     &FA_FILE_DOOMED_2,
//     &FA_FILE_ENTRIES_2,
//     &FA_FILE_CACHE_90,
//     &FA_FILE_CACHE_91,
//     &FA_FILE_CACHE2_3,
//     &FA_FILE_DOOMED_3,
//     &FA_FILE_ENTRIES_3,
//     &FA_FILE_CACHE_92,
//     &FA_FILE_CACHE2_4,
//     &FA_FILE_DOOMED_4,
//     &FA_FILE_ENTRIES_4,
//     &FA_FILE_CACHE_93,
//     &FA_FILE_CACHE2_5,
//     &FA_FILE_DOOMED_5,
//     &FA_FILE_ENTRIES_5,
//     &FA_FILE_CACHE_94,
//     &FA_FILE_CACHE2_6,
//     &FA_FILE_DOOMED_6,
//     &FA_FILE_ENTRIES_6,
//     &FA_FILE_CACHE_95,
//     &FA_FILE_CACHE2_7,
//     &FA_FILE_DOOMED_7,
//     &FA_FILE_ENTRIES_7,
//     &FA_FILE_CACHE_96,
//     &FA_FILE_CACHE2_8,
//     &FA_FILE_DOOMED_8,
//     &FA_FILE_ENTRIES_8,
//     &FA_FILE_COOKIES_SQLITE,
//     &FA_FILE_COOKIES_SQLITE_WAL,
//     &FA_FILE_COOKIES_SQLITE_2,
//     &FA_FILE_COOKIES_SQLITE_SHM,
//     &FA_FILE_COOKIES_SQLITE_WAL_2,
//     &FA_FILE_COOKIES_SQLITE_3,
//     &FA_FILE_COOKIES_SQLITE_WAL_3,
//     &FA_FILE_COOKIES_SQLITE_4,
//     &FA_FILE_COOKIES_SQLITE_WAL_4,
//     &FA_FILE_DOWNLOADS_SQLITE,
//     &FA_FILE_DOWNLOADS_SQLITE_WAL,
//     &FA_FILE_DOWNLOADS_SQLITE_2,
//     &FA_FILE_DOWNLOADS_SQLITE_WAL_2,
//     &FA_FILE_DOWNLOADS_SQLITE_3,
//     &FA_FILE_DOWNLOADS_SQLITE_WAL_3,
//     &FA_FILE_DOWNLOADS_SQLITE_4,
//     &FA_FILE_DOWNLOADS_SQLITE_WAL_4,
//     &FA_FILE_PLACES_SQLITE,
//     &FA_FILE_PLACES_SQLITE_WAL,
//     &FA_FILE_PLACES_SQLITE_2,
//     &FA_FILE_PLACES_SQLITE_WAL_2,
//     &FA_FILE_PLACES_SQLITE_3,
//     &FA_FILE_PLACES_SQLITE_WAL_3,
//     &FA_FILE_PLACES_SQLITE_4,
//     &FA_FILE_PLACES_SQLITE_WAL_4,
//     &FA_FILE_PLACES_SQLITE_5,
//     &FA_FILE_PLACES_SQLITE_WAL_5,
//     &FA_FILE_ADDONS_JSON,
//     &FA_FILE_EXTENSIONS_JSON,
//     &FA_FILE_WEBAPPS_WEBAPPS_JSON,
//     &FA_FILE_ADDONS_JSON_2,
//     &FA_FILE_EXTENSIONS_JSON_2,
//     &FA_FILE_WEBAPPS_WEBAPPS_JSON_2,
//     &FA_FILE_ADDONS_JSON_3,
//     &FA_FILE_EXTENSIONS_JSON_3,
//     &FA_FILE_WEBAPPS_WEBAPPS_JSON_3,
//     &FA_FILE_ADDONS_JSON_4,
//     &FA_FILE_EXTENSIONS_JSON_4,
//     &FA_FILE_WEBAPPS_WEBAPPS_JSON_4,
//     &FA_EXPLORER_BROWSER_HELPER_OBJECTS,
//     &FA_EXPLORER_BROWSER_HELPER_OBJECTS_2,
//     &FA_FILE__9,
//     &FA_FILE__10,
//     &FA_FILE__11,
//     &FA_FILE__12,
//     &FA_FILE_COOKIES_INDEX_DAT,
//     &FA_FILE_LOW_INDEX_DAT,
//     &FA_FILE_WEBCACHE_WEBCACHEV_DAT,
//     &FA_FILE_IEDOWNLOADHISTORY_INDEX_DAT,
//     &FA_FILE_FEEDS_CACHE_INDEX_DAT,
//     &FA_FILE_INDEX_DAT,
//     &FA_FILE_HISTORY_IE5_INDEX_DAT,
//     &FA_FILE_INDEX_DAT_2,
//     &FA_FILE_HISTORY_IE5_INDEX_DAT_2,
//     &FA_FILE_CONTENT_IE5_INDEX_DAT,
//     &FA_FILE_CONTENT_IE5_INDEX_DAT_2,
//     &FA_FILE_HISTORY_IE5_INDEX_DAT_3,
//     &FA_INTERNET_EXPLORER_MAIN_NOPROTECTEDMODEBANNER,
//     &FA_INTERNET_EXPLORER_TYPEDURLS,
//     &FA_FILE_OPERA_GLOBAL_HISTORY_DAT,
//     &FA_FILE_OPERA_GLOBAL_HISTORY_DAT_2,
//     &FA_FILE_OPERA_GLOBAL_HISTORY_DAT_3,
//     &FA_FILE_OPERA_STABLE_HISTORY,
//     &FA_FILE_OPERA_STABLE_HISTORY_JOURNAL,
//     &FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB,
//     &FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB_WAL,
//     &FA_FILE_COM_APPLE_SAFARI_CACHE_DB,
//     &FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL,
//     &FA_FILE_COM_APPLE_SAFARI_CACHE_DB_2,
//     &FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL_2,
//     &FA_FILE_SAFARI_CACHE_DB,
//     &FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB,
//     &FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB_WAL,
//     &FA_FILE_COOKIES_COOKIES_BINARYCOOKIES,
//     &FA_FILE_COOKIES_COOKIES_BINARYCOOKIES_2,
//     &FA_FILE_SAFARI_DOWNLOADS_PLIST,
//     &FA_FILE_SAFARI_DOWNLOADS_PLIST_2,
//     &FA_FILE_SAFARI_DOWNLOADS_PLIST_3,
//     &FA_FILE_EXTENSIONS_3,
//     &FA_FILE_FAVICON_CACHE_FAVICONS_DB,
//     &FA_FILE_FAVICON_CACHE_FAVICONS_DB_WAL,
//     &FA_FILE_SAFARI_HISTORY_PLIST,
//     &FA_FILE_SAFARI_HISTORY_PLIST_2,
//     &FA_FILE_SAFARI_HISTORY_PLIST_3,
//     &FA_FILE_SAFARI_HISTORY_DB,
//     &FA_FILE_SAFARI_HISTORY_DB_WAL,
//     &FA_FILE_SAFARI_PERSITEPREFERENCES_DB,
//     &FA_FILE_SAFARI_PERSITEPREFERENCES_DB_WAL,
//     &FA_FILE_TABSNAPSHOTS_METADATA_DB,
//     &FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB,
