//! Static [`ArtifactDescriptor`] instances and the [`CATALOG_ENTRIES`] slice.
//!
//! All descriptor statics live here to avoid const-concatenation limitations.
//! The content is organised with section comments matching the original
//! `artifact.rs` structure so `grep -n "^// ──"` still navigates cleanly.
#![allow(clippy::too_many_lines)]
mod android_ext;
mod browser_ext;
mod cloud_ext;
mod generated;
mod linux_ext;
mod macos_ext;
mod vehicle_ext;
mod windows_evtx_ext;
mod windows_files_ext;
mod windows_logs_ext;
mod windows_memory_ext;
mod windows_ntfs_ext;
mod windows_registry_ext;
mod windows_registry_ext2;
mod windows_registry_ext3;
mod windows_vss_ext;
mod windows_wmi_ext;
use super::types::{
ArtifactDescriptor, ArtifactLocation, BinaryField, BinaryFieldType, DataScope, Decoder,
FieldSchema, HiveTarget, OsScope, TriagePriority, ValueType,
};
/// UserAssist 72-byte binary value fields (Win7+ EXE GUID).
pub(crate) static USERASSIST_BINARY_FIELDS: &[BinaryField] = &[
BinaryField {
name: "run_count",
offset: 4,
field_type: BinaryFieldType::U32Le,
description: "Number of times the program was launched",
},
BinaryField {
name: "focus_count",
offset: 8,
field_type: BinaryFieldType::U32Le,
description: "Number of times the program received input focus",
},
BinaryField {
name: "focus_duration_ms",
offset: 12,
field_type: BinaryFieldType::U32Le,
description: "Total focus time in milliseconds",
},
BinaryField {
name: "last_run",
offset: 60,
field_type: BinaryFieldType::FiletimeLe,
description: "FILETIME of the last execution",
},
];
/// UserAssist field schema (decoded output description).
pub(crate) static USERASSIST_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "program",
value_type: ValueType::Text,
description: "ROT13-decoded program path or name",
is_uid_component: true,
},
FieldSchema {
name: "run_count",
value_type: ValueType::UnsignedInt,
description: "Number of times launched",
is_uid_component: false,
},
FieldSchema {
name: "focus_count",
value_type: ValueType::UnsignedInt,
description: "Number of times received focus",
is_uid_component: false,
},
FieldSchema {
name: "focus_duration_ms",
value_type: ValueType::UnsignedInt,
description: "Total focus time in milliseconds",
is_uid_component: false,
},
FieldSchema {
name: "last_run",
value_type: ValueType::Timestamp,
description: "FILETIME of last execution as ISO 8601",
is_uid_component: false,
},
];
/// UserAssist EXE entries (NTUSER.DAT).
///
/// GUID: `{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}` — application/executable launches (.exe files).
/// Key: `Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count`
/// Decoder: ROT13 the value name + parse 72-byte binary value.
///
/// # Forensic caveats
///
/// - **Non-zero Focus Time** is the strongest indicator of actual interactive execution.
/// - **Zero Focus Time + non-zero Run Count** is ambiguous: shell preloading or click attempts
/// that failed to launch may register a Run Count without any Focus Time.
/// - Focus Time is cumulative and includes AFK time while the window remains in focus.
/// - GUI-only: command-line invocations and background processes do not appear here.
/// - The key can be cleared by the user or malware; absence is not proof of non-execution.
///
/// Sources:
/// - GUID confirmed: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
/// - GUID confirmed: <https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/>
/// - Key path structure: <https://windowsir.blogspot.com/2004/02/userassist.html>
pub static USERASSIST_EXE: ArtifactDescriptor = ArtifactDescriptor {
id: "userassist_exe",
name: "UserAssist (EXE)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
// Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
// https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/
// GUID {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} = Win7+ executable-launch GUID.
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count",
value_name: None, // enumerate all values
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_BINARY_FIELDS),
meaning: "Interactive program execution history: launch counts, last execution timestamp, and focus duration. Non-zero Focus Time confirms interactive use; zero Focus Time with non-zero Run Count may indicate shell preloading.",
mitre_techniques: &["T1059", "T1204.002"],
fields: USERASSIST_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["prefetch_dir", "shimcache", "srum_app_resource"],
sources: &[
"https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/",
"https://windowsir.blogspot.com/2004/02/userassist.html",
"http://windowsir.blogspot.com/2007/09/more-on-userassist-keys.html",
"https://www.magnetforensics.com/blog/artifact-profile-userassist/",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
// Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
"https://training.13cubed.com/p/courses/investigating-windows-endpoints",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Counts GUI application launches; CLI-only execution not recorded",
"ROT13 name encoding can be misread if decoder is missing",
"Run Count alone is insufficient — right-clicking an app in the Start Menu and selecting 'Open file location' increments Run Count and updates Last Executed without actual execution; require Focus Time > 0 for higher confidence",
"Behaviour differs across Windows 10 and 11 builds; verify on an exact matching OS version when this artifact is case-critical",
"Batch (.bat) and .cmd files launched via double-click are tracked; this may be the only GUI-execution artifact that captures them explicitly",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Updated per user GUI interaction; persists in NTUSER.DAT",
};
/// Run key field schema.
pub(crate) static RUN_KEY_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "value",
value_type: ValueType::Text,
description: "Autostart command or path",
is_uid_component: false,
}];
/// HKLM SOFTWARE Run key -- system-wide autostart persistence.
pub static RUN_KEY_HKLM_RUN: ArtifactDescriptor = ArtifactDescriptor {
id: "run_key_hklm",
name: "Run Key (HKLM)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows\CurrentVersion\Run",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "System-wide autostart entry executed at every user logon",
mitre_techniques: &["T1547.001"],
fields: RUN_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[
"run_key_hklm_once",
"services_imagepath",
"scheduled_tasks_dir",
],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
"https://windowsir.blogspot.com/2013/01/run-mru.html",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Legitimate software also uses Run keys; context required"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "System registry key; persists until explicit deletion",
};
/// TypedURLs field schema.
pub(crate) static TYPED_URLS_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "value",
value_type: ValueType::Text,
description: "URL typed into the IE/Edge address bar",
is_uid_component: true,
}];
/// Internet Explorer / Edge TypedURLs (NTUSER.DAT).
pub static TYPED_URLS: ArtifactDescriptor = ArtifactDescriptor {
id: "typed_urls",
name: "TypedURLs (IE/Edge)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Internet Explorer\TypedURLs",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "URLs manually typed into the Internet Explorer or Edge address bar",
mitre_techniques: &["T1071.001"],
fields: TYPED_URLS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/digital-forensics-windows-registry-forensics-part-6-internet-explorer-user-typed-urls/",
"https://windowsir.blogspot.com/2006/04/typed-urls.html",
"https://crucialsecurity.wordpress.com/2011/03/14/typedurls-part-1/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// PCA AppLaunch.dic pipe-delimited fields.
pub(crate) static PCA_FIELDS_SCHEMA: &[FieldSchema] = &[
FieldSchema {
name: "exe_path",
value_type: ValueType::Text,
description: "Full path to the executable",
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
value_type: ValueType::Text,
description: "Launch timestamp string",
is_uid_component: false,
},
];
pub(crate) static PCA_PIPE_FIELDS: &[&str] = &["exe_path", "timestamp"];
/// Program Compatibility Assistant AppLaunch.dic (Win11 22H2+).
///
/// A pipe-delimited text file where each line records an application launch.
pub static PCA_APPLAUNCH_DIC: ArtifactDescriptor = ArtifactDescriptor {
id: "pca_applaunch_dic",
name: "PCA PcaAppLaunchDic.txt",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\appcompat\pca\PcaAppLaunchDic.txt"),
scope: DataScope::System,
os_scope: OsScope::Win11_22H2,
decoder: Decoder::PipeDelimited {
fields: PCA_PIPE_FIELDS,
},
meaning: "Program execution evidence from the Program Compatibility Assistant",
mitre_techniques: &["T1059", "T1204.002"],
fields: PCA_FIELDS_SCHEMA,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["pca_general_db"],
sources: &[
"https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/",
"https://www.sygnia.co/blog/new-windows-11-pca-artifact/",
"https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/program-compatibility-assistant.md",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// PCA `PcaGeneralDb0.txt` field schema — abnormal-exit records.
pub(crate) static PCA_GENERAL_DB_FIELDS_SCHEMA: &[FieldSchema] = &[
FieldSchema {
name: "exe_path",
value_type: ValueType::Text,
description:
"Full path (often %programfiles% / %USERPROFILE%-style) of the process that exited",
is_uid_component: true,
},
FieldSchema {
name: "exit_code",
value_type: ValueType::Text,
description: "Hex Win32 NTSTATUS / process exit code (e.g. 0x2, 0x80) from the \
\"Abnormal process exit with code 0xN\" record",
is_uid_component: false,
},
FieldSchema {
name: "timestamp",
value_type: ValueType::Text,
description: "Raw on-disk format is a UTC datetime string 'YYYY-MM-DD HH:MM:SS.f' \
(e.g. 2022-05-12 21:32:42.556), reported as recorded when the process \
terminates (not at launch); Carvey's PCAParse re-emits it as Unix epoch seconds",
is_uid_component: false,
},
FieldSchema {
name: "run_status",
value_type: ValueType::Text,
description: "Numeric record/run-status code (pipe field 2), analogous to an Event ID for the record; observed values 0-4 per AboutDFIR/Sygnia analysis (3 = a PCA Resolve call, the component that applies compatibility fixes)",
is_uid_component: false,
},
FieldSchema {
name: "file_description",
value_type: ValueType::Text,
description: "PE FileDescription of the executable (e.g. \"git\"); blank when the program was run from a UNC path",
is_uid_component: false,
},
FieldSchema {
name: "software_vendor",
value_type: ValueType::Text,
description: "CompanyName / publisher from the PE version resource (e.g. \"the git development community\"); blank for UNC-launched programs",
is_uid_component: false,
},
FieldSchema {
name: "file_version",
value_type: ValueType::Text,
description: "ProductVersion / FileVersion from the PE version resource (e.g. \"2.32.0.windows.2\"); blank for UNC-launched programs",
is_uid_component: false,
},
FieldSchema {
name: "program_id",
value_type: ValueType::Text,
description: "AmCache ProgramId (e.g. 0006ea6a66e62a303f7b974dc4952647a80300000904) — the join key to the AmCache InventoryApplicationFile entry of the same name. Per Blanche Lagny's AmCache research the ProgramId is derived from the file Name, Version, Publisher and Language, so it is stable for identical software across systems and enables cross-artifact and cross-host correlation. Blank for UNC-launched programs",
is_uid_component: false,
},
];
/// Program Compatibility Assistant `PcaGeneralDb0.txt` (Win11 22H2+).
///
/// Sibling text-log file to `PcaAppLaunchDic`. Records lines of the form
/// `<timestamp>|...|<exe_path> - Abnormal process exit with code 0xNN`.
/// Per Carvey (2024-02-26): "there's nothing in either file that points to
/// a specific user", so this artifact is `DataScope::System` even though
/// the recorded executables may live under per-user paths.
///
/// Useful for:
/// - Crash/abnormal-termination evidence for living-off-the-land binaries
/// - Triage of malware that crashes during sandbox or AV interference
/// - Long-lived "fossilized" evidence (Carvey: the file persists across
/// uninstalls of the source app)
pub static PCA_GENERAL_DB: ArtifactDescriptor = ArtifactDescriptor {
id: "pca_general_db",
name: "PCA PcaGeneralDb0.txt",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\appcompat\pca\PcaGeneralDb0.txt"),
scope: DataScope::System,
os_scope: OsScope::Win11_22H2,
decoder: Decoder::Identity,
meaning: "Program Compatibility Assistant abnormal-exit log — each record captures \
an executable path plus its abnormal process exit code (e.g. 0x2, 0x80). \
Sibling to PcaAppLaunchDic in C:\\Windows\\appcompat\\pca\\. \
No user attribution is recorded in the file itself, so analysts must correlate \
with EVTX / EDR telemetry to assign activity to a specific user.",
mitre_techniques: &["T1059", "T1204.002"],
fields: PCA_GENERAL_DB_FIELDS_SCHEMA,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["pca_applaunch_dic", "amcache_app_file"],
// Source: Harlan Carvey, "PCAParse" (2024-02-26) — first public DFIR-side
// documentation of PcaGeneralDb0.txt's "Abnormal process exit with code 0xNN" format.
sources: &[
"https://windowsir.blogspot.com/2024/02/pcaparse.html",
"https://www.sygnia.co/blog/new-windows-11-pca-artifact/",
"https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// PCA PcaGeneralDb1.txt — the rotating SECONDARY of the abnormal-exit log pair.
///
/// Sibling of `pca_general_db` (Db0). Db0 is primary until it reaches 2 MB (2×10^6
/// bytes); the secondary (Db1) is then cleared, becomes the new primary, and the cycle
/// repeats — so the pair retains ~2-4 MB of history. Same UTF-16LE/CRLF pipe-delimited
/// format as Db0. A collector keyed only on Db0 silently loses Db1's older window.
///
/// Source: https://www.sygnia.co/blog/new-windows-11-pca-artifact/ (RE: rotation, 2 MB threshold, encoding, 8-field layout)
/// Source: https://windowsir.blogspot.com/2024/02/pcaparse.html (Carvey PCAParse — parses the pca folder pair)
pub static PCA_GENERAL_DB1: ArtifactDescriptor = ArtifactDescriptor {
id: "pca_general_db1",
name: "PCA PcaGeneralDb1.txt",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\appcompat\pca\PcaGeneralDb1.txt"),
scope: DataScope::System,
os_scope: OsScope::Win11_22H2,
decoder: Decoder::Identity,
meaning: "Secondary/rotating half of the Program Compatibility Assistant abnormal-exit log pair. \
PcaGeneralDb0.txt is the primary file and PcaGeneralDb1.txt the secondary; new records go to whichever \
is primary until it reaches 2 MB (2x10^6 bytes), at which point the secondary is cleared and becomes \
the new primary and the cycle repeats — so 2-4 MB of historical data is retained across the pair. Same \
record format and encoding as Db0 (UTF-16LE, CRLF, one pipe-delimited record per line). Frequently \
empty or sparse (a clean-install Win11 Pro VM did not populate Db1 at all, while a real-use machine \
populated it, less than Db0). Must be collected and parsed alongside Db0 to avoid losing the older \
rotation window. No user attribution is recorded in the file itself — correlate with EVTX / EDR \
telemetry to assign activity to a user.",
mitre_techniques: &["T1059", "T1204.002"],
fields: PCA_GENERAL_DB_FIELDS_SCHEMA,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["pca_general_db", "pca_applaunch_dic"],
sources: &[
"https://www.sygnia.co/blog/new-windows-11-pca-artifact/",
"https://windowsir.blogspot.com/2024/02/pcaparse.html",
"https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Windows `hosts` file (`C:\Windows\System32\drivers\etc\hosts`).