//     &FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB_WAL,
//     &FA_FILE_DATABASE_DATABASE_SQLITE3,
//     &FA_FILE_APACHE_ACCESS_LOG,
//     &FA_FILE_APACHE_ACCESS_LOG_2,
//     &FA_FILE_APACHE2_ACCESS_LOG,
//     &FA_FILE_APACHE2_ACCESS_LOG_2,
//     &FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG,
//     &FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG_2,
//     &FA_FILE_HTTPD_ACCESS_LOG,
//     &FA_FILE_HTTPD_ACCESS_LOG_2,
//     &FA_FILE_LOGS_ACCESS_LOG_11,
//     &FA_FILE_APACHE2_CONF,
//     &FA_FILE_HTTPD_CONF,
//     &FA_FILE_CONF_D_CONF_2,
//     &FA_FILE_CONF_MODULES_D_CONF,
//     &FA_FILE_SITES_AVAILABLE_000_DEFAULT_CONF,
//     &FA_FILE_APACHE_ERROR,
//     &FA_FILE_APACHE_ERROR_LOG,
//     &FA_FILE_APACHE2_ERROR,
//     &FA_FILE_APACHE2_ERROR_LOG,
//     &FA_FILE_HTTPD_ERROR,
//     &FA_FILE_HTTPD_ERROR_LOG,
//     &FA_FILE_LOGS_ERROR_LOG,
//     &FA_FILE_NGINX_ACCESS_LOG,
//     &FA_FILE_LOGS_LOG_6,
//     &FA_FILE_NGINX_ERROR_LOG,
//     &FA_FILE_WP_CONFIG_PHP,
//     &FA_FILE_WWW_WP_CONFIG_PHP,
//     &FA_FILE_WP_CONFIG_PHP_2,
//     &FA_FILE_WWW_WP_CONFIG_PHP_2,
//     &FA_FILE_WP_WP_CONFIG_PHP,
//     &FA_FILE_LOGFILES_LOG,
//     &FA_FILE_W3SVC_LOG,
//     &FA_FILE_W3SVC_LOG_2,
//     &FA_FILE_W3SVC_LOG_3,
//     &FA_DESKTOP_COMPONENTS,
//     &FA_INTERNET_EXPLORER_DESKTOP_GENERAL,
//     &FA_FILE_NTDS_NTDS_DIT,
//     &FA_FILE_NTDS_DIT,
//     &FA_FILE_NTDS_DIT_2,
//     &FA_FILE_SYSTEM32_NTDS_DIT,
//     &FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT,
//     &FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT,
//     &FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT_2,
//     &FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT_2,
//     &FA_FILE_L_USERS_USERNAME_ACTIVITIESCACHE_DB,
//     &FA_FILE_PROGRAMS_AMCACHE_HVE,
//     &FA_FILE_PROGRAMS_AMCACHE_HVE_LOG1,
//     &FA_FILE_PROGRAMS_AMCACHE_HVE_LOG2,
//     &FA_CONTROL_SESSION_MANAGER_APPCERTDLLS,
//     &FA_CURRENTVERSION_APP_PATHS,
//     &FA_CURRENTVERSION_APP_PATHS_2,
//     &FA_FILE_APPPATCH_DRVMAIN_SDB,
//     &FA_FILE_APPPATCH_FRXMAIN_SDB,
//     &FA_FILE_APPPATCH_MSIMAIN_SDB,
//     &FA_FILE_APPPATCH_PCAMAIN_SDB,
//     &FA_FILE_APPPATCH_SYSMAIN_SDB,
//     &FA_FILE_CUSTOM,
//     &FA_FILE_CUSTOM_2,
//     &FA_FILE_CUSTOM64,
//     &FA_FILE_CUSTOMSDB,
//     &FA_FILE_SYSTEM32_WINAPPXRT_DLL,
//     &FA_FILE_ENVIRON_SYSTEMROOT_WINAPPXRT_DLL,
//     &FA_FILE_WBEM_WINAPPXRT_DLL,
//     &FA_FILE_V1_0_WINAPPXRT_DLL,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_AUTOEXEC_BAT,
//     &FA_FILE_ENVIRON_WINDIR_AUTOEXEC_NT,
//     &FA_CURRENTVERSION_AUTOEXCLUSIONLIST,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_AUTORUN_INF,
//     &FA_CURRENTVERSION_TIME_ZONES,
//     &FA_BAM_USERSETTINGS,
//     &FA_STATE_USERSETTINGS,
//     &FA_DAM_USERSETTINGS,
//     &FA_STATE_USERSETTINGS_2,
//     &FA_FILE_DOWNLOADER_QMGR_DAT,
//     &FA_FILE_DOWNLOADER_QMGR_DB,
//     &FA_FILE_BOOT_BCD,
//     &FA_FILE_BOOT_BCD_LOG,
//     &FA_FILE_BOOT_BCD_LOG1,
//     &FA_FILE_BOOT_BCD_LOG2,
//     &FA_FILE_BOOT_BCD_2,
//     &FA_FILE_BOOT_BCD_LOG_2,
//     &FA_FILE_BOOT_BCD_LOG1_2,
//     &FA_FILE_BOOT_BCD_LOG2_2,
//     &FA_FILE_RECOVERY_BCD,
//     &FA_FILE_RECOVERY_BCD_LOG,
//     &FA_FILE_RECOVERY_BCD_LOG1,
//     &FA_FILE_RECOVERY_BCD_LOG2,
//     &FA_FILE_REPOSITORY_CIM_REP,
//     &FA_FILE_REPOSITORY_CIM_REC,
//     &FA_FILE_REPOSITORY_CIM_REP_2,
//     &FA_FILE_REPOSITORY_INDEX_BTR,
//     &FA_FILE_REPOSITORY_INDEX_MAP,
//     &FA_FILE_REPOSITORY_MAPPING_VER,
//     &FA_FILE_REPOSITORY_MAPPING_1_3_MAP,
//     &FA_FILE_REPOSITORY_OBJECTS_DATA,
//     &FA_FILE_REPOSITORY_OBJECTS_MAP,
//     &FA_FILE_FS_INDEX_BTR,
//     &FA_FILE_FS_INDEX_MAP,
//     &FA_FILE_FS_MAPPING_VER,
//     &FA_FILE_FS_MAPPING_1_2_MAP,
//     &FA_FILE_FS_OBJECTS_DATA,
//     &FA_FILE_FS_OBJECTS_MAP,
//     &FA_FILE_REPOSITORY_00_1_9_INDEX_BTR,
//     &FA_FILE_REPOSITORY_00_1_9_INDEX_MAP,
//     &FA_FILE_REPOSITORY_00_1_9_MAPPING_VER,
//     &FA_FILE_REPOSITORY_00_1_9_MAPPING_1_3_MAP,
//     &FA_FILE_REPOSITORY_00_1_9_OBJECTS_DATA,
//     &FA_FILE_REPOSITORY_00_1_9_OBJECTS_MAP,
//     &FA_FILE_FS_INDEX_BTR_2,
//     &FA_FILE_FS_INDEX_MAP_2,
//     &FA_FILE_FS_MAPPING_VER_2,
//     &FA_FILE_FS_MAPPING_1_2_MAP_2,
//     &FA_FILE_FS_OBJECTS_DATA_2,
//     &FA_FILE_FS_OBJECTS_MAP_2,
//     &FA_FILE_INTERNET_EXPLORER_SXS_DLL,
//     &FA_FILE_INTERNET_EXPLORER_SXS_DLL_2,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_EXPLORER_EXE,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_PROGRAM_EXE,
//     &FA_FILE_ENVIRON_SYSTEMROOT_LINKINFO_DLL,
//     &FA_FILE_ENVIRON_SYSTEMROOT_NTSHRUI_DLL,
//     &FA_FILE_SYSTEM32_OCI_DLL,
//     &FA_FILE_SYSPREP_CRYPTBASE_DLL,
//     &FA_FILE_SYSWOW64_OCI_DLL,
//     &FA_FILE_SYSPREP_CRYPTBASE_DLL_2,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_CONFIG_SYS,
//     &FA_FILE_ENVIRON_WINDIR_CONFIG_NT,
//     &FA_CURRENTVERSION_CONTROL_PANEL_CPLS,
//     &FA_CURRENTVERSION_CONTROL_PANEL_CPLS_2,
//     &FA_CURRENTVERSION_CONTROL_PANEL_CPLS_3,
//     &FA_CURRENTVERSION_CONTROL_PANEL_CPLS_4,
//     &FA_FILE_INDEXED_DB_INDEXEDDB_EDB,
//     &FA_FILE_ESEDATABASE_CORTANACOREINSTANCE_CORTANACOREDB_DAT,
//     &FA_FILE_WER,
//     &FA_FILE_ENVIRON_SYSTEMROOT_DMP,
//     &FA_FILE_MINIDUMP_DMP,
//     &FA_FILE_CRASHDUMPS,
//     &FA_FILE_TEMP_DMP,
//     &FA_FILE_CRASHDUMPS_2,
//     &FA_FILE_TEMP_DMP_2,
//     &FA_FILE_TEMP_DMP_3,
//     &FA_FILE_CRASHDUMPS_3,
//     &FA_FILE_WER_2,
//     &FA_FILE_TEMP_DMP_4,
//     &FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS,
//     &FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS_2,
//     &FA_AUTHENTICATION_CREDENTIAL_PROVIDERS,
//     &FA_AUTHENTICATION_CREDENTIAL_PROVIDERS_2,
//     &FA_FILE_METADATA,
//     &FA_FILE_METADATA_2,
//     &FA_FILE_METADATA_3,
//     &FA_FILE_CONTENT,
//     &FA_FILE_CONTENT_2,
//     &FA_FILE_CONTENT_3,
//     &FA_DISALLOWED_CERTIFICATES,
//     &FA_DISALLOWED_CERTIFICATES_2,
//     &FA_DISALLOWED_CERTIFICATES_3,
//     &FA_DISALLOWED_CERTIFICATES_4,
//     &FA_FILE_CONFIG_APPEVENT_EVT,
//     &FA_WINEVT_PUBLISHERS,
//     &FA_FILE_CONFIG_EVT,
//     &FA_FILE_LOGS_EVTX,
//     &FA_FILE_CONFIG_SECEVENT_EVT,
//     &FA_EVENTLOG,
//     &FA_FILE_CONFIG_SYSEVENT_EVT,
//     &FA_FILE_SHUTDOWNLOGGER_ETL,
//     &FA_FILE_COLLECTORS_ETL,
//     &FA_FILE_WFP_ETL,
//     &FA_FILE_LOGS_ETL,
//     &FA_FILE_SYSTEM_ETL,
//     &FA_FILE_PERSONAL_ETL,
//     &FA_FILE_EXPLORER_ETL,
//     &FA_FILE_LOCALSTATE_ETL,
//     &FA_FILE_ETL,
//     &FA_FILE_PANTHER_ETL,
//     &FA_FILE_LOGS_ETL_2,
//     &FA_FILE_LOGS_ETL_3,
//     &FA_FILE_WMI_ETL,
//     &FA_FILE_WMI_ETL_0,
//     &FA_FILE_RTBACKUP_ETL,
//     &FA_FILE_SLEEPSTUDY_ETL,
//     &FA_FILE_SCREENON_ETL,
//     &FA_FILE_LOGFILES_ETL,
//     &FA_FILE_LOGFILES_ETL_0,
//     &FA_FILE_ETL_2,
//     &FA_AUTOPLAYHANDLERS_HANDLERS,
//     &FA_EXPLORER_COMMONPLACES_NAMESPACE,
//     &FA_EXPLORER_COMMONPLACES_NAMESPACE_2,
//     &FA_EXPLORER_COMMONPLACES_NAMESPACE_3,
//     &FA_EXPLORER_COMMONPLACES_NAMESPACE_4,
//     &FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS,
//     &FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_4,
//     &FA_COMMONPLACES_NAMESPACE,
//     &FA_COMMONPLACES_NAMESPACE_2,
//     &FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_5,
//     &FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_6,
//     &FA_EXPLORER_CONTROLPANEL_NAMESPACE,
//     &FA_EXPLORER_CONTROLPANEL_NAMESPACE_2,
//     &FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS,
//     &FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_CONTROLPANEL_NAMESPACE,
//     &FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE,
//     &FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_2,
//     &FA_CONTROLPANEL_NAMESPACEWOW64_DELEGATEFOLDERS,
//     &FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS,
//     &FA_CONTROLPANELWOW64_NAMESPACE,
//     &FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_EXPLORER_CONTROLPANEL_NAMESPACE_3,
//     &FA_EXPLORER_CONTROLPANEL_NAMESPACE_4,
//     &FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_4,
//     &FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_5,
//     &FA_CONTROLPANEL_NAMESPACE_2,
//     &FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_6,
//     &FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_3,
//     &FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_EXPLORER_DESKTOP_NAMESPACE,