///
/// Static name → IP mapping consulted *before* DNS in Microsoft's TCP/IP
/// host name resolution order, making it a small, high-leverage tampering
/// target for adversaries who want to silently break agent telemetry.
///
/// Per Harlan Carvey's 2024-01 *EDRSilencer* post (and Dray's prompt cited
/// therein), modifying `hosts` to map an EDR vendor's cloud endpoint to
/// `127.0.0.1`/`0.0.0.0` is the simplest of three "silence EDR" alternatives
/// to WFP filters — alongside custom routes and Name Resolution Policy Table
/// edits. Unlike WFP filters, hosts-file modification leaves a trivially
/// triaged on-disk artifact, but most "current investigators and analysts"
/// (Carvey) no longer recognize the resolution order well enough to spot it.
pub static WINDOWS_HOSTS_FILE: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_hosts_file",
name: "Windows hosts File",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\drivers\etc\hosts"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Static name-to-IP overrides consulted before DNS during host name resolution. \
Adversary tradecraft (per Carvey/EDRSilencer write-ups) maps EDR vendor or C2 \
hostnames to 127.0.0.1 / 0.0.0.0 to blackhole agent telemetry without touching \
the EDR process — a stealthier alternative to WFP filters that nonetheless \
leaves a trivially-collected on-disk artifact. Any non-default entry warrants \
triage during incident response.",
mitre_techniques: &["T1562.001", "T1565.001"],
fields: &[FieldSchema {
name: "value",
value_type: ValueType::Text,
description: "Raw hosts-file contents — one record per non-comment line: \
<IP> <hostname1> [hostname2 ...] [# comment]",
is_uid_component: false,
}],
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
// Source: Harlan Carvey, "EDRSilencer" (2024-01-15) — explicitly enumerates
// the hosts file as an EDR-silencing technique alongside WFP and NRPT.
sources: &[
"https://windowsir.blogspot.com/2024/01/edrsilencer.html",
"https://support.microsoft.com/en-us/topic/microsoft-tcp-ip-host-name-resolution-order-dae00cc9-7e9c-c0cc-8360-477b99cb978a",
"https://academy.bluraven.io/blog/edr-silencer-and-beyond-exploring-methods-to-block-edr-communication-part-2",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Non-default entries prove tampering but not who made the change — correlate with filesystem timestamps and event logs",
"Hosts file takes precedence over DNS but NOT over hardcoded IPs; tools that embed C2 IPs bypass this artifact entirely",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Plain text file on disk; survives reboots indefinitely until explicitly modified or restored — unlike WFP filters, hosts edits are trivially recoverable even after adversary cleanup if VSS copies exist",
};
/// Name Resolution Policy Table (NRPT) — `HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\{UUID}`.
///
/// The NRPT is a Windows 7+ feature that lets the DNS client redirect queries
/// for specific FQDNs / suffixes to caller-specified DNS servers, **before**
/// consulting the system-configured resolver. Each rule is stored as a
/// subkey under `DnsPolicyConfig` keyed by a per-rule UUID.
///
/// Carvey's 2024-01 *EDRSilencer* post (addendum 18 Dec) flags NRPT abuse as
/// a third EDR-silencing technique alongside WFP filters and hosts-file
/// edits. Per Fabian Bader's 2024-12 Cloudbrothers analysis, an attacker can
/// run `Add-DnsClientNrptRule -Namespace ".endpoint.security.microsoft.com"
/// -NameServers 127.0.0.1` to blackhole all DNS queries for an EDR vendor's
/// cloud endpoint — and crucially, the resulting registry values are not
/// captured by Defender for Endpoint registry telemetry, because the `Name`
/// value is `REG_MULTI_SZ` and Sysmon stores it as opaque "Binary Data".
pub static DNS_POLICY_CONFIG_NRPT: ArtifactDescriptor = ArtifactDescriptor {
id: "dns_policy_config_nrpt",
name: "DNS Name Resolution Policy Table (NRPT)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Name Resolution Policy Table (NRPT) — per-FQDN / per-suffix DNS \
redirection rules consulted before the system DNS resolver. \
EDR-silencing tradecraft (Carvey 2024-01 addendum, Cloudbrothers \
2024-12) creates a UUID subkey here per rule mapping an EDR vendor \
or C2 hostname to 127.0.0.1 to blackhole agent telemetry. Benign \
uses include VPN clients (e.g. Tailscale) that redirect DNS for \
split-DNS configurations.",
mitre_techniques: &["T1562.001", "T1562.006"],
fields: &[
FieldSchema {
// Source: https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
name: "Name",
value_type: ValueType::List,
description: "REG_MULTI_SZ — list of FQDNs or DNS suffixes the rule applies to. \
Sysmon stores this as opaque 'Binary Data', limiting EDR registry \
telemetry visibility.",
is_uid_component: true,
},
FieldSchema {
// Source: https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
name: "GenericDNSServers",
value_type: ValueType::Text,
description: "Target IP address(es) the matching DNS query is redirected to \
(e.g. 127.0.0.1 for blackhole). Matches the \
`-NameServers` parameter of `Add-DnsClientNrptRule`.",
is_uid_component: false,
},
FieldSchema {
name: "Comment",
value_type: ValueType::Text,
description: "Optional rule comment from `Add-DnsClientNrptRule -Comment`. \
Carvey-style triage flag: free-text strings like \
\"Silenced by Name Resolution Policy Table\" are explicit IOCs.",
is_uid_component: false,
},
],
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["windows_hosts_file"],
// Source: Harlan Carvey 2024-01-15 EDRSilencer (18 Dec addendum); registry
// path & value schema documented in Fabian Bader's Cloudbrothers post.
sources: &[
"https://windowsir.blogspot.com/2024/01/edrsilencer.html",
"https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/",
"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593632(v=ws.11)",
"https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Run key HKCU variants ────────────────────────────────────────────────────
/// HKCU Run key — per-user autostart persistence.
pub static RUN_KEY_HKCU_RUN: ArtifactDescriptor = ArtifactDescriptor {
id: "run_key_hkcu",
name: "Run Key (HKCU)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Run",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Per-user autostart programs executed at every logon without elevation. \
Lower-privilege than HKLM Run — writable by the user account itself, \
making it a common unprivileged persistence location that survives password resets.",
mitre_techniques: &["T1547.001"],
fields: RUN_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["run_key_hklm", "startup_folder_user"],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
"https://windowsir.blogspot.com/2013/01/run-mru.html",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/02_Detection_Rules/2.2_sigma_rules/HKCU%20Run%20Key%20Written%20by%20Unusual%20Process.yml",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Per-user; requires knowing which user profile to examine"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Per-user registry key; persists in NTUSER.DAT",
};
/// HKCU RunOnce — per-user one-shot autostart (deleted after execution).
pub static RUN_KEY_HKCU_RUNONCE: ArtifactDescriptor = ArtifactDescriptor {
id: "run_key_hkcu_once",
name: "RunOnce Key (HKCU)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\RunOnce",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Per-user one-shot autostart: values execute once at the next \
USER LOGIN (not machine boot) and are immediately deleted by the OS. \
Presence proves a payload was staged for the next logon session of \
that user. Absence after suspected compromise means the trigger already \
fired; correlate execution time with user logon events (Event ID 4624). \
Distinct from the persistent Run key — malware choosing RunOnce may be \
trying to limit dwell time or avoid repeated execution. Raspberry Robin \
used HKCU RunOnce for user-scoped persistence (T1547.001).",
mitre_techniques: &["T1547.001", "T1112"],
fields: RUN_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["run_key_hkcu", "run_key_hklm_once"],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
// Source: Raspberry Robin RunOnce misreport — HKCU fires at user login not boot
"https://windowsir.blogspot.com/2022/11/post-compilation.html",
// Source: Carvey confirmed indirect-write evasion leaves no hive trace
"https://windowsir.blogspot.com/2022/10/testing-registry-modification-scenarios.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Key is deleted by the OS after the first user login execution — \
absence does not prove the key was never set; correlate with Event ID 4624 \
(user logon) and execution artifacts (Prefetch, Shimcache) at that time",
"HKCU RunOnce fires at USER LOGIN, not machine boot — \
open reporting frequently confuses these; a user-hive persistence entry \
cannot execute before that user logs in",
"Indirect write via key rename (rename RunOnce → add value → rename back, \
used by Raspberry Robin/Roshtyak) leaves no forensic trace distinguishable \
from normal RunOnce usage in the hive — registry-only analysis cannot detect \
this evasion; requires Sysmon EID 12/13/14 or \
Microsoft-Windows-Shell-Core%4Operational.evtx",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Deleted by OS after single user-login execution; \
transient by design — acquire before the user\'s next login",
};
/// HKLM RunOnce — system-wide one-shot autostart.
pub static RUN_KEY_HKLM_RUNONCE: ArtifactDescriptor = ArtifactDescriptor {
id: "run_key_hklm_once",
name: "RunOnce Key (HKLM)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows\CurrentVersion\RunOnce",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "System-wide one-time autostart: values execute once at the next MACHINE BOOT \
and are immediately deleted by the OS. Presence proves a payload was staged for the \
next boot. Absence after suspected compromise means the trigger already fired — \
correlate execution time with boot records (Event ID 4608 System startup) and \
execution artifacts (Prefetch, ShimCache). Distinct from the persistent Run key; \
malware choosing RunOnce may be trying to limit dwell time or leave minimal trace. \
Indirect write via key rename (Raspberry Robin/Roshtyak) can bypass detection rules.",
mitre_techniques: &["T1547.001", "T1112"],
fields: RUN_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["run_key_hkcu_once", "run_key_hklm"],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
// Source: Carvey confirmed indirect-write evasion leaves no hive trace
"https://windowsir.blogspot.com/2022/10/testing-registry-modification-scenarios.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Single-run key deleted by OS after boot execution — absence does not prove the \
key was never set; correlate with Event ID 4608 (System startup) and execution \
artifacts (Prefetch, ShimCache) at that boot time",
"Indirect write via key rename (rename RunOnce → add value → rename back, \
used by Raspberry Robin/Roshtyak) leaves no forensic trace distinguishable \
from normal RunOnce usage in the hive — registry-only analysis cannot detect \
this evasion; requires Sysmon EID 12/13/14 or \
Microsoft-Windows-Shell-Core%4Operational.evtx",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Deleted by OS after single boot-time execution; \
transient by design — acquire before the next system restart",
};
// ── IFEO ──────────────────────────────────────────────────────────────────────
pub(crate) static IFEO_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "debugger",
value_type: ValueType::Text,
description: "Debugger path that hijacks the target process launch",
is_uid_component: false,
}];
/// Image File Execution Options — Debugger value hijack (T1546.012).
///
/// Attacker sets `Debugger` under a target EXE's IFEO key to redirect
/// its launch to an arbitrary binary (e.g., `cmd.exe`).
pub static IFEO_DEBUGGER: ArtifactDescriptor = ArtifactDescriptor {
id: "ifeo_debugger",
name: "IFEO Debugger Hijack",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows NT\CurrentVersion\Image File Execution Options",
value_name: Some("Debugger"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Redirects target-process launch to an attacker-controlled binary",
mitre_techniques: &["T1546.012"],
fields: IFEO_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/enabling-postmortem-debugging",
"https://www.sans.org/blog/malware-persistence-without-the-windows-registry/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Legitimate debugger keys exist; focus on non-debugger executables"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry key; persists until explicit deletion",
};
// ── UserAssist (Shortcut/LNK GUID) ───────────────────────────────────────────
/// UserAssist Shortcut GUID entries (NTUSER.DAT) — Win7+.
///
/// GUID: `{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}`
///
/// Historically called the "Folder GUID" in DFIR tooling (RegRipper and many
/// blog posts), but per the Magnet Forensics artifact profile this key tracks
/// **launches initiated via shortcuts (.lnk files)** — e.g. Start Menu items,
/// Desktop shortcuts, taskbar pinned items. The "Folder" label is a community
/// misnomer. Corrected naming source:
/// <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
///
/// # Forensic note
///
/// Shortcut (.lnk) interactions can register an entry **without actual execution**
/// if the target fails to launch. Always verify against Prefetch or AmCache.
/// LNK-based persistence (T1547.009) will appear in this GUID, not `{CEBFF5CD-...}`.
pub static USERASSIST_FOLDER: ArtifactDescriptor = ArtifactDescriptor {
id: "userassist_folder",
name: "UserAssist (Shortcut/LNK)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
// Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
// https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/
// GUID {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} = Win7+ shortcut/LNK launch GUID.
// NOTE: Commonly (incorrectly) called "Folder GUID" in RegRipper and community tooling.
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_BINARY_FIELDS),
meaning: "Shortcut-initiated launch history (.lnk files, Start Menu, Desktop) with run counts and timestamps",
mitre_techniques: &["T1547.009", "T1204.002"],
fields: USERASSIST_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["userassist_exe"],
sources: &[
"https://www.magnetforensics.com/blog/artifact-profile-userassist/",
"https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/",
"https://windowsir.blogspot.com/2004/02/userassist.html",
"http://windowsir.blogspot.com/2007/09/more-on-userassist-keys.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── UserAssist XP-era GUIDs (pre-Vista) ──────────────────────────────────────
/// UserAssist XP-era 16-byte binary record field schema.
///
/// Windows XP UserAssist values are 16 bytes, not the 72-byte Win7+ format.
/// Layout: [4 bytes session/pad][4 bytes run count][8 bytes FILETIME].
pub(crate) static USERASSIST_XP_BINARY_FIELDS: &[BinaryField] = &[
BinaryField {
name: "session_id",
offset: 0,
field_type: BinaryFieldType::U32Le,
description: "Session counter or padding (XP-era, often zero)",
},
BinaryField {
name: "run_count",
offset: 4,
field_type: BinaryFieldType::U32Le,
description: "Number of times the item was launched (little-endian DWORD)",
},
BinaryField {
name: "last_run_time",
offset: 8,
field_type: BinaryFieldType::FiletimeLe,
description: "FILETIME of last launch (100-nanosecond intervals since 1601-01-01 UTC)",
},
];
/// UserAssist XP-era field schema (decoded output).
pub(crate) static USERASSIST_XP_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "program",
value_type: ValueType::Text,
description: "ROT13-decoded path or item name",
is_uid_component: true,
},
FieldSchema {
name: "run_count",
value_type: ValueType::UnsignedInt,
description: "Number of times the item was launched",
is_uid_component: false,
},
FieldSchema {
name: "last_run_time",
value_type: ValueType::Timestamp,
description: "Timestamp of most recent launch",
is_uid_component: false,
},
];
/// UserAssist XP EXE GUID (NTUSER.DAT) — Windows XP / 2000.