//     &FA_EXPLORER_DESKTOP_NAMESPACE_2,
//     &FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS,
//     &FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_DESKTOP_NAMESPACE,
//     &FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_EXPLORER_DESKTOP_NAMESPACE_3,
//     &FA_EXPLORER_DESKTOP_NAMESPACE_4,
//     &FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_4,
//     &FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_5,
//     &FA_DESKTOP_NAMESPACE_2,
//     &FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_6,
//     &FA_EXPLORER_MYCOMPUTER_NAMESPACE,
//     &FA_EXPLORER_MYCOMPUTER_NAMESPACE_2,
//     &FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS,
//     &FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_MYCOMPUTER_NAMESPACE,
//     &FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_EXPLORER_MYCOMPUTER_NAMESPACE_3,
//     &FA_EXPLORER_MYCOMPUTER_NAMESPACE_4,
//     &FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_4,
//     &FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_5,
//     &FA_MYCOMPUTER_NAMESPACE_2,
//     &FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_6,
//     &FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE,
//     &FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_2,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_3,
//     &FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_4,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_4,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_5,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_2,
//     &FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_6,
//     &FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE,
//     &FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_2,
//     &FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS,
//     &FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_2,
//     &FA_PRINTERSANDFAXES_NAMESPACE,
//     &FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_3,
//     &FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_3,
//     &FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_4,
//     &FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_4,
//     &FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_5,
//     &FA_PRINTERSANDFAXES_NAMESPACE_2,
//     &FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_6,
//     &FA_FILE_FIREWALL_PFIREWALL_LOG,
//     &FA_FILE_SCRIPTS_PSSCRIPTS_INI,
//     &FA_FILE_SCRIPTS_SCRIPTS_INI,
//     &FA_FILE_LOGOFF,
//     &FA_FILE_LOGON,
//     &FA_FILE_SCRIPTS_PSSCRIPTS_INI_2,
//     &FA_FILE_SCRIPTS_SCRIPTS_INI_2,
//     &FA_FILE_SHUTDOWN,
//     &FA_FILE_STARTUP,
//     &FA_AUTHORIZEDAPPLICATIONS_LIST,
//     &FA_AUTHORIZEDAPPLICATIONS_LIST_2,
//     &FA_AUTHORIZEDAPPLICATIONS_LIST_3,
//     &FA_AUTHORIZEDAPPLICATIONS_LIST_4,
//     &FA_AUTHORIZEDAPPLICATIONS_LIST_5,
//     &FA_GLOBALLYOPENPORTS_LIST,
//     &FA_GLOBALLYOPENPORTS_LIST_2,
//     &FA_GLOBALLYOPENPORTS_LIST_3,
//     &FA_GLOBALLYOPENPORTS_LIST_4,
//     &FA_GLOBALLYOPENPORTS_LIST_5,
//     &FA_CURRENTVERSION_FONT_DRIVERS,
//     &FA_FILE_DATABASE_HCDATA_EDB,
//     &FA_FILE_ETC_LMHOSTS,
//     &FA_FILE_ETC_HOSTS_3,
//     &FA_FILE_SYSTEM32_MAGNIFIER_EXE,
//     &FA_FILE_SYSTEM32_SETHC_EXE,
//     &FA_FILE_SYSTEM32_UTILMAN_EXE,
//     &FA_CURRENTVERSION_EXPLORER_MAP_NETWORK_DRIVE_MRU,
//     &FA_FILE_AC_INETCACHE,
//     &FA_FILE_AC_INETCOOKIES,
//     &FA_FILE_AC_INETHISTORY,
//     &FA_FILE_WINDOWS_ROAMINGTILES,
//     &FA_SYSTEM_MOUNTEDDEVICES,
//     &FA_MSDTC_MTXOCI,
//     &FA_MSDTC_MTXOCI_2,
//     &FA_CURRENTVERSION_DRIVERS32,
//     &FA_CURRENTVERSION_DRIVERS32_2,
//     &FA_CURRENTVERSION_DRIVERS32_3,
//     &FA_CURRENTVERSION_DRIVERS32_4,
//     &FA_SOFTWARE_MICROSOFT_NETSH,
//     &FA_WOW6432NODE_MICROSOFT_NETSH,
//     &FA_OPENSAVEMRU,
//     &FA_OPENSAVEPIDLMRU,
//     &FA_AUTHENTICATION_PLAP_PROVIDERS,
//     &FA_AUTHENTICATION_PLAP_PROVIDERS_2,
//     &FA_EXPLORER_DISALLOWRUN,
//     &FA_EXPLORER_DISALLOWRUN_2,
//     &FA_,
//     &FA_FILE_V1_0_PROFILE_PS1,
//     &FA_FILE_V1_0_MICROSOFT_POWERSHELL_PROFILE_PS1,
//     &FA_FILE_WINDOWSPOWERSHELL_PROFILE_PS1,
//     &FA_FILE_WINDOWSPOWERSHELL_MICROSOFT_POWERSHELL_PROFILE_PS1,
//     &FA_FILE_PSREADLINE_CONSOLEHOST_HISTORY_TXT,
//     &FA_FILE_PREFETCH_PF,
//     &FA_FILE_NOTIFICATIONS_WPNDATABASE_DB,
//     &FA_FILE_NOTIFICATIONS_WPNDATABASE_DB_2,
//     &FA_FILE_CACHE_97,
//     &FA_FILE_PROGRAMS_RECENTFILECACHE_BCF,
//     &FA_FILE_RECYCLE_BIN,
//     &FA_FILE_RECYCLER,
//     &FA_FILE_I,
//     &FA_FILE_INFO2,
//     &FA_FILE_SYSTEM32_ROVER_DLL,
//     &FA_CLSID_16D12736_7A9E_4765_BEC6_F301D679CAAA,
//     &FA_EXPLORER_RUN,
//     &FA_CURRENTVERSION_RUN,
//     &FA_CURRENTVERSION_RUNONCE,
//     &FA_RUNONCE_SETUP,
//     &FA_CURRENTVERSION_RUNONCEEX,
//     &FA_CURRENTVERSION_RUN_2,
//     &FA_CURRENTVERSION_RUNONCE_2,
//     &FA_RUNONCE_SETUP_2,
//     &FA_CURRENTVERSION_RUNONCEEX_2,
//     &FA_EXPLORER_RUN_2,
//     &FA_EXPLORER_RUN_3,
//     &FA_CURRENTVERSION_RUN_3,
//     &FA_CURRENTVERSION_RUNONCE_3,
//     &FA_RUNONCE_SETUP_3,
//     &FA_CURRENTVERSION_RUNONCEEX_3,
//     &FA_EXPLORER_RUN_4,
//     &FA_CURRENTVERSION_RUN_4,
//     &FA_CURRENTVERSION_RUNONCE_4,
//     &FA_RUNONCE_SETUP_4,
//     &FA_CURRENTVERSION_RUNONCEEX_4,
//     &FA_CURRENTVERSION_RUNSERVICESONCE,
//     &FA_CURRENTVERSION_RUNSERVICES,
//     &FA_CURRENTVERSION_RUNSERVICESONCE_2,
//     &FA_CURRENTVERSION_RUNSERVICES_2,
//     &FA_CURRENTVERSION_RUNSERVICESONCE_3,
//     &FA_CURRENTVERSION_RUNSERVICES_3,
//     &FA_CURRENTVERSION_RUNSERVICESONCE_4,
//     &FA_CURRENTVERSION_RUNSERVICES_4,
//     &FA_FILE_TASKS_10,
//     &FA_FILE_TASKS_10_2,
//     &FA_FILE_TASKS_10_3,
//     &FA_FILE_WINDOWS_WINDOWS_EDB,
//     &FA_CONTROL_SECURITYPROVIDERS,
//     &FA_FILE_DATABASE_SECEDIT_SDB,
//     &FA_FILE_TEMPLATES_SPSECUPD_SDB,
//     &FA_CURRENTCONTROLSET_SERVICES,
//     &FA_EXPLORER_SHAREDTASKSCHEDULER,
//     &FA_EXPLORER_SHAREDTASKSCHEDULER_2,
//     &FA_EXPLORER_SHELLEXECUTEHOOKS,
//     &FA_EXPLORER_SHELLEXECUTEHOOKS_2,
//     &FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED,
//     &FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_2,
//     &FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_3,
//     &FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_4,
//     &FA_SHELLEX_COLUMNHANDLERS,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS,
//     &FA_SHELLEX_COPYHOOKHANDLERS,
//     &FA_SHELLEX_DRAGDROPHANDLERS,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_2,
//     &FA_SHELLEX_COPYHOOKHANDLERS_2,
//     &FA_SHELLEX_DRAGDROPHANDLERS_2,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_2,
//     &FA_SHELLEX_COLUMNHANDLERS_2,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_3,
//     &FA_SHELLEX_COPYHOOKHANDLERS_3,
//     &FA_SHELLEX_DRAGDROPHANDLERS_3,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_3,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_4,
//     &FA_SHELLEX_COPYHOOKHANDLERS_4,
//     &FA_SHELLEX_DRAGDROPHANDLERS_4,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_4,
//     &FA_SHELLEX_COLUMNHANDLERS_3,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_5,
//     &FA_SHELLEX_COPYHOOKHANDLERS_5,
//     &FA_SHELLEX_DRAGDROPHANDLERS_5,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_5,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_6,
//     &FA_SHELLEX_COPYHOOKHANDLERS_6,
//     &FA_SHELLEX_DRAGDROPHANDLERS_6,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_6,
//     &FA_SHELLEX_COLUMNHANDLERS_4,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_7,
//     &FA_SHELLEX_COPYHOOKHANDLERS_7,
//     &FA_SHELLEX_DRAGDROPHANDLERS_7,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_7,
//     &FA_SHELLEX_CONTEXTMENUHANDLERS_8,
//     &FA_SHELLEX_COPYHOOKHANDLERS_8,
//     &FA_SHELLEX_DRAGDROPHANDLERS_8,
//     &FA_SHELLEX_PROPERTYSHEETHANDLERS_8,
//     &FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS,
//     &FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_2,
//     &FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_3,
//     &FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_4,
//     &FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD,
//     &FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD_2,
//     &FA_FILE_MESSAGESTORE_SMSINTERCEPTSTORE_DB,
//     &FA_FILE_ENVIRON_SYSTEMROOT_SETUPAPI_LOG,
//     &FA_FILE_INF_SETUPAPI_APP_LOG,