///
/// GUID: `{75048700-EF1F-11D0-9888-006097DEACF9}`
///
/// Tracks applications, files, links, and other objects accessed on
/// Windows XP/2000. The Win7+ replacement is `{CEBFF5CD-...}`.
/// Binary values are 16 bytes (no focus time/count fields).
///
/// Source: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
pub static USERASSIST_XP_EXE: ArtifactDescriptor = ArtifactDescriptor {
id: "userassist_xp_exe",
name: "UserAssist XP (App/File/Link)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
// Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
// https://windowsir.blogspot.com/2004/02/userassist.html
// GUID {75048700-EF1F-11D0-9888-006097DEACF9} = XP/2000 app, file, and link launch GUID.
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All, // present on XP/2000; may appear on upgraded systems
decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_XP_BINARY_FIELDS),
meaning: "Pre-Vista application, file, and link launch history (16-byte record; no focus time fields)",
mitre_techniques: &["T1059", "T1204.002"],
fields: USERASSIST_XP_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["userassist_exe"],
sources: &[
"https://www.magnetforensics.com/blog/artifact-profile-userassist/",
"https://windowsir.blogspot.com/2004/02/userassist.html",
"http://windowsir.blogspot.com/2007/09/more-on-userassist-keys.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// UserAssist XP IE Favorites GUID (NTUSER.DAT) — Windows XP.
///
/// GUID: `{5E6AB780-7743-11CF-A12B-00AA004AE837}`
///
/// Tracks IE Favorites and IE toolbar objects on Windows XP.
///
/// Source: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
pub static USERASSIST_XP_IE_FAVORITES: ArtifactDescriptor = ArtifactDescriptor {
id: "userassist_xp_ie_favorites",
name: "UserAssist XP (IE Favorites/Toolbar)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
// Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
// GUID {5E6AB780-7743-11CF-A12B-00AA004AE837} = XP IE Favorites and toolbar GUID.
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All, // XP-era; may appear on upgraded systems
decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_XP_BINARY_FIELDS),
meaning: "Pre-Vista Internet Explorer Favorites and toolbar object access history",
mitre_techniques: &["T1071.001"],
fields: USERASSIST_XP_FIELDS,
retention: None,
triage_priority: TriagePriority::Low,
related_artifacts: &["userassist_xp_exe", "typed_urls"],
sources: &[
"https://www.magnetforensics.com/blog/artifact-profile-userassist/",
"https://windowsir.blogspot.com/2004/02/userassist.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// UserAssist XP IE7-specific GUID (NTUSER.DAT) — Windows XP with IE7.
///
/// GUID: `{0D6D4F41-2994-4BA0-8FEF-620E43CD2812}`
///
/// Appears only on Windows XP systems with Internet Explorer 7 installed.
///
/// Source: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
pub static USERASSIST_XP_IE7: ArtifactDescriptor = ArtifactDescriptor {
id: "userassist_xp_ie7",
name: "UserAssist XP (IE7)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
// Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
// GUID {0D6D4F41-2994-4BA0-8FEF-620E43CD2812} = IE7-specific UserAssist GUID (XP + IE7 only).
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{0D6D4F41-2994-4BA0-8FEF-620E43CD2812}\Count",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All, // XP + IE7 only
decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_XP_BINARY_FIELDS),
meaning: "IE7-specific UserAssist tracking on Windows XP (present only when IE7 was installed)",
mitre_techniques: &["T1071.001"],
fields: USERASSIST_XP_FIELDS,
retention: None,
triage_priority: TriagePriority::Low,
related_artifacts: &["userassist_xp_exe", "userassist_xp_ie_favorites"],
sources: &[
"https://www.magnetforensics.com/blog/artifact-profile-userassist/",
"https://windowsir.blogspot.com/2004/02/userassist.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── ShellBags ─────────────────────────────────────────────────────────────────
pub(crate) static SHELLBAGS_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "indices",
value_type: ValueType::List,
description: "MRU order of accessed shell folder slots",
is_uid_component: false,
}];
/// ShellBags — folder navigation history in UsrClass.dat.
///
/// Records folders the user browsed via Explorer, including deleted, network,
/// and removable-media paths. Survives folder deletion.
pub static SHELLBAGS_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "shellbags_user",
name: "ShellBags (User)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::UsrClass),
key_path: r"Local Settings\Software\Microsoft\Windows\Shell\Bags",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::MruListEx,
meaning: "Folder access history; persists paths even after folder deletion",
mitre_techniques: &["T1083", "T1005"],
fields: SHELLBAGS_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/shell-bag-forensics/",
"https://windowsir.blogspot.com/2009/07/shellbag-analysis.html",
"https://ericzimmerman.github.io/#!index.md",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
"https://www.sans.org/white-papers/34545/",
"https://www.magnetforensics.com/blog/forensic-analysis-of-windows-shellbags/",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &["Proves folder was browsed; does not prove file access or execution"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Updated on folder access; persists in UsrClass.dat",
};
// ── Amcache ───────────────────────────────────────────────────────────────────
pub(crate) static AMCACHE_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "file_id",
value_type: ValueType::Text,
description: "Volume GUID + MFT file reference (unique file identity)",
is_uid_component: true,
},
FieldSchema {
name: "sha1",
value_type: ValueType::Text,
description: "SHA1 of the first 31.25 MB (0000-prefixed)",
is_uid_component: false,
},
];
/// Amcache InventoryApplicationFile — program execution evidence with hashes.
pub static AMCACHE_APP_FILE: ArtifactDescriptor = ArtifactDescriptor {
id: "amcache_app_file",
name: "Amcache InventoryApplicationFile",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::Amcache),
key_path: r"Root\InventoryApplicationFile",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning: "Program execution evidence with file hash; persists after binary deletion",
mitre_techniques: &["T1218", "T1204.002"],
fields: AMCACHE_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["shimcache", "prefetch_dir", "srum_app_resource"],
sources: &[
"https://www.sans.org/blog/new-amcache-hve-in-windows-8-1-update-1/",
"https://www.sansforensics.com/blog/amcache-hive-forensics/",
"https://www.researchgate.net/publication/317258237_Leveraging_the_Windows_Amcachehve_File_in_Forensic_Investigations",
"https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/",
"https://github.com/EricZimmerman/AmcacheParser",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
// Seth Enoka — "Shimcache and Amcache: Program Execution Without Certainty":
"https://sethenoka.com/shimcache-and-amcache-program-execution-without-certainty/",
// Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
"https://training.13cubed.com/p/courses/investigating-windows-endpoints",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Presence proves file was on disk and touched by Windows; not always execution",
"Can be populated by antivirus scans",
"AmCache last write time is NOT a reliable first-execution indicator on modern systems — the hive is updated by multiple mechanisms beyond the Compatibility Appraiser scheduled task (which is often disabled), including normal app launches and PCA activity",
"Run AmcacheParser.exe with the -i flag to generate AssociatedFileEntries output; omitting -i produces incomplete results",
"Transaction log files (.LOG1/.LOG2) must be co-located with the hive; AmcacheParser processes them automatically if present — without them, in-flight writes may be missing",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Persists until Windows Update or manual clear",
};
pub(crate) static AMCACHE_PROGRAM_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "program_id",
value_type: ValueType::Text,
description: "ProgramId — the subkey name and the pivot to InventoryApplicationFile: a file whose ProgramId appears in both keys was installed as part of an application, whereas a ProgramId absent here indicates a merely dropped/standalone executable",
is_uid_component: true,
},
FieldSchema {
name: "name",
value_type: ValueType::Text,
description: "Application display name (e.g. \"CrystalDiskMark 8.0.4c\")",
is_uid_component: false,
},
FieldSchema {
name: "publisher",
value_type: ValueType::Text,
description: "Software publisher / vendor",
is_uid_component: false,
},
FieldSchema {
name: "version",
value_type: ValueType::Text,
description: "Application version string",
is_uid_component: false,
},
FieldSchema {
name: "source",
value_type: ValueType::Text,
description: "How the install was discovered — AddRemoveProgram, Msi, or a Store/UWP source; drives which InstallDate values populate",
is_uid_component: false,
},
FieldSchema {
name: "install_date",
value_type: ValueType::Timestamp,
description: "InstallDate — when the OS first recorded the application; day-level granularity and populates mainly for AddRemoveProgram/Msi sources, so treat as approximate",
is_uid_component: false,
},
FieldSchema {
name: "install_date_arp_last_modified",
value_type: ValueType::Timestamp,
description: "InstallDateArpLastModified — last modification of the Add/Remove Programs uninstall entry; a large gap from InstallDate can flag a replaced binary (e.g. a DLL side-load left in a legitimate installer's directory)",
is_uid_component: false,
},
];
/// Amcache InventoryApplication — installed-application inventory (evidence of
/// program presence, not execution).
///
/// Distinct from `amcache_app_file` (InventoryApplicationFile, per-PE-file entries):
/// this key has one subkey per *installed application*, named by its ProgramId, which
/// links the two keys.
///
/// Source: https://github.com/EricZimmerman/AmcacheParser (parser; -i includes installed apps)
/// Source: https://securelist.com/amcache-forensic-artifact/117622/ (Securelist AmCache analysis)
/// Source: https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/amcache.md
pub static AMCACHE_PROGRAM: ArtifactDescriptor = ArtifactDescriptor {
id: "amcache_program",
name: "Amcache InventoryApplication (installed programs)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::Amcache),
key_path: r"Root\InventoryApplication",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning: "Inventory of applications that were INSTALLED on the system — one subkey per \
application, named by its ProgramId, recording Name, Publisher, Version, Source \
(AddRemoveProgram / Msi / Store), InstallDate and the uninstall registry key. It records \
installation/presence, NOT execution: an entry proves the application was installed, not \
that it ran. The ProgramId links to InventoryApplicationFile — a file present in both was \
installed as part of an application, while a file absent from InventoryApplication was \
merely dropped or run standalone, which is a core triage distinction. The key is not \
real-time: it is populated by the Microsoft Compatibility Appraiser (compattelrunner.exe \
scheduled task) and carries a LastScanTime, so software installed since the last appraiser \
run may be missing. Parse with AmcacheParser (-i) after replaying the .LOG1/.LOG2 \
transaction logs.",
mitre_techniques: &[],
fields: AMCACHE_PROGRAM_FIELDS,
retention: Some("Persists in Amcache.hve across reboots; entries may survive application uninstall until the appraiser prunes them"),
triage_priority: TriagePriority::High,
related_artifacts: &["amcache_app_file", "shimcache", "prefetch_dir"],
sources: &[
"https://github.com/EricZimmerman/AmcacheParser",
"https://securelist.com/amcache-forensic-artifact/117622/",
"https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/amcache.md",
"https://www.sans.org/blog/new-amcache-hve-in-windows-8-1-update-1/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Records installation/presence, not execution — an installed application need not have run; prove execution with Prefetch/UserAssist",
"Not real-time: populated by the Compatibility Appraiser (compattelrunner.exe); a LastScanTime marks the last run and software installed since then may be absent",
"InstallDate is day-granularity and populates mainly for AddRemoveProgram/Msi sources; treat as approximate",
"Compare ProgramId against InventoryApplicationFile to distinguish an installed application from a merely dropped/executed file; a large InstallDate vs InstallDateArpLastModified gap can flag a replaced binary (DLL side-load)",
"Replay the .LOG1/.LOG2 transaction logs into Amcache.hve before parsing; behaviour tracks the appraiser library version, not the OS version",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Persists in Amcache.hve; entries remain after uninstall until pruned by the appraiser or a Windows Update",
};
// ── ShimCache (AppCompatCache) ────────────────────────────────────────────────
pub(crate) static SHIMCACHE_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "raw",
value_type: ValueType::Bytes,
description: "Raw AppCompatCache binary blob (parsed by shimcache module)",
is_uid_component: false,
}];
/// ShimCache — application compatibility cache with executable metadata.
///
/// Stored as a single binary value `AppCompatCache` under the SYSTEM hive.
/// Contains executable paths and last-modified timestamps (NOT execution times
/// on Win8+). Parsed by the shimcache module.
pub static SHIMCACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "shimcache",
name: "ShimCache (AppCompatCache)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Session Manager\AppCompatCache",
value_name: Some("AppCompatCache"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Executable metadata cache; presence proves binary existed on disk",
mitre_techniques: &["T1218", "T1059", "T1070.006", "T1036.003"],
fields: SHIMCACHE_FIELDS,
retention: Some("written at clean shutdown only; lost on crash/hard-power-off"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["amcache_app_file", "prefetch_dir", "bam_user", "shimcache_memory"],
sources: &[
// Mandiant "Caching Out: The Value of Shimcache for Investigators" — entry timestamp is $SI last-modified, NOT execution:
"https://cloud.google.com/blog/topics/threat-intelligence/caching-out-the-val/",
// Microsoft — File Times: last-write semantics + SetFileTime altering $SI without changing $DATA:
"https://learn.microsoft.com/en-us/windows/win32/sysinfo/file-times",
"https://www.sans.org/blog/digital-forensics-shimcache/",
"https://redcanary.com/blog/threat-detection/appcompatcache/",
"https://www.sans.org/blog/mass-triage-part-4-processing-returned-files-appcache-shimcache/",
"https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/",
"https://github.com/EricZimmerman/AppCompatCacheParser",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
// Seth Enoka — "Shimcache and Amcache: Program Execution Without Certainty":
"https://sethenoka.com/shimcache-and-amcache-program-execution-without-certainty/",
// Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
"https://training.13cubed.com/p/courses/investigating-windows-endpoints",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Presence proves file existed on disk, not necessarily executed",
"Written only on clean shutdown; live system registry shows entries from last reboot only — use shimcache_memory to capture entries since last reboot",
"Copying a file at the Command Prompt without opening it in Windows Explorer does NOT create a Shimcache entry — the file must be accessed through the shell (Explorer view, rename, or move) to be shimmed",
"Collection method matters: ShimCache records exposure, not execution — a responder browsing the live system under review (e.g. opening the folder in Explorer) can CREATE entries, making the analyst the source. Treat entries as evidence of exposure rather than proof of execution",
"The stored value is a historical snapshot of the executable's $STANDARD_INFORMATION last-modified (last-write) FILETIME captured when the entry was created (Mandiant, 'Caching Out'). A mismatch between this ShimCache-recorded timestamp and the LIVE filesystem $SI last-modified time for the same path is CONSISTENT WITH timestomping of that file between the two capture points (SetFileTime alters on-disk $SI without changing $DATA). Direction-dependent: detectable only when the shim predates the timestomp",
"An identical 64-bit last-modified FILETIME appearing under two or more different paths is CONSISTENT WITH the same binary having been renamed/moved (rename/move within a volume preserves $SI last-modified while each new path is re-shimmed), useful for tracing malware relocation and renamed-utility masquerading. Not proof — unrelated files could share a modified time; note the psexec exception (it rewrites its own $DATA each run, so same-name entries carry DIFFERENT timestamps)",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry value persists until hive is overwritten; see shimcache_memory for the Volatile in-memory counterpart",
};
/// In-memory AppCompatCache state (ShimCache live buffer).