//     &FA_FILE_INF_SETUPAPI_DEV_LOG,
//     &FA_FILE_INF_SETUPAPI_OFFLINE_LOG,
//     &FA_FILE_APPREPOSITORY_STATEREPOSITORY_DEPLOYMENT_SRD,
//     &FA_FILE_APPREPOSITORY_STATEREPOSITORY_MACHINE_SRD,
//     &FA_FILE_STARTUP_2,
//     &FA_FILE_STARTUP_3,
//     &FA_FILE_STARTUP_4,
//     &FA_FILE_STARTUP_5,
//     &FA_FILE_PREFETCH_AG_DB,
//     &FA_FILE_PREFETCH_AG_DB_TRX,
//     &FA_FILE_ENVIRON_SYSTEMDRIVE_SYSTEM_INI,
//     &FA_FILE_ENVIRON_WINDIR_WIN_INI,
//     &FA_FILE_ENVIRON_WINDIR_WININIT_INI,
//     &FA_FILE_REGBACK_SAM,
//     &FA_FILE_REGBACK_SECURITY,
//     &FA_FILE_REGBACK_SOFTWARE,
//     &FA_FILE_REGBACK_SYSTEM,
//     &FA_FILE_REGBACK_SAM_LOG,
//     &FA_FILE_REGBACK_SAM_LOG1,
//     &FA_FILE_REGBACK_SAM_LOG2,
//     &FA_FILE_REGBACK_SECURITY_LOG,
//     &FA_FILE_REGBACK_SECURITY_LOG1,
//     &FA_FILE_REGBACK_SECURITY_LOG2,
//     &FA_FILE_REGBACK_SOFTWARE_LOG,
//     &FA_FILE_REGBACK_SOFTWARE_LOG1,
//     &FA_FILE_REGBACK_SOFTWARE_LOG2,
//     &FA_FILE_REGBACK_SYSTEM_LOG,
//     &FA_FILE_REGBACK_SYSTEM_LOG1,
//     &FA_FILE_REGBACK_SYSTEM_LOG2,
//     &FA_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE,
//     &FA_FILE_CONFIG_SAM,
//     &FA_FILE_CONFIG_SECURITY,
//     &FA_FILE_CONFIG_SOFTWARE,
//     &FA_FILE_CONFIG_SYSTEM,
//     &FA_FILE_CONFIG_SAM_LOG,
//     &FA_FILE_CONFIG_SAM_LOG1,
//     &FA_FILE_CONFIG_SAM_LOG2,
//     &FA_FILE_CONFIG_SECURITY_LOG,
//     &FA_FILE_CONFIG_SECURITY_LOG1,
//     &FA_FILE_CONFIG_SECURITY_LOG2,
//     &FA_FILE_CONFIG_SOFTWARE_LOG,
//     &FA_FILE_CONFIG_SOFTWARE_LOG1,
//     &FA_FILE_CONFIG_SOFTWARE_LOG2,
//     &FA_FILE_CONFIG_SYSTEM_LOG,
//     &FA_FILE_CONFIG_SYSTEM_LOG1,
//     &FA_FILE_CONFIG_SYSTEM_LOG2,
//     &FA_FILE_SRU_SRUDB_DAT,
//     &FA_FILE_STARTUPINFO_XML,
//     &FA_FILE_TEMP,
//     &FA_FILE_TEMP_2,
//     &FA_FILE_TEMP_3,
//     &FA_CURRENTVERSION_RUNONCE_5,
//     &FA_CURRENTVERSION_RUNONCEEX_5,
//     &FA_CURRENTVERSION_RUN_5,
//     &FA_CURRENTVERSION_RUNONCE_6,
//     &FA_CURRENTVERSION_RUNONCEEX_6,
//     &FA_CURRENTVERSION_RUN_6,
//     &FA_CURRENTVERSION_RUNONCE_7,
//     &FA_CURRENTVERSION_RUNONCEEX_7,
//     &FA_CURRENTVERSION_RUN_7,
//     &FA_CURRENTVERSION_RUNONCE_8,
//     &FA_CURRENTVERSION_RUNONCEEX_8,
//     &FA_CURRENTVERSION_RUN_8,
//     &FA_FILE_EXPLORER_THUMBCACHE_DB,
//     &FA_EXPLORER_MYCOMPUTER_BACKUPPATH,
//     &FA_EXPLORER_MYCOMPUTER_CHKDSKPATH,
//     &FA_EXPLORER_MYCOMPUTER_CLEANUPPATH,
//     &FA_EXPLORER_MYCOMPUTER_DEFRAGPATH,
//     &FA_FILE_DATABASE_VEDATAMODEL_EDB,
//     &FA_UNINSTALL,
//     &FA_UNINSTALL_2,
//     &FA_UNINSTALL_3,
//     &FA_FILE_CATDB,
//     &FA_FILE_DATASTORE_DATASTORE_EDB,
//     &FA_FILE_SYSTEM_ETL_2,
//     &FA_FILE_CBS_CBS_LOG,
//     &FA_FILE_WINDOWSUPDATE_WINDOWSUPDATE_ETL,
//     &FA_FILE_UPDATESTORE_STORE_DB,
//     &FA_FILE_SUM_MDB,
//     &FA_FILE_AUTOMATICDESTINATIONS_AUTOMATICDESTINATIONS_MS,
//     &FA_FILE_CUSTOMDESTINATIONS_CUSTOMDESTINATIONS_MS,
//     &FA_FILE_RECENT,
//     &FA_FILE_RECENT_2,
//     &FA_FILE_USERS_USERPROFILE_NTUSER_DAT,
//     &FA_FILE_USERS_USERPROFILE_NTUSER_MAN,
//     &FA_FILE_WINDOWS_USRCLASS_DAT,
//     &FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG,
//     &FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG1,
//     &FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG2,
//     &FA_FILE_WINDOWS_USRCLASS_DAT_LOG,
//     &FA_FILE_WINDOWS_USRCLASS_DAT_LOG1,
//     &FA_FILE_WINDOWS_USRCLASS_DAT_LOG2,
//     &FA_EXPLORER_SHELL_FOLDERS,
//     &FA_USERS_SID_ENVIRONMENT,
//     &FA_USERS_SID_VOLATILE_ENVIRONMENT,
//     &FA_FILE_CACHESTORAGE_CACHESTORAGE_EDB,
//     &FA_ALTERNATESHELLS_AVAILABLESHELLS,
//     &FA_FILE_ENVIRON_WINDIR_WINSTART_BAT,
//     &FA_FILE_ENVIRON_WINDIR_DOSSTART_BAT,
//     &FA_EXPLORER_WORDWHEELQUERY,
//     &FA_FILE_LOGS_APPLICATION_EVTX,
//     &FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4ADMIN_EVTX,
//     &FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4OPERATIONAL_EVTX,
//     &FA_FILE_LOGS_POWERSHELLCORE_OPERATIONAL_EVTX,
//     &FA_FILE_LOGS_WINDOWS_POWERSHELL_EVTX,
//     &FA_FILE_LOGS_SECURITY_EVTX,
//     &FA_FILE_LOGS_MICROSOFT_WINDOWS_SYSMON_4OPERATIONAL_EVTX,
//     &FA_FILE_LOGS_SYSTEM_EVTX,