///
/// The Application Compatibility Cache is maintained by the kernel in memory
/// and flushed to the registry only at clean shutdown. On a live system the
/// in-memory buffer contains entries from the current boot session that are
/// NOT yet visible in the registry value — making this the richer artefact
/// for live triage. Collected with volatility3 `windows.shimcachemem` or
/// similar memory-forensics tooling.
pub static SHIMCACHE_MEMORY: crate::catalog::ArtifactDescriptor =
crate::catalog::ArtifactDescriptor {
id: "shimcache_memory",
name: "ShimCache In-Memory Buffer (AppCompatCache live)",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Live AppCompatCache entries not yet flushed to registry. Richer than the on-disk \
registry snapshot on a running system — includes all executables touched since the \
last reboot. Collect via memory acquisition before shutdown; flushes to shimcache \
(registry) on clean shutdown, lost on crash/power-off.",
mitre_techniques: &["T1218", "T1059"],
fields: SHIMCACHE_FIELDS,
retention: Some("lost on reboot or crash; flushed to registry AppCompatCache on clean shutdown"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["shimcache", "amcache_app_file", "prefetch_dir"],
sources: &[
"https://www.sans.org/blog/digital-forensics-shimcache/",
"https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Requires live memory acquisition; not obtainable from disk image alone",
"Presence proves file was loaded by shimming subsystem in current boot session",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "In RAM; lost on reboot. Contains entries not visible in registry until shutdown flush.",
};
// ── BAM / DAM ─────────────────────────────────────────────────────────────────
pub(crate) static BAM_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "last_exec",
value_type: ValueType::Timestamp,
description: "FILETIME of last background execution",
is_uid_component: false,
}];
/// Background Activity Moderator — per-user background process execution times.
///
/// Each value under a SID sub-key is the executable path; value data is an
/// 8-byte FILETIME of the last execution. Win10 1709+.
pub static BAM_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "bam_user",
name: "BAM (Background Activity Moderator)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services\bam\State\UserSettings",
value_name: None,
file_path: None,
scope: DataScope::Mixed,
os_scope: OsScope::Win10Plus,
decoder: Decoder::FiletimeAt { offset: 0 },
meaning: "Last execution time of background/UWP processes per-user SID",
mitre_techniques: &["T1059", "T1204"],
fields: BAM_FIELDS,
retention: Some("~7 days rolling window"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["dam_user", "shimcache", "prefetch_dir"],
sources: &[
"https://www.sans.org/blog/background-activity-moderator-bam-forensics/",
"https://www.13cubed.com/downloads/windows10_forensics_cheat_sheet.pdf",
"https://forensafe.com/blogs/bam.html",
"https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/bam-dam.md",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Granularity is per-day; precise execution time not available"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Rotated by OS on background activity manager flush",
};
pub(crate) static DAM_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "last_exec",
value_type: ValueType::Timestamp,
description: "FILETIME of last desktop application execution",
is_uid_component: false,
}];
/// Desktop Activity Moderator — per-user desktop application execution times.
pub static DAM_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "dam_user",
name: "DAM (Desktop Activity Moderator)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services\dam\State\UserSettings",
value_name: None,
file_path: None,
scope: DataScope::Mixed,
os_scope: OsScope::Win10Plus,
decoder: Decoder::FiletimeAt { offset: 0 },
meaning: "Last execution time of desktop applications per-user SID",
mitre_techniques: &["T1059", "T1204"],
fields: DAM_FIELDS,
retention: Some("~7 days rolling window"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["bam_user", "shimcache"],
sources: &[
"https://www.sans.org/blog/background-activity-moderator-bam-forensics/",
"https://forensafe.com/blogs/bam.html",
"https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/bam-dam.md",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &["Device Activity Monitor; less studied than BAM"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Rotated by OS on desktop activity monitor flush",
};
// ── SAM ───────────────────────────────────────────────────────────────────────
pub(crate) static SAM_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "username",
value_type: ValueType::Text,
description: "Local account username (sub-key name)",
is_uid_component: true,
}];
/// SAM local user account enumeration.
///
/// Each sub-key under `Names` is a local account username. The adjacent
/// `Users\<RID>` keys contain F/V binary records with password hash metadata.
pub static SAM_USERS: ArtifactDescriptor = ArtifactDescriptor {
id: "sam_users",
name: "SAM User Accounts",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSam),
key_path: r"SAM\Domains\Account\Users\Names",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Local Windows accounts; F/V records contain login counts and NTLM hash metadata",
mitre_techniques: &["T1003.002", "T1087.001"],
fields: SAM_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["lsa_secrets", "dcc2_cache"],
sources: &[
"https://www.sans.org/blog/windows-credential-storage-for-penetration-testers/",
"https://windowsir.blogspot.com/2010/11/recovering-passwords.html",
"http://windowsir.blogspot.com/2013/07/howto-determine-users-on-system.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Contains local account NTLM hashes; requires SYSTEM privilege to read",
"Must be used with SYSTEM hive to decrypt",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "SAM registry hive; persists until account deleted",
};
// ── LSA Secrets / DCC2 ───────────────────────────────────────────────────────
pub(crate) static LSA_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "secret_name",
value_type: ValueType::Text,
description: "LSA secret key name (e.g. _SC_*, DPAPI_SYSTEM, DefaultPassword)",
is_uid_component: true,
}];
/// LSA Secrets — encrypted service credentials and DPAPI material.
pub static LSA_SECRETS: ArtifactDescriptor = ArtifactDescriptor {
id: "lsa_secrets",
name: "LSA Secrets",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSecurity),
key_path: r"Policy\Secrets",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Encrypted service credentials, auto-logon passwords, and DPAPI master key",
mitre_techniques: &["T1003.004", "T1552.002"],
fields: LSA_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["sam_users", "dpapi_system_masterkey", "dcc2_cache"],
sources: &["https://www.sans.org/blog/lsa-secrets/"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Requires SYSTEM privileges to read; encrypted at rest"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "System hive registry; persists until credential removed",
};
pub(crate) static DCC2_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "slot_name",
value_type: ValueType::Text,
description: "Cache slot name (NL$1 through NL$25)",
is_uid_component: true,
}];
/// Domain Cached Credentials 2 (MS-Cache v2 / DCC2).
///
/// PBKDF2-SHA1 hashes of the last N domain logons, enabling offline logon
/// when no DC is reachable. Crackable offline.
pub static DCC2_CACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "dcc2_cache",
name: "Domain Cached Credentials 2 (DCC2)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSecurity),
key_path: r"Cache",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "MS-Cache v2 (PBKDF2-SHA1) hashes enabling offline domain logon",
mitre_techniques: &["T1003.005"],
fields: DCC2_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &["https://www.sans.org/blog/windows-credential-storage-for-penetration-testers/"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Only proves domain user logged in; not current password"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Rotated; last 10 cached credentials by default",
};
// ── TypedURLsTime ─────────────────────────────────────────────────────────────
pub(crate) static TYPED_URLS_TIME_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "timestamp",
value_type: ValueType::Timestamp,
description: "FILETIME when the URL slot was typed",
is_uid_component: false,
}];
/// IE/Edge TypedURLsTime — FILETIME timestamps parallel to TypedURLs.
pub static TYPED_URLS_TIME: ArtifactDescriptor = ArtifactDescriptor {
id: "typed_urls_time",
name: "TypedURLsTime (IE/Edge)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Internet Explorer\TypedURLsTime",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::FiletimeAt { offset: 0 },
meaning: "Timestamps of URLs typed into IE/Edge address bar (paired with TypedURLs)",
mitre_techniques: &["T1071.001"],
fields: TYPED_URLS_TIME_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/digital-forensics-windows-registry-forensics-part-6-internet-explorer-user-typed-urls/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── MRU RecentDocs ────────────────────────────────────────────────────────────
pub(crate) static MRU_RECENT_DOCS_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "indices",
value_type: ValueType::List,
description: "MRUListEx order indices of recently accessed documents",
is_uid_component: false,
}];
/// Explorer RecentDocs MRU — most-recently-used document list.
pub static MRU_RECENT_DOCS: ArtifactDescriptor = ArtifactDescriptor {
id: "mru_recent_docs",
name: "MRU RecentDocs",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::MruListEx,
meaning: "Most-recently-used documents list (MRUListEx order of shell32 items)",
mitre_techniques: &["T1005", "T1083"],
fields: MRU_RECENT_DOCS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://windowsir.blogspot.com/2006/11/recent-docs-mru.html",
"https://www.sans.org/blog/windows-mru-registry-keys/",
"https://www.sans.org/blog/opensavemru-and-lastvisitedmru/",
"https://forensics.wiki/opensavemru/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Only tracks files opened via common dialog; programmatic access not recorded",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Updated per file open; fixed max MRU depth",
};
// ── USB device enumeration ────────────────────────────────────────────────────
pub(crate) static USB_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "device_id",
value_type: ValueType::Text,
description: "USB device instance ID (VID&PID sub-key name)",
is_uid_component: true,
}];
/// USBSTOR — USB storage device connection history.
///
/// Each sub-key records a device that was ever connected. Survives device removal.
pub static USB_ENUM: ArtifactDescriptor = ArtifactDescriptor {
id: "usb_enum",
name: "USB Device Enumeration (USBSTOR)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Enum\USBSTOR",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "USB storage device connection history; persists after device removal",
mitre_techniques: &["T1200", "T1052.001"],
fields: USB_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/computer-forensic-artifacts-windows-7-usb-device-tracking/",
"https://windowsir.blogspot.com/2013/07/usb-device-tracking-in-windows-7.html",
"https://www.magnetforensics.com/blog/artifact-profile-usb-devices/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── MUICache ──────────────────────────────────────────────────────────────────
pub(crate) static MUICACHE_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "display_name",
value_type: ValueType::Text,
description: "Localized display name of the executed application",
is_uid_component: false,
},
FieldSchema {
name: "friendly_app_name",
value_type: ValueType::Text,
description: "Value-name suffix .FriendlyAppName; copied from the executable's PE VersionInfo FileDescription string. Recorded verbatim by the shell, so it SURVIVES a filesystem rename — a renamed binary retains its original embedded identity (renamed-executable / masquerade detection)",
is_uid_component: false,
},
FieldSchema {
name: "application_company",
value_type: ValueType::Text,
description: "Value-name suffix .ApplicationCompany; copied from the executable's PE VersionInfo CompanyName string. Survives a filesystem rename",
is_uid_component: false,
},
];
/// MUICache — cached display names of executed applications.
///
/// Value name is the full executable path; data is the localized display name
/// (UTF-16 LE). Program execution evidence that survives log clearing.
pub static MUICACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "muicache",
name: "MUICache",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::UsrClass),
key_path: r"Local Settings\MuiCache",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Utf16Le,
meaning: "Cached display names keyed by executable path; program execution evidence",
mitre_techniques: &["T1059", "T1204.002"],
fields: MUICACHE_FIELDS,
retention: Some("persists until registry cleanup"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["userassist_exe", "bam_user", "amcache_app_file", "prefetch_file", "shimcache"],
sources: &[
"https://windowsir.blogspot.com/2012/08/no-more-mr-nice-guy.html",
"https://www.sans.org/blog/digital-forensics-windows-muicache/",
"http://windowsir.blogspot.com/2005/12/mystery-of-muicachesolved.html",
"https://www.magnetforensics.com/blog/forensic-analysis-of-muicache-files-in-windows/",
"https://forensafe.com/blogs/muicache.html",
// PE VersionInfo string keys (FileDescription / CompanyName) that .FriendlyAppName / .ApplicationCompany are copied from:
"https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo-block",
// RE-derived DFIR reference: the two suffix values, rename-detection use, no-timestamp property:
"https://artefacts.help/windows_registry_muicache.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"MUICache carries NO execution timestamp — the values are stored directly and the key last-write time only tracks the most-recent change, not any specific program launch",
"Populated by the shell on GUI-program interaction, not proof of a full process launch — corroborate with UserAssist / Prefetch / Amcache before concluding execution",
".FriendlyAppName / .ApplicationCompany are absent when the binary has no PE VersionInfo resource (common for packed/stripped malware), so their absence is not exculpatory",
"An attacker can forge the PE VersionInfo strings, so a matching FriendlyAppName is consistent-with, not proof-of, a given identity",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry values in UsrClass.dat; persist until registry cleanup",
};
// ── AppInit_DLLs ──────────────────────────────────────────────────────────────
pub(crate) static APPINIT_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "dll_list",
value_type: ValueType::Text,
description: "Comma/space-separated DLL paths injected into user32.dll consumers",
is_uid_component: false,
}];
/// AppInit_DLLs — DLL injection into every user-mode process (T1546.010).
///
/// Disabled by Secure Boot; still active on systems without it.
pub static APPINIT_DLLS: ArtifactDescriptor = ArtifactDescriptor {
id: "appinit_dlls",
name: "AppInit_DLLs",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows NT\CurrentVersion\Windows",
value_name: Some("AppInit_DLLs"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "DLLs injected into every process that loads user32.dll",
mitre_techniques: &["T1546.010"],
fields: APPINIT_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/dlls/registry-keys-for-appinit-dlls",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Only effective when SecureBoot is disabled"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry value; persists until explicit deletion",
};
// ── Winlogon Userinit ─────────────────────────────────────────────────────────
pub(crate) static WINLOGON_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "userinit",
value_type: ValueType::Text,
description: "Comma-separated executables launched by Winlogon at logon",
is_uid_component: false,
}];
/// Winlogon Userinit — process launched after user authentication (T1547.004).
///
/// Default value: `C:\Windows\System32\userinit.exe,`
/// Attackers append `,malware.exe` or replace entirely.
pub static WINLOGON_USERINIT: ArtifactDescriptor = ArtifactDescriptor {
id: "winlogon_userinit",
name: "Winlogon Userinit",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows NT\CurrentVersion\Winlogon",
value_name: Some("Userinit"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Process(es) launched by Winlogon at logon; default is userinit.exe,",
mitre_techniques: &["T1547.004"],
fields: WINLOGON_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows/win32/secauthn/winlogon-and-gina"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Screensaver persistence ───────────────────────────────────────────────────
pub(crate) static SCREENSAVER_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "path",
value_type: ValueType::Text,
description: "Path to the screensaver executable (.scr)",
is_uid_component: false,
}];
/// Screensaver executable persistence (T1546.002).