//     &FA_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSION,
//     &FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES,
//     &FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES64,
//     &FA_FILE_ENVIRON_WINDIR_EXPLORERFRAME_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DUSER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DUI70_DLL,
//     &FA_FILE_ENVIRON_WINDIR_UXTHEME_DLL,
//     &FA_FILE_ENVIRON_WINDIR_POWRPROF_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DWMAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SLC_DLL,
//     &FA_FILE_ENVIRON_WINDIR_GDIPLUS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SECUR32_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SSPICLI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_PROPSYS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WINSTA_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CRYPTBASE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WINDOWSCODECS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_PROFAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_APPHELP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_EHSTORSHELL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CSCUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CSCDLL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CSCAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NTSHRUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SRVCLI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ICONCODECSERVICE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CRYPTSP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RSAENH_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RPCRTREMOTE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SNDVOLSSO_DLL,
//     &FA_FILE_ENVIRON_WINDIR_HID_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MMDEVAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_TIMEDATE_CPL,
//     &FA_FILE_ENVIRON_WINDIR_ATL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ACTXPRXY_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NTMARTA_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SHDOCVW_DLL,
//     &FA_FILE_ENVIRON_WINDIR_LINKINFO_DLL,
//     &FA_FILE_ENVIRON_WINDIR_USERENV_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SHACCT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_GAMEUX_DLL,
//     &FA_FILE_ENVIRON_WINDIR_XMLLITE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SAMLIB_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSLS31_DLL,
//     &FA_FILE_ENVIRON_WINDIR_TIPTSF_DLL,
//     &FA_FILE_ENVIRON_WINDIR_AUTHUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CRYPTUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSILTCFG_DLL,
//     &FA_FILE_ENVIRON_WINDIR_VERSION_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NETWORKEXPLORER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WINMM_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WDMAUD_DRV,
//     &FA_FILE_ENVIRON_WINDIR_KSUSER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_AVRT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_AUDIOSES_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSACM32_DRV,
//     &FA_FILE_ENVIRON_WINDIR_MSACM32_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MIDIMAP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NETUTILS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_STOBJECT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_BATMETER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WTSAPI32_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ES_DLL,
//     &FA_FILE_ENVIRON_WINDIR_PRNFLDR_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WINSPOOL_DRV,
//     &FA_FILE_ENVIRON_WINDIR_DXP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SYNCREG_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NETSHELL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_IPHLPAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WINNSI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NLAAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ALTTAB_DLL,