///
/// `.scr` files are PE executables; an attacker can replace the screensaver
/// path with a malicious binary that executes when the screen locks.
pub static SCREENSAVER_EXE: ArtifactDescriptor = ArtifactDescriptor {
id: "screensaver_exe",
name: "Screensaver Executable",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
key_path: r"Control Panel\Desktop",
value_name: Some("SCRNSAVE.EXE"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Screensaver path; malicious .scr enables persistence on screen lock",
mitre_techniques: &["T1546.002"],
fields: SCREENSAVER_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://www.sans.org/blog/screensaver-registry-key-for-persistence/"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ═══════════════════════════════════════════════════════════════════════════
// Batch C — Windows persistence / execution / credential artifacts
// ═══════════════════════════════════════════════════════════════════════════
// ── Shared field schemas (reused across multiple descriptors) ─────────────
/// Generic "command or path" field — suitable for persistence value descriptors.
pub(crate) static PERSIST_CMD_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "command",
value_type: ValueType::Text,
description: "Command, DLL path, or executable registered for execution",
is_uid_component: false,
}];
/// Generic "DLL path" field.
pub(crate) static DLL_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "dll_path",
value_type: ValueType::Text,
description: "Path to the DLL registered for injection or loading",
is_uid_component: false,
}];
/// Generic "directory listing" field for filesystem directory artifacts.
pub(crate) static DIR_ENTRY_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "entry_name",
value_type: ValueType::Text,
description: "Name of the file or shortcut present in this directory",
is_uid_component: true,
}];
/// LNK / Shell Link field schema.
///
/// Documents the MS-SHLLINK fields that matter most forensically:
/// - `arguments` — LNK StringData.Arguments; the primary weaponisation indicator;
/// legitimate LNKs are empty, malicious ones carry PowerShell/stager payloads
/// - `drive_type` — LinkInfo.DriveType (FIXED/REMOVABLE/REMOTE/CDROM); combined
/// with `volume_serial_number` links the LNK to USB or MountPoints2 artifacts
/// - `mft_record_number` — 48-bit NTFS record from BEEF0004 (low 32 + high 16 bits);
/// enables independent file identity verification after path changes or deletion
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
/// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/
pub(crate) static LNK_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "target_path",
value_type: ValueType::Text,
description: "Resolved target path (LocalBasePath + CommonPathSuffix from LinkInfo)",
is_uid_component: true,
},
FieldSchema {
name: "created_time",
value_type: ValueType::Timestamp,
description: "LNK header CreationTime (FILETIME, UTC) — when target file was created",
is_uid_component: false,
},
FieldSchema {
name: "accessed_time",
value_type: ValueType::Timestamp,
description: "LNK header AccessTime (FILETIME, UTC) — last access of target file",
is_uid_component: false,
},
FieldSchema {
name: "modified_time",
value_type: ValueType::Timestamp,
description: "LNK header WriteTime (FILETIME, UTC) — last modification of target file",
is_uid_component: false,
},
FieldSchema {
name: "arguments",
value_type: ValueType::Text,
description: "StringData.Arguments — empty for legitimate LNKs; \
PowerShell/encoded payloads indicate weaponised LNK",
is_uid_component: false,
},
FieldSchema {
name: "working_dir",
value_type: ValueType::Text,
description: "StringData.WorkingDir — execution working directory",
is_uid_component: false,
},
FieldSchema {
name: "drive_type",
value_type: ValueType::Text,
description: "LinkInfo.DriveType: FIXED/REMOVABLE/REMOTE/CDROM/RAMDISK; \
REMOVABLE links to USB artifacts; REMOTE indicates lateral movement",
is_uid_component: false,
},
FieldSchema {
name: "volume_serial_number",
value_type: ValueType::Text,
description: "LinkInfo.VolumeSerialNumber — disk identity; \
cross-reference with MountPoints2 and USB enumeration keys",
is_uid_component: false,
},
FieldSchema {
name: "net_share_name",
value_type: ValueType::Text,
description: "CommonNetworkRelativeLink.NetName — UNC share path \
when DriveType=REMOTE; identifies lateral movement source host",
is_uid_component: false,
},
FieldSchema {
name: "file_size",
value_type: ValueType::Integer,
description: "LNK header FileSize (UInt32, low 32 bits only — truncates for >4 GB targets)",
is_uid_component: false,
},
FieldSchema {
name: "mft_record_number",
value_type: ValueType::Integer,
description: "BEEF0004 MFT record number (48-bit: low 32 bits at +0x12, \
high 16 bits at +0x16); pivot to $MFT/$UsnJrnl for full timeline",
is_uid_component: false,
},
FieldSchema {
name: "mft_sequence_number",
value_type: ValueType::Integer,
description: "BEEF0004 MFT sequence number (UInt16 at +0x18); \
detects MFT record reuse (file deleted then slot reused)",
is_uid_component: false,
},
];
/// AutomaticDestinations (.automaticDestinations-ms) DestList entry field schema.
///
/// Each DestList entry embeds a full LNK record. Key forensic fields:
/// - `mru_rank` — entry position in DestList stream (0 = most recently accessed)
/// - `file_size_64bit` — BEEF0004 reconstructs the full 64-bit target file size
/// (LNK header only stores the low 32 bits, truncating files >4 GB)
/// - `mft_record_number` — 48-bit MFT record number for $MFT/$UsnJrnl pivoting
/// - `app_id_hash` — 8-byte CRC64 that identifies the application;
/// resolved via HKCU\...\Search\JumplistData or AppIdlist.csv
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
/// https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/
pub(crate) static JUMP_LIST_AUTO_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id_hash",
value_type: ValueType::Text,
description: "8-byte CRC64 AppID hash (filename stem of .automaticDestinations-ms); \
resolved via JumplistData registry key or AppIdlist.csv",
is_uid_component: true,
},
FieldSchema {
name: "mru_rank",
value_type: ValueType::Integer,
description: "DestList entry order (0 = most recently accessed); \
reconstructs file access chronology per application",
is_uid_component: false,
},
FieldSchema {
name: "pin_status",
value_type: ValueType::Text,
description: "Pin Entry field — whether item is pinned and its pinned order",
is_uid_component: false,
},
FieldSchema {
name: "quick_access_order",
value_type: ValueType::Integer,
description: "Quick Access position (item order in Windows Quick Access folder)",
is_uid_component: false,
},
FieldSchema {
name: "lnk_target_path",
value_type: ValueType::Text,
description: "Embedded LNK target path (LocalBasePath + CommonPathSuffix)",
is_uid_component: false,
},
FieldSchema {
name: "accessed_time",
value_type: ValueType::Timestamp,
description: "Embedded LNK header AccessTime (FILETIME, UTC)",
is_uid_component: false,
},
FieldSchema {
name: "modified_time",
value_type: ValueType::Timestamp,
description: "Embedded LNK header WriteTime (FILETIME, UTC)",
is_uid_component: false,
},
FieldSchema {
name: "file_size_64bit",
value_type: ValueType::Integer,
description:
"Full 64-bit target file size (BEEF0004 high 32 bits + LNK header low 32 bits); \
critical for files >4 GB where LNK header alone truncates",
is_uid_component: false,
},
FieldSchema {
name: "mft_record_number",
value_type: ValueType::Integer,
description: "BEEF0004 48-bit MFT record number (low 32 + high 16 bits); \
pivot to $MFT or $UsnJrnl for timestomping or rename-chain analysis",
is_uid_component: false,
},
FieldSchema {
name: "mft_sequence_number",
value_type: ValueType::Integer,
description: "BEEF0004 MFT sequence number — detects MFT record reuse",
is_uid_component: false,
},
];
/// CustomDestinations (.customDestinations-ms) entry field schema.
///
/// Each entry is an embedded LNK record within a named group. Key fields:
/// - `group_name` — jump list group title (e.g. "Tasks", "Recent", "Pinned")
/// - `arguments` — LNK StringData.Arguments; empty for legitimate entries;
/// malicious entries may carry encoded payloads or C2 URLs
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
/// https://github.com/kacos2000/Jumplist-Browser/blob/master/CustomDestinations-ms.md
pub(crate) static JUMP_LIST_CUSTOM_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "group_name",
value_type: ValueType::Text,
description: "Jump list group title (e.g. 'Tasks', 'Recent', 'Pinned', \
or empty for unnamed Tasks groups)",
is_uid_component: true,
},
FieldSchema {
name: "entry_order",
value_type: ValueType::Integer,
description: "Position of this entry within its group (MRU ordering)",
is_uid_component: false,
},
FieldSchema {
name: "lnk_target_path",
value_type: ValueType::Text,
description: "Embedded LNK target path (LocalBasePath + CommonPathSuffix)",
is_uid_component: false,
},
FieldSchema {
name: "arguments",
value_type: ValueType::Text,
description: "LNK StringData.Arguments — primary weaponisation indicator; \
legitimate entries are empty; malicious entries carry payloads",
is_uid_component: false,
},
FieldSchema {
name: "working_dir",
value_type: ValueType::Text,
description: "LNK StringData.WorkingDir — execution working directory",
is_uid_component: false,
},
FieldSchema {
name: "accessed_time",
value_type: ValueType::Timestamp,
description: "Embedded LNK header AccessTime (FILETIME, UTC)",
is_uid_component: false,
},
];
/// Generic "file path" for single-file artifacts.
pub(crate) static FILE_PATH_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "path",
value_type: ValueType::Text,
description: "Full path to the artifact file",
is_uid_component: true,
}];
// ── Windows persistence: advanced registry ────────────────────────────────
/// Winlogon Shell value — replaceable Windows Explorer shell (T1547.004).
///
/// Default: `explorer.exe`. Attackers replace or append to gain persistence
/// that launches their binary as the user's shell at logon.
pub static WINLOGON_SHELL: ArtifactDescriptor = ArtifactDescriptor {
id: "winlogon_shell",
name: "Winlogon Shell",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows NT\CurrentVersion\Winlogon",
value_name: Some("Shell"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Windows shell process(es) launched by Winlogon; default is explorer.exe",
mitre_techniques: &["T1547.004"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows/win32/secauthn/winlogon-and-gina"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Default value is 'explorer.exe'; any deviation is highly suspicious"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry value; persists until explicit deletion",
};
/// Windows Services — ImagePath value indicates binary launched as a service.
///
/// Each sub-key under `Services\*` has `ImagePath` (the executable) and
/// `Start` (0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled).
pub static SERVICES_IMAGEPATH: ArtifactDescriptor = ArtifactDescriptor {
id: "services_imagepath",
name: "Services ImagePath",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services",
value_name: Some("ImagePath"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Executable path of a Windows service; auto-started services persist across reboots. \
Attackers use sc.exe to set binPath to %COMSPEC% /c powershell.exe -nop -w hidden \
-encodedcommand <base64>, embedding obfuscated PowerShell payloads (base64-encoded \
UTF-16LE, sometimes gzip/deflate-compressed then base64-wrapped) directly in the \
registry. Look for -EncodedCommand, -WindowStyle Hidden, FromBase64String, \
GzipStream, and [IO.Compression.CompressionMode]::Decompress in ImagePath values.",
mitre_techniques: &["T1543.003", "T1059.001", "T1027"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["evtx_system"],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager",
"https://redcanary.com/threat-detection-report/techniques/t1543/",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
// Source: https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html
// — PowerShell encoded command abuse via sc.exe binPath, base64+gzip obfuscation
"https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Many legitimate services present; focus on unsigned/unusual paths"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry key under SYSTEM; persists until service removed",
};
pub(crate) static ACTIVE_SETUP_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "stub_path",
value_type: ValueType::Text,
description: "StubPath command executed once per user at logon for new installs",
is_uid_component: false,
}];
/// Active Setup HKLM — system-side component registration (T1547.014).
///
/// Each CLSID sub-key has `StubPath`. Windows compares HKLM and HKCU versions;
/// if HKCU is missing or older, StubPath is executed as the user at logon.
pub static ACTIVE_SETUP_HKLM: ArtifactDescriptor = ArtifactDescriptor {
id: "active_setup_hklm",
name: "Active Setup (HKLM)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Active Setup\Installed Components",
value_name: Some("StubPath"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Per-user setup command executed by HKLM Active Setup; malicious StubPath = user-context persistence",
mitre_techniques: &["T1547.014"],
fields: ACTIVE_SETUP_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/active-setup-registry-persistence/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Registry key presence is definitive persistence evidence; compare sub-key StubPath against known-good baseline"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry key; persists until explicit deletion",
};
/// Active Setup HKCU — user-side Active Setup version tracking.
///
/// Attacker may delete HKCU entry to trigger HKLM StubPath re-execution.
pub static ACTIVE_SETUP_HKCU: ArtifactDescriptor = ArtifactDescriptor {
id: "active_setup_hkcu",
name: "Active Setup (HKCU)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Active Setup\Installed Components",
value_name: Some("Version"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "User-side Active Setup version; mismatch with HKLM triggers StubPath re-execution",
mitre_techniques: &["T1547.014"],
fields: RUN_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://www.sans.org/blog/active-setup-registry-persistence/"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// COM Hijacking via HKCU CLSID registration (T1546.015).
///
/// When an application resolves a CLSID, Windows checks HKCU\Classes before
/// HKLM. Registering a malicious InprocServer32 in HKCU wins the race
/// without requiring admin privileges.
pub static COM_HIJACK_CLSID_HKCU: ArtifactDescriptor = ArtifactDescriptor {
id: "com_hijack_clsid_hkcu",
name: "COM Hijack CLSID (HKCU)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::UsrClass),
key_path: r"CLSID",
value_name: Some("InprocServer32"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "User-space CLSID registration overriding system COM server; no admin needed",
mitre_techniques: &["T1546.015"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://redcanary.com/threat-detection-report/techniques/t1546/"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Some legitimate COM redirection exists; compare with HKLM entries"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry key per-user; persists in NTUSER.DAT",
};
/// AppCert DLLs — DLL injected into every process calling CreateProcess (T1546.009).
///
/// Unlike AppInit_DLLs, these are loaded into more process types. Rarely
/// legitimate; any non-empty value is highly suspicious.
pub static APPCERT_DLLS: ArtifactDescriptor = ArtifactDescriptor {
id: "appcert_dlls",
name: "AppCertDlls",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Session Manager\AppCertDlls",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "DLLs injected into every process that calls CreateProcess-family APIs",
mitre_techniques: &["T1546.009"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows/win32/devnotes/appcertdlls"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static BOOT_EXECUTE_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "commands",
value_type: ValueType::List,
description: "Commands executed by Session Manager before Win32 subsystem starts",
is_uid_component: false,
}];
/// Boot Execute — commands run by smss.exe before Win32 subsystem (T1547.001).