//     &FA_FILE_ENVIRON_WINDIR_PNIDUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_QUTIL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WEVTAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DHCPCSVC6_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DHCPCSVC_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CREDSSP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NPMPROXY_DLL,
//     &FA_FILE_ENVIRON_WINDIR_CSCOBJ_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WLANAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WLANUTIL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WWANAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WWAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_QAGENT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SRCHADMIN_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSSPRXY_DLL,
//     &FA_FILE_ENVIRON_WINDIR_BTHPROPS_CPL,
//     &FA_FILE_ENVIRON_WINDIR_IEFRAME_DLL,
//     &FA_FILE_ENVIRON_WINDIR_OLEACC_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SYNCCENTER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ACTIONCENTER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_IMAPI2_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SXS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_HGCPL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_PROVSVC_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WKSCLI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_FXSST_DLL,
//     &FA_FILE_ENVIRON_WINDIR_FXSAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_FXSRESM_DLL,
//     &FA_FILE_ENVIRON_WINDIR_IEPROXY_DLL,
//     &FA_FILE_ENVIRON_WINDIR_THUMBCACHE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RASADHLP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MPR_DLL,
//     &FA_FILE_ENVIRON_WINDIR_VMHGFS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DRPROV_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NTLANMAN_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DAVCLNT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DAVHLPR_DLL,
//     &FA_FILE_ENVIRON_WINDIR_STRUCTUREDQUERY_DLL,
//     &FA_FILE_ENVIRON_WINDIR_UIANIMATION_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DEVRTL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MLANG_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WSCINTEROP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WSCAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WSCUI_CPL,
//     &FA_FILE_ENVIRON_WINDIR_WERCONCPL_DLL,
//     &FA_FILE_ENVIRON_WINDIR_FRAMEDYNOS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WERCPLSUPPORT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSXML6_DLL,
//     &FA_FILE_ENVIRON_WINDIR_HCPROVIDERS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ZIPFLDR_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RAREXT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_7_ZIP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_TWEXT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_WINCDEMUCONTEXTMENU_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SYNCUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SYNCENG_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SHLEXT010_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ATL90_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ACPPAGE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SFC_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SFC_OS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DSROLE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_ACLUI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NTDSAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_PHOTOBASE_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SBDROP_DLL,
//     &FA_FILE_ENVIRON_WINDIR_TQUERY_DLL,
//     &FA_FILE_ENVIRON_WINDIR_EHSTORAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SEARCHFOLDER_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NATURALLANGUAGE6_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NLSDATA0009_DLL,
//     &FA_FILE_ENVIRON_WINDIR_NLSLEXICONS0009_DLL,
//     &FA_FILE_ENVIRON_WINDIR_MSFTEDIT_DLL,
//     &FA_FILE_ENVIRON_WINDIR_DNSAPI_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RASAPI32_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RASMAN_DLL,
//     &FA_FILE_ENVIRON_WINDIR_RTUTILS_DLL,
//     &FA_FILE_ENVIRON_WINDIR_SENSAPI_DLL,
// ];