///
/// Default: `autocheck autochk *`. Additional entries run native NT executables
/// at boot, before antivirus and most defences are loaded.
pub static BOOT_EXECUTE: ArtifactDescriptor = ArtifactDescriptor {
id: "boot_execute",
name: "Boot Execute",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Session Manager",
value_name: Some("BootExecute"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::MultiSz,
meaning: "Native executables run by smss.exe at boot; executes before most security software",
mitre_techniques: &["T1547.001"],
fields: BOOT_EXECUTE_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/boot-time-global-flag-settings",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Any non-default value is highly suspicious; default is autocheck autochk *"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry value; persists until explicit deletion",
};
/// LSA Security Support Providers — SSPs injected into LSASS (T1547.005).
///
/// Legitimate SSPs: kerberos, msv1_0, schannel, wdigest. Extra entries
/// indicate credential-harvesting or persistence.
pub static LSA_SECURITY_PKGS: ArtifactDescriptor = ArtifactDescriptor {
id: "lsa_security_pkgs",
name: "LSA Security Packages",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Lsa",
value_name: Some("Security Packages"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::MultiSz,
meaning: "Security Support Providers loaded into LSASS; malicious SSP = persistent LSASS credential access",
mitre_techniques: &["T1547.005"],
fields: BOOT_EXECUTE_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/secauthn/lsa-authentication",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// LSA Authentication Packages — loaded by LSASS for auth (T1547.002).
pub static LSA_AUTH_PKGS: ArtifactDescriptor = ArtifactDescriptor {
id: "lsa_auth_pkgs",
name: "LSA Authentication Packages",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Lsa",
value_name: Some("Authentication Packages"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::MultiSz,
meaning: "Authentication packages loaded by LSASS; extra DLLs intercept logon credentials",
mitre_techniques: &["T1547.002"],
fields: BOOT_EXECUTE_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows/win32/secauthn/lsa-authentication"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Print Monitors — DLL loaded by the spooler service (T1547.010).
///
/// Requires admin. DLL runs as SYSTEM inside spoolsv.exe across reboots.
pub static PRINT_MONITORS: ArtifactDescriptor = ArtifactDescriptor {
id: "print_monitors",
name: "Print Monitors",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Print\Monitors",
value_name: Some("Driver"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "DLL loaded into spoolsv.exe (SYSTEM); extra monitors = SYSTEM persistence",
mitre_techniques: &["T1547.010"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows-hardware/drivers/print/print-monitor"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Time Provider DLLs — loaded into svchost as part of W32Time (T1547.003).
pub static TIME_PROVIDERS: ArtifactDescriptor = ArtifactDescriptor {
id: "time_providers",
name: "W32Time Time Provider DLLs",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services\W32Time\TimeProviders",
value_name: Some("DllName"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "DLLs loaded by the Windows Time service; malicious entry = SYSTEM persistence",
mitre_techniques: &["T1547.003"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows/win32/sysinfo/time-provider"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Netsh Helper DLLs — COM-like DLLs loaded by netsh.exe (T1546.007).
pub static NETSH_HELPER_DLLS: ArtifactDescriptor = ArtifactDescriptor {
id: "netsh_helper_dlls",
name: "Netsh Helper DLLs",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\NetSh",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "DLLs loaded whenever netsh.exe is invoked; attacker DLL runs in user's netsh context",
mitre_techniques: &["T1546.007"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/netmgmt/network-management-functions",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static BHO_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "clsid",
value_type: ValueType::Text,
description: "CLSID of the Browser Helper Object (sub-key name)",
is_uid_component: true,
}];
/// Browser Helper Objects — COM components loaded by IE (T1176).
///
/// BHOs run inside iexplore.exe and can intercept HTTP traffic, steal
/// credentials, and maintain persistence via the COM registry.
pub static BROWSER_HELPER_OBJECTS: ArtifactDescriptor = ArtifactDescriptor {
id: "browser_helper_objects",
name: "Internet Explorer Browser Helper Objects",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "COM components auto-loaded into IE; can intercept browsing and steal credentials",
mitre_techniques: &["T1176"],
fields: BHO_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa753582(v=vs.85)",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Windows persistence: filesystem ──────────────────────────────────────
/// User Startup Folder — files/LNKs here execute at user logon (T1547.001).
pub static STARTUP_FOLDER_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "startup_folder_user",
name: "User Startup Folder",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Executables and LNKs here run at user logon; no admin required",
mitre_techniques: &["T1547.001"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/shell/csidl",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// System Startup Folder — files/LNKs here execute for all users at logon.
pub static STARTUP_FOLDER_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "startup_folder_system",
name: "System Startup Folder",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Executables and LNKs run for every user at logon; requires admin to plant",
mitre_techniques: &["T1547.001"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://learn.microsoft.com/en-us/windows/win32/shell/csidl"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Windows Task Scheduler task XML files (T1053.005).
///
/// Each task is stored as an XML file; key elements: `<Actions>` (what runs),
/// `<Triggers>` (when), `<Principal>` (which user/privileges).
pub static SCHEDULED_TASKS_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "scheduled_tasks_dir",
name: "Scheduled Tasks Directory",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\Tasks"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "XML task definitions; malicious tasks can run at boot, logon, or arbitrary intervals",
mitre_techniques: &["T1053.005"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page",
"https://redcanary.com/threat-detection-report/techniques/t1053/",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Task XML may be deleted after execution; check event log 4698/4702"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "XML files in tasks directory; persist until task deleted",
};
/// WDigest credential caching control (T1003.001).
///
/// Setting `UseLogonCredential` = 1 re-enables cleartext credential caching
/// in LSASS memory on Windows 8.1+ (disabled by default since KB2871997).
pub static WDIGEST_CACHING: ArtifactDescriptor = ArtifactDescriptor {
id: "wdigest_caching",
name: "WDigest UseLogonCredential",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\SecurityProviders\WDigest",
value_name: Some("UseLogonCredential"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::DwordLe,
meaning:
"1 = cleartext creds in LSASS; attackers set this before Mimikatz to harvest passwords",
mitre_techniques: &["T1003.001"],
fields: RUN_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://redcanary.com/threat-detection-report/techniques/t1003/"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Windows execution evidence ────────────────────────────────────────────
/// WordWheelQuery — Explorer search bar history (MRUListEx).
pub static WORDWHEEL_QUERY: ArtifactDescriptor = ArtifactDescriptor {
id: "wordwheel_query",
name: "WordWheelQuery (Explorer Search)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::MruListEx,
meaning:
"Search terms entered into Windows Explorer search bar; reveals attacker reconnaissance",
mitre_techniques: &["T1083"],
fields: MRU_RECENT_DOCS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["lnk_files"],
sources: &[
"https://windowsir.blogspot.com/2012/08/wordwheelquery.html",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
// Mandiant "The Missing LNK" — timestamp-interpretation limit + LNK-correlation method:
"https://cloud.google.com/blog/topics/threat-intelligence/the-missing-lnk-correlating-user-search-lnk-files/",
// RegRipper wordwheelquery.pl — MRUListEx u32-array + 0xFFFFFFFF terminator + UTF-16LE decode:
"https://github.com/keydet89/RegRipper3.0/blob/master/plugins/wordwheelquery.pl",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Derived-timestamp rule: the key LastWrite time dates ONLY the single most-recent search term. Every other term can be bounded only as searched BEFORE that LastWrite; the Registry stores no per-term timestamp (Mandiant, 2020)",
"Recency order is recovered from the MRUListEx value: an array of little-endian u32 value-indices, most-recent-first, whose final entry is the 0xFFFFFFFF terminator (dropped before use). The FIRST element of that most-recent-first array identifies the term the LastWrite dates (RegRipper wordwheelquery.pl: unpack(\"V*\"), pop if 0xffffffff)",
"Older search times can be recovered by correlating each term with user-search LNK files, which carry their own target MAC timestamps for when a file was opened from the search results; combining the LNK times with the MRUListEx order lets the analyst infer the relative sequence of earlier searches (Mandiant 'The Missing LNK', 2020)",
"Scope: this key records File Explorer search-bar terms",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Updated when the user types a term into Explorer search; persists in NTUSER.DAT",
};
/// OpenSaveMRU — files opened/saved via Windows common dialog (T1083).
///
/// Each file extension has a sub-key containing an MRU list of paths.
/// The `*` sub-key shows all extensions combined.
pub static OPENSAVE_MRU: ArtifactDescriptor = ArtifactDescriptor {
id: "opensave_mru",
name: "OpenSaveMRU (Common Dialog)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::MruListEx,
meaning: "Paths of files opened or saved via Win32 common dialog boxes, stored as shell PIDLs per file extension (Win7+ key; Windows XP used the non-PIDL OpenSaveMRU)",
mitre_techniques: &["T1083"],
fields: MRU_RECENT_DOCS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://windowsir.blogspot.com/2006/11/recent-docs-mru.html",
"https://www.sans.org/blog/opensavemru-and-lastvisitedmru/",
"https://forensics.wiki/opensavemru/",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// LastVisitedMRU — last folder visited in common dialog per-application.
pub static LASTVISITED_MRU: ArtifactDescriptor = ArtifactDescriptor {
id: "lastvisited_mru",
name: "LastVisitedMRU (Common Dialog)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::MruListEx,
meaning: "Application executable + last-used folder from common dialog; reveals programs accessing files (Win7+ key; Windows XP used the non-PIDL LastVisitedMRU)",
mitre_techniques: &["T1083"],
fields: MRU_RECENT_DOCS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://windowsir.blogspot.com/2006/11/recent-docs-mru.html",
"https://www.sans.org/blog/opensavemru-and-lastvisitedmru/",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── NTFS metadata files ───────────────────────────────────────────────────────
pub(crate) static MFT_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "mft_record_number",
value_type: ValueType::Integer,
description: "Unique 48-bit record number within the $MFT (NTFS 3.1: explicit at header 0x2A; pre-3.1: inferred from file offset)",
is_uid_component: true,
},
FieldSchema {
name: "sequence_number",
value_type: ValueType::Integer,
description: "Reuse counter (uint16 at header 0x10) — incremented each time a record slot is deallocated; stale references detectable",
is_uid_component: false,
},
FieldSchema {
// MFT record header offset 0x08, uint64.
// Increments on every modification — chronological anchor independent of timestamps.
// Source: https://github.com/kacos2000/MFT_Browser
name: "lsn",
value_type: ValueType::UnsignedInt,
description: "$LogFile Sequence Number (uint64 at 0x08); monotonically increasing modification counter; links to $LogFile transaction",
is_uid_component: false,
},
FieldSchema {
// MFT record header offset 0x12, uint16.
// Count > 1 means multiple $FILE_NAME attributes (directory entries) point here.
// Anti-forensic technique: hard links to malicious executables in benign locations.
// Source: https://github.com/kacos2000/MFT_Browser
name: "hard_link_count",
value_type: ValueType::UnsignedInt,
description: "Number of $FILE_NAME attributes (uint16 at 0x12); > 1 indicates hard links — each is a separate directory entry",
is_uid_component: false,
},
FieldSchema {
name: "si_created",
value_type: ValueType::Timestamp,
description: "$STANDARD_INFORMATION created time (SI offset +0; spoofable via SetFileTime API — compare with FN timestamp)",
is_uid_component: false,
},
FieldSchema {
name: "si_modified",
value_type: ValueType::Timestamp,
description: "$STANDARD_INFORMATION last-modified time (SI offset +8; spoofable)",
is_uid_component: false,
},
FieldSchema {
name: "si_changed",
value_type: ValueType::Timestamp,
description: "$STANDARD_INFORMATION MFT-record-changed time (SI offset +16; requires raw volume write to forge)",
is_uid_component: false,
},
FieldSchema {
name: "si_accessed",
value_type: ValueType::Timestamp,
description: "$STANDARD_INFORMATION last-accessed time (SI offset +24; often disabled on modern Windows)",
is_uid_component: false,
},
FieldSchema {
// $SI NTFS 3.1 extension at offset +64, 8 bytes.
// Links this record to $UsnJrnl:$J — resolves operation type and flags.
// Source: https://github.com/kacos2000/MFT_Browser
name: "usn",
value_type: ValueType::UnsignedInt,
description: "Update Sequence Number from $STANDARD_INFORMATION offset +64; links MFT record to its $UsnJrnl:$J change entry",
is_uid_component: false,
},
FieldSchema {
name: "fn_created",
value_type: ValueType::Timestamp,
description: "$FILE_NAME created time (FN offset +8); kernel-maintained, requires raw volume write to falsify",
is_uid_component: false,
},
FieldSchema {
name: "fn_modified",
value_type: ValueType::Timestamp,
description: "$FILE_NAME last-modified time (FN offset +16); kernel-maintained",
is_uid_component: false,
},
FieldSchema {
// Completes the 8-timestamp dual-MACE set exposed by MFT_Browser.
// Source: https://github.com/kacos2000/MFT_Browser
name: "fn_changed",
value_type: ValueType::Timestamp,
description: "$FILE_NAME MFT-record-changed time (FN offset +24); kernel-maintained",
is_uid_component: false,
},
FieldSchema {
// Source: https://github.com/kacos2000/MFT_Browser
name: "fn_accessed",
value_type: ValueType::Timestamp,
description: "$FILE_NAME last-accessed time (FN offset +32); kernel-maintained",
is_uid_component: false,
},
FieldSchema {
name: "filename",
value_type: ValueType::Text,
description: "UTF-16LE filename from $FILE_NAME (offset +66); namespace: 0=POSIX, 1=Win32, 2=DOS, 3=Win32&DOS",
is_uid_component: true,
},
FieldSchema {
name: "parent_mft_record",
value_type: ValueType::Integer,
description: "48-bit MFT record number of the parent directory (FN offset +0)",
is_uid_component: false,
},
FieldSchema {
name: "file_size",
value_type: ValueType::Integer,
description: "Logical (real) file size in bytes from $FILE_NAME offset +48",
is_uid_component: false,
},
FieldSchema {
name: "flags",
value_type: ValueType::UnsignedInt,
description: "Allocation status flags (header 0x16): bit 15=In Use, bit 14=Is Directory, bit 13=In $Extend",
is_uid_component: false,
},
FieldSchema {
// Physical size = 1024 or 4096 bytes. Logical = header 0x18.
// Slack = physical - logical. May contain remnants of prior attribute data.
// Source: https://github.com/kacos2000/MFT_Browser
name: "record_slack",
value_type: ValueType::UnsignedInt,
description: "PhysicalSize - LogicalSize (bytes); residual space may contain prior attribute remnants from shrunk metadata",
is_uid_component: false,
},
];
/// NTFS Master File Table — the complete filesystem map and primary
/// timestomping detection source (T1070.006).
///
/// Every file, directory, and metadata object on an NTFS volume has one MFT
/// entry. Each entry contains two timestamp sets: `$STANDARD_INFORMATION` (SI)
/// and `$FILE_NAME` (FN). Timestomping tools (e.g. Meterpreter, SetTimestamp)
/// modify SI timestamps only; FN timestamps require kernel-level access and are
/// rarely touched. A discrepancy between SI and FN timestamps — especially
/// SI timestamps predating the volume creation or FN creation — is a reliable
/// timestomping indicator.
///
/// The $MFT also records $LogFile Sequence Numbers (LSN) in the entry header,
/// providing an independent ordering of file system events that survives most
/// Windows log-clearing operations.
///
/// # Forensic pivot
///
/// - Unallocated entries (flags bit 0 clear) represent recently deleted files;
/// the $MFT retains the filename and timestamps even after the directory
/// entry is removed.
/// - INDX slack in directory entries and MFT slack can recover older filenames.
/// - Pair with `$UsnJrnl` for operation-level sequencing (create → write → close).
pub static MFT: ArtifactDescriptor = ArtifactDescriptor {
id: "mft",
name: "NTFS Master File Table ($MFT)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
// Source: https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table
// $MFT always resides at the beginning of the NTFS volume; accessible via raw disk read.
file_path: Some(r"\\.\<volume>\$MFT"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Complete filesystem map with dual timestamps ($STANDARD_INFORMATION vs $FILE_NAME); primary source for timestomping detection and deleted-file recovery",
mitre_techniques: &[
"T1070.006", // Timestomping — SI vs FN discrepancy
"T1070.004", // File Deletion — unallocated entries remain in $MFT
"T1564.001", // Hidden Files — SYSTEM/HIDDEN file attribute flags
],
fields: MFT_FIELDS,
retention: Some("Entries persist until overwritten; allocated space grows monotonically"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["usnjrnl", "logfile_ntfs", "prefetch_dir"],
sources: &[
// Primary NTFS specification reference
"https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table",
// Timestomping technique + SI vs FN discrepancy
// SANS FOR508 — MFT analysis methodology
"https://www.sans.org/blog/windows-file-system-forensics-ntfs-master-file-table/",
// MFTECmd by Eric Zimmerman — primary parsing tool
"https://github.com/EricZimmerman/MFTECmd",
// MFT forensic overview — 13cubed
"https://www.13cubed.com/downloads/Windows_Forensic_Analysis_Poster.pdf",
// Kazamiya MFT_Forensics.pdf — Japanese academic MFT analysis paper;
// original URL 404 as of 2026-05-04 (www.kazamiya.net down)
"https://web.archive.org/web/20210228/https://www.kazamiya.net/files/MFT_Forensics.pdf",
// kacos2000/MFT_Browser: authoritative field offsets for all NTFS attributes,
// LSN (0x08), hard link count (0x12), record slack, USN in $SI (+64),
// 8-timestamp dual MACE set ($SI + $FN), $Object_ID UUID creation time
"https://github.com/kacos2000/MFT_Browser",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Requires raw disk access or volume shadow copy; locked on live systems",
"SI timestamps are user-spoofable; always compare against FN timestamps",
"Deleted-file entries may be overwritten if MFT fills up",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "$MFT entries persist until overwritten by new allocations; unallocated entries survive long-term",
};
pub(crate) static USNJRNL_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "usn",
value_type: ValueType::Integer,
description: "Update Sequence Number — monotonically increasing journal position",
is_uid_component: true,
},
FieldSchema {
name: "file_reference",
value_type: ValueType::Integer,
description: "48-bit MFT record number + 16-bit sequence of the affected file",
is_uid_component: true,
},
FieldSchema {
name: "parent_reference",
value_type: ValueType::Integer,
description: "MFT reference of the parent directory at the time of the event",
is_uid_component: false,
},
FieldSchema {
name: "timestamp",
value_type: ValueType::Timestamp,
description: "Event timestamp as a 64-bit Windows FILETIME",
is_uid_component: false,
},
FieldSchema {
name: "reason",
value_type: ValueType::UnsignedInt,
description: "USN reason bitmask: FILE_CREATE (0x100), FILE_DELETE (0x200), RENAME_OLD_NAME (0x1000), RENAME_NEW_NAME (0x2000), DATA_OVERWRITE (0x1), CLOSE (0x80000000)",
is_uid_component: false,
},
FieldSchema {
name: "file_attributes",
value_type: ValueType::UnsignedInt,
description: "Win32 file attribute flags at the time of the event",
is_uid_component: false,
},
FieldSchema {
name: "filename",
value_type: ValueType::Text,
description: "Filename (not full path) of the affected file or directory",
is_uid_component: true,
},
];
/// NTFS Update Sequence Number Journal — operation-level file system log (T1070.004).
///
/// The $UsnJrnl records a log entry for every file system operation: creates,
/// deletes, renames, attribute changes, and security changes. The journal is
/// stored in the sparse `$J` alternate data stream of the `$Extend\$UsnJrnl`
/// metadata file; only the tail portion is allocated (sparse head occupies
/// no disk space).
///
/// # Key forensic uses
///
/// - **Deleted files**: FILE_DELETE records appear even after the directory
/// entry is removed and the MFT entry is reallocated. Combined with USN
/// timestamps, this timestamps the deletion accurately.
/// - **Rename chains**: consecutive RENAME_OLD_NAME + RENAME_NEW_NAME records
/// reconstruct the full rename history of a file — commonly used by attackers
/// who rename tools post-use to hide them from Prefetch name-based queries.
/// - **Anti-forensics detection**: absence of expected USN records for a known
/// file activity window (e.g. attacker-cleared the journal) is itself
/// evidence of tampering.
///
/// # Record format
///
/// V2 records are 60 bytes minimum + variable-length filename. V3 records (rare)
/// have a 128-bit file reference instead of 64-bit.
///
/// Source: https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2
pub static USNJRNL: ArtifactDescriptor = ArtifactDescriptor {
id: "usnjrnl",
name: "NTFS USN Change Journal ($UsnJrnl:$J)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
// Source: https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2
// The $J alternate data stream is the journalled portion; $Max contains the max size config.
file_path: Some(r"\\.\<volume>\$Extend\$UsnJrnl:$J"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Operation-level file system log: file creates, deletes, renames, and attribute changes — survives directory-entry deletion and MFT reuse",
mitre_techniques: &[
"T1070.004", // File Deletion — deletion events persist in journal
"T1036.003", // Rename System Utilities — rename chain reconstruction
"T1070.006", // Timestomping — USN timestamps cross-validate SI/FN discrepancy
],
fields: USNJRNL_FIELDS,
retention: Some("Configurable; default ~32 MB rolling window (~days of activity)"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["mft", "logfile_ntfs", "prefetch_dir"],
sources: &[
// USN_RECORD_V2 structure specification
"https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2",
// ATT&CK file deletion technique
// SANS FOR508 — USN Journal forensics
"https://www.sans.org/blog/ntfs-usn-change-journal-forensics/",
// MFTECmd handles $UsnJrnl parsing
"https://github.com/EricZimmerman/MFTECmd",
// Velociraptor USN Journal artifact
"https://docs.velociraptor.app/artifact_references/pages/windows.ntfs.usnjournalscanner/",
// Forensic value of the USN Journal
"https://www.magnetforensics.com/blog/ntfs-usn-change-journal/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Journal is a rolling window (~32 MB default); older entries are overwritten",
"Journal can be cleared by an attacker with sufficient privileges",
"$J alternate data stream requires raw NTFS access — not visible via Win32 APIs",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "$UsnJrnl:$J is a rolling window (~32 MB); oldest records are overwritten as the journal grows",
};
/// NTFS $LogFile — transaction log used for crash recovery (T1070.006).
///
/// Every metadata change on an NTFS volume is first written to `$LogFile`
/// before being committed to the MFT. This makes `$LogFile` a secondary
/// timestamp source — LSNs (Log Sequence Numbers) in MFT entry headers
/// correlate to `$LogFile` records, enabling detection of timestamp injection
/// that didn't update the LSN chain.
///
/// `$LogFile` is typically 64 MB. It wraps around; in practice only a few
/// hours of very recent metadata operations are recoverable.
pub static LOGFILE_NTFS: ArtifactDescriptor = ArtifactDescriptor {
id: "logfile_ntfs",
name: "NTFS Transaction Log ($LogFile)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
// Source: https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview
file_path: Some(r"\\.\<volume>\$LogFile"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "NTFS transaction log with LSNs that cross-validate MFT timestamps; recent metadata operations only",
mitre_techniques: &[
"T1070.006", // Timestomping — LSN chain verification
],
fields: &[
FieldSchema {
name: "lsn",
value_type: ValueType::Integer,
description: "Log Sequence Number — monotonically increasing within the volume",
is_uid_component: true,
},
FieldSchema {
name: "record_type",
value_type: ValueType::Text,
description: "NTFS log record type (UPDATE, CHECKPOINT, etc.)",
is_uid_component: false,
},
],
retention: Some("~64 MB rolling window; typically hours of recent activity"),
triage_priority: TriagePriority::High,
related_artifacts: &["mft", "usnjrnl"],
sources: &[
"https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview",
// NTFS Log Tracker — Eric Zimmerman
"https://github.com/EricZimmerman/NTFSLogTracker",
// $LogFile forensics reference
"https://www.sans.org/blog/the-key-to-ntfs-forensics-the-logfile/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"~64 MB rolling window; typically only hours of recent metadata operations",
"Primarily useful for cross-validating MFT LSN chains to detect timestamp injection",
"Requires specialised NTFS log parser (e.g. NTFSLogTracker)",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "$LogFile is ~64 MB; wraps on high-activity systems within hours",
};
/// Windows Prefetch files directory — execution evidence (T1204.002).
///
/// Each `.pf` file records: executable name, run count, last 8 run timestamps,
/// and volume/file references. Requires Prefetch service enabled.
pub static PREFETCH_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "prefetch_dir",
name: "Prefetch Files Directory",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\Prefetch"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Binary .pf files recording 30-day program execution history with timestamps",
mitre_techniques: &["T1204.002"],
fields: DIR_ENTRY_FIELDS,
retention: Some("128 entries; oldest evicted"),
triage_priority: TriagePriority::High,
related_artifacts: &["shimcache", "amcache_app_file", "bam_user"],
sources: &[
"https://www.sans.org/blog/computer-forensic-artifacts-windows-7-prefetch-files/",
"https://13cubed.com/downloads/Windows_Forensic_Analysis_Poster.pdf",
"https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/application-verifier",
"https://isc.sans.edu/diary/Forensic+Value+of+Prefetch/29168",
"https://www.magnetforensics.com/blog/forensic-analysis-of-prefetch-files-in-windows/",
"https://github.com/EricZimmerman/PECmd",
"https://github.com/EricZimmerman/Prefetch",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static SRUM_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_name",
value_type: ValueType::Text,
description: "Application executable path or service name",
is_uid_component: true,
},
FieldSchema {
name: "user_sid",
value_type: ValueType::Text,
description: "SID of the user who ran the application",
is_uid_component: false,
},
];
/// System Resource Usage Monitor database — rich execution timeline (Win8+).
///
/// ESE (JET Blue) database at `C:\Windows\System32\sru\SRUDB.dat`. Key tables:
/// `{D10CA2FE-...}` = Application Resource Usage (network, CPU per app),
/// `{973F5D5C-...}` = Network Data Usage, `{5C8CF1C7-...}` = App Timeline Provider.
/// Retains ~30-60 days of history overall (the App Timeline table only ~7 days).
pub static SRUM_DB: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_db",
name: "SRUM Database (SRUDB.dat)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat"),
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning:
"Per-app CPU, network, and energy usage records; execution timeline survives log clearing",
mitre_techniques: &["T1204.002"],
fields: SRUM_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &[
"https://www.sans.org/white-papers/36660/",
"https://www.sans.org/blog/srum-forensics/",
"https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
"https://github.com/MarkBaggett/srum-dump",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Requires ESE database parsing; data is aggregated over time windows",
"App paths may be partial; correlate with other execution artifacts",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "SRUM ESE database; records rolled up and purged periodically",
};
/// ActivitiesCache.db field schema — derived from kacos2000/WindowsTimeline analysis.
///
/// `payload_json` is a type-specific JSON blob:
/// - Activity_Type 5 (AppInFocus): `{"appDisplayName": "...", "displayText": "..."}`
/// - Activity_Type 16 (CopyPaste): clipboard text — credential exfiltration indicator
/// - Activity_Type 6 (AppLifecycle): launch/exit events
pub(crate) static WINDOWS_TIMELINE_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "activity_type",
value_type: ValueType::Integer,
description: "5=AppInFocus, 6=AppLifecycle, 11=UserActivity, 12=Notification, 16=CopyPaste",
is_uid_component: true,
},
FieldSchema {
name: "start_time",
value_type: ValueType::Timestamp,
description: "Unix epoch start time of the activity",
is_uid_component: false,
},
FieldSchema {
name: "end_time",
value_type: ValueType::Timestamp,
description: "Unix epoch end time; duration = end_time - start_time gives focus duration",
is_uid_component: false,
},
FieldSchema {
name: "payload_json",
value_type: ValueType::Json,
description: "Type-specific JSON payload; type 16 contains clipboard text",
is_uid_component: false,
},
FieldSchema {
name: "platform_device_id",
value_type: ValueType::Guid,
description: "Device GUID; resolve to name via DeviceCache registry",
is_uid_component: false,
},
FieldSchema {
name: "is_local_only",
value_type: ValueType::Integer,
description:
"1 = not synced to cloud; 0 = was eligible for cross-device sync (pre-July 2021)",
is_uid_component: false,
},
];
/// Windows Timeline / Activities Cache — cross-device activity history (Win10+).
///
/// SQLite database per user+device at:
/// `C:\Users\*\AppData\Local\ConnectedDevicesPlatform\*\ActivitiesCache.db`.
/// Three tables: Activities (focus/clipboard events), ActivityOperation (pending sync),
/// Activity_PackageID (app identity). Cloud sync disabled July 2021 for MSA accounts;
/// local database persists. db-wal carving recovers deleted clipboard entries.
///
/// `platform_device_id` is a GUID — resolve to human name via DeviceCache registry:
/// `HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*\Current\Data`
pub static WINDOWS_TIMELINE: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_timeline",
name: "Windows Timeline (ActivitiesCache.db)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\ConnectedDevicesPlatform\*\ActivitiesCache.db"),
scope: DataScope::User,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "App focus, lifecycle, and clipboard events with per-device attribution. \
Activity_Type 16 (CopyPaste) entries capture clipboard text — primary indicator \
for credential staging and data exfiltration. platform_device_id GUID resolves \
to device name via DeviceCache registry. Cloud sync disabled July 2021; \
db-wal carving recovers deleted clipboard entries.",
mitre_techniques: &["T1059", "T1204.002", "T1115"],
fields: WINDOWS_TIMELINE_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["windows_timeline_devicecache"],
sources: &[
"https://kacos2000.github.io/WindowsTimeline/WindowsTimeline.pdf",
"https://github.com/kacos2000/WindowsTimeline",
"https://www.sans.org/blog/windows-10-timeline-forensic-artifacts/",
"https://aboutdfir.com/windows-10-timeline/",
"http://windowsir.blogspot.com/2019/11/activitescachedb-vs-ntuserdat.html",
"https://github.com/EricZimmerman/WxTCmd",
// Microsoft — Windows activity history & your privacy (Win11 local-storage statement):
"https://support.microsoft.com/en-us/windows/windows-activity-history-and-your-privacy-2b279964-44ec-8c2f-e0c2-6779b07d2cbd",
// Microsoft — Get help with Timeline (Timeline retired in Win11, remains on Win10; 2021 MSA-sync deprecation):
"https://support.microsoft.com/en-us/windows/get-help-with-timeline-febc28db-034c-d2b0-3bbe-79adc0f7f513",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Windows 11 retired the Timeline user experience (Task View no longer shows activity history); it remains only on Windows 10. Local activity history is still stored on-device when the Activity History setting is enabled, so ActivitiesCache.db can still exist on Windows 11 — its absence from Task View is a UI change, not deletion (Microsoft: activity-history privacy page)",
"Cross-device sync history: local upload to a Microsoft account was deprecated in 2021 (the July-2021 month is per kacos2000's WindowsTimeline research; Microsoft documents only the year), and the send-to-Microsoft toggle was removed entirely on 23 Jan 2024 (KB5034204 for Win11 22H2/23H2, KB5034203 for Win10 22H2)",
"Forensic bottom line — NOT exculpatory: on Windows 11 the on-device ActivitiesCache.db is commonly sparse, with rich application/file-execution history no longer populated; surviving entries are typically clipboard (ActivityType 10 = clipboard text present; ActivityType 16 = copy-vs-paste indicator) plus minimal system activity. A sparse or missing ActivitiesCache.db on Windows 11 is the expected, documented consequence of the Timeline deprecation — it does NOT indicate anti-forensic deletion or that the user was inactive. Check ActivitiesCache.db-wal for buffered/deleted entries. (The clipboard-only population pattern is a DFIR-community observation — inversecos, Cellebrite — not vendor-documented; treat as observed, not proven)",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "On-disk SQLite updated as the user works; entries persist (with a -wal buffer) until pruned or the DB is cleared",
};
/// Windows Timeline DeviceCache registry — resolves PlatformDeviceId GUIDs to names.
///
/// Registry path:
/// `HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*\Current\Data`
/// Each subkey GUID corresponds to a device that contributed Timeline activities.
/// Without this key, `platform_device_id` in ActivitiesCache.db is an opaque GUID.
pub static WINDOWS_TIMELINE_DEVICECACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_timeline_devicecache",
name: "Windows Timeline DeviceCache Registry",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*\Current",
value_name: Some("Data"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "Maps platform_device_id GUIDs (ActivitiesCache.db Activities.PlatformDeviceId) \
to human-readable device names. Required to determine whether timeline activities \
originated on the examined device or were synced from another.",
mitre_techniques: &["T1059"],
fields: &[
FieldSchema {
name: "device_guid",
value_type: ValueType::Guid,
description: "Device GUID matching Activities.PlatformDeviceId",
is_uid_component: true,
},
FieldSchema {
name: "device_name",
value_type: ValueType::Text,
description: "Human-readable device display name",
is_uid_component: false,
},
],
retention: None,
triage_priority: TriagePriority::Low,
related_artifacts: &["windows_timeline"],
sources: &[
"https://kacos2000.github.io/WindowsTimeline/WindowsTimeline.pdf",
"https://github.com/kacos2000/WindowsTimeline",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Windows Search index (SQLite) — Win11 22H2+ migration from Windows.edb.
///
/// SQLite3 at:
/// `C:\ProgramData\Microsoft\Search\Data\Applications\Windows\windows.db`
///
/// Note the path change: `Windows Search` → `Search`, `Windows.edb` → `windows.db`.
/// The migration is silent and automatic on Win11 22H2+. Analysts must check
/// for both files on Windows 11 systems.
pub static WINDOWS_SEARCH_DB_WIN11: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_search_db_win11",
name: "Windows Search Index SQLite (windows.db, Win11 22H2+)",
artifact_type: ArtifactLocation::DatabaseEntry,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Search\Data\Applications\Windows\windows.db"),
scope: DataScope::System,
os_scope: OsScope::Win11_22H2,
decoder: Decoder::Identity,
meaning: "Win11 22H2+ replacement for Windows.edb. Same forensic value — gather_time \
independent of NTFS timestamps — but SQLite3. The index is SPLIT across THREE co-resident \
SQLite files in C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\: windows.db \
(property store — SystemIndex_1_PropertyStore, one row per property, WorkId join key), \
Windows-gather.db (the gatherer DB, HIGHEST value — SystemIndex_Gthr holds FileName, \
LastModified/GatherTime, ScopeID, DocumentID; SystemIndex_GthrPth + ScopeID reconstructs the \
full path; WorkId in windows.db maps to DocumentID here), and Windows-usn.db (little/no \
forensic value). Collect ALL THREE — the filename/path/gather-time evidence lives in \
Windows-gather.db, NOT windows.db, so grabbing only windows.db loses it.",
mitre_techniques: &["T1070.004", "T1070.006"],
fields: &[
FieldSchema {
name: "file_path",
value_type: ValueType::Text,
description: "Indexed file or folder path — reconstructed from Windows-gather.db SystemIndex_Gthr.FileName joined with SystemIndex_GthrPth via ScopeID (NOT windows.db)",
is_uid_component: true,
},
FieldSchema {
name: "gather_time",
value_type: ValueType::Timestamp,
description: "Last indexed time (SIDR: System_Search_GatherTime) from Windows-gather.db SystemIndex_Gthr.LastModified — independent of NTFS timestamps",
is_uid_component: false,
},
FieldSchema {
name: "document_id",
value_type: ValueType::UnsignedInt,
description: "Per-object UID (SystemIndex_Gthr.DocumentID); joins to WorkId in windows.db's SystemIndex_1_PropertyStore",
is_uid_component: true,
},
FieldSchema {
name: "scope_id",
value_type: ValueType::UnsignedInt,
description: "Parent-scope link (SystemIndex_Gthr.ScopeID) used with SystemIndex_GthrPth to reconstruct the full path",
is_uid_component: false,
},
],
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["windows_search_edb", "mft", "usnjrnl"],
sources: &[
"https://github.com/kacos2000/WinEDB",
// AON / Trustwave-SpiderLabs RE: the three co-resident files + table/column layout:
"https://www.levelblue.com/blogs/spiderlabs-blog/windows-search-index-the-forensic-artifact-youve-been-searching-for/",
// Securelist/Kaspersky RE: corroborates the three-file split + SystemIndex_Gthr columns:
"https://securelist.com/forensic-artifacts-in-windows-11/117680/",
// SIDR (Stroz Friedberg) — parses windows.db SQLite, surfaces System_Search_GatherTime:
"https://github.com/strozfriedberg/sidr",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Win11 Search splits across THREE co-resident SQLite files (windows.db, Windows-gather.db, Windows-usn.db) in the same Applications\\Windows dir; collect all three — filename/path/gather-time evidence is in Windows-gather.db, not windows.db",
"Windows-usn.db has little forensic value and is excluded from most write-ups; collect for completeness, analyse gather.db + windows.db",
"gather_time is a present-on-system / last-indexed indicator independent of NTFS timestamps — consistent with a file having been present and indexed, not proof of a specific access",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "On-disk SQLite index files; persist until the index is rebuilt or the files are deleted",
};
/// PowerShell PSReadLine command history (T1059.001).
///
/// Plain-text file; contains full command history including sensitive strings,
/// filenames, and lateral movement commands typed interactively.
pub static POWERSHELL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
id: "powershell_history",
name: "PowerShell PSReadLine History",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(
r"C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt",
),
scope: DataScope::User,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "Line-by-line PowerShell interactive command history; attackers often clear this",
mitre_techniques: &["T1059.001", "T1552"],
fields: FILE_PATH_FIELDS,
retention: Some("4096 commands; oldest evicted when limit reached"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/powershell-forensics/",
"https://redcanary.com/threat-detection-report/techniques/t1059.001/",
"https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// $I file binary schema — Vista+ format.
///
/// Offsets documented in https://github.com/akhil-dara/RecycleBin-Forensic-Explorer
/// (parse_dollar_i_file function). Version 1 = Vista/7/8/8.1; Version 2 = Win10/11.
/// Path offset differs between versions (24 vs 28); all other fields are identical.
pub const RECYCLE_BIN_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "version",
value_type: ValueType::UnsignedInt,
description: "uint64 at offset 0: 1=Vista/7/8/8.1 (path@24), 2=Win10/11 (path@28); \
selects correct UTF-16LE path offset",
is_uid_component: false,
},
FieldSchema {
name: "original_size",
value_type: ValueType::UnsignedInt,
description: "uint64 at offset 8: size of deleted file in bytes; \
zero if file was a directory",
is_uid_component: false,
},
FieldSchema {
name: "deletion_time",
value_type: ValueType::Timestamp,
description: "FILETIME (100-ns intervals since 1601-01-01) at offset 16: \
moment the file was moved to Recycle.Bin — not secure-delete time; \
convert: (filetime - 116444736000000000) / 10000000 = Unix epoch",
is_uid_component: false,
},
FieldSchema {
name: "original_path",
value_type: ValueType::Text,
description: "UTF-16LE null-terminated string starting at offset 24 (v1) or 28 (v2): \
full pre-deletion Windows path (e.g. C:\\Users\\alice\\Documents\\creds.xlsx); \
survives Recycle.Bin emptying if $I file is not overwritten",
is_uid_component: true,
},
FieldSchema {
name: "sid",
value_type: ValueType::Text,
description: "Security Identifier from parent directory name, format S-1-5-21-…-{RID}; \
identifies which user deleted the file; pivot to SAM hive \
(HKLM\\SAM\\SAM\\Domains\\Account\\Users) for username resolution",
is_uid_component: true,
},
FieldSchema {
name: "i_filename",
value_type: ValueType::Text,
description: "$I{hex} — the metadata filename; hex suffix links to matching $R{hex} \
content file; suffix is random but consistent within the pair",
is_uid_component: true,
},
FieldSchema {
name: "r_file_exists",
value_type: ValueType::Bool,
description: "bool: whether $R{hex} content file is present; False = file permanently \
deleted or Bin emptied — but $I metadata still recoverable; \
analysts can reconstruct deletion evidence from $I alone",
is_uid_component: false,
},
FieldSchema {
name: "mft_addr",
value_type: ValueType::UnsignedInt,
description: "NTFS MFT record address (meta.addr via pytsk3) of the $I file itself; \
pivot to $MFT for additional timeline anchors independent of $I timestamps",
is_uid_component: false,
},
];
/// Recycle Bin ($I metadata files) — deletion evidence.
///
/// `$I{RAND}` files in `C:\$Recycle.Bin\{SID}\` contain a 24-byte (v1) or 28-byte (v2)
/// binary header encoding the deleted file's original path, size, and deletion timestamp
/// in FILETIME format.
///
/// ## Why High triage priority
///
/// $I files survive Recycle.Bin emptying until NTFS overwrites the MFT entry. Even
/// an empty Recycle.Bin may contain $I remnants. The deletion_time field reveals
/// *when* an adversary tried to destroy evidence; original_path reveals *what*.
///
/// ## Version semantics
///
/// - Version 1 (Vista/7/8/8.1): path starts at byte offset 24
/// - Version 2 (Win10/11): path starts at byte offset 28 (4-byte path-length prefix added)
///
/// ## User attribution
///
/// Each SID subdirectory corresponds to one user. Pivot SID → SAM hive for username.
/// Domain-joined machines: SID → AD for domain user resolution.
pub static RECYCLE_BIN: ArtifactDescriptor = ArtifactDescriptor {
id: "recycle_bin",
name: "Recycle Bin ($I Metadata)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
// SID-keyed subdirectories: C:\$Recycle.Bin\{SID}\$I{hex} (metadata)
// C:\$Recycle.Bin\{SID}\$R{hex} (content)
file_path: Some(r"C:\$Recycle.Bin\{SID}\$I*"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "$I files reveal original path and deletion timestamp even after Recycle Bin is \
emptied; version field selects correct path offset (24 vs 28); SID directory \
links deletion to a specific user account (pivot to SAM hive for username); \
$R absence means content is unrecoverable but $I metadata always survives until \
MFT slot is reused",
mitre_techniques: &[
"T1070.004", // Indicator Removal: File Deletion — adversary sent to Bin to cover tracks
"T1083", // File and Directory Discovery — reveals original file system layout
"T1078.003", // Valid Accounts: Local Accounts — SID attribution to local user
],
fields: RECYCLE_BIN_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["sam_users", "mft_file", "usnjrnl", "lnk_files"],
sources: &[
"https://www.sans.org/blog/digital-forensics-recycle-bin-forensics/",
"https://windowsir.blogspot.com/2010/02/more-on-recycle-bin.html",
"https://www.magnetforensics.com/blog/artifact-profile-recycle-bin/",
"https://andreafortuna.org/2019/09/26/windows-forensics-analysis-of-recycle-bin-artifacts/",
"https://github.com/EricZimmerman/RBCmd",
"https://github.com/akhil-dara/RecycleBin-Forensic-Explorer",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["File name and deletion time available; original content may be overwritten"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Deleted on permanent delete; survives recycle until purge",
};
/// Windows Explorer Thumbnail Cache — file-access and image evidence.
///
/// Proprietary binary format; contains thumbnails for files browsed via
/// Explorer, including since-deleted images/documents.
pub static THUMBCACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "thumbcache",
name: "Explorer Thumbnail Cache",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Windows\Explorer"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Cached thumbnails including deleted files; proves files were viewed via Explorer",
mitre_techniques: &["T1083"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["thumbs_db"],
sources: &[
"https://www.sans.org/blog/thumbnail-cache-forensics/",
"https://www.nirsoft.net/utils/thumbcache_viewer.html",
"https://www.pentestpartners.com/security-blog/thumbnail-forensics-dfir-techniques-for-analysing-windows-thumbcache/",
"https://thumbcacheviewer.github.io/",
"https://forensics.wiki/windows_thumbcache/",
// Joachim Metz / libyal — byte-level RE spec (24-byte header, per-version cache-type ordinal map):
"https://github.com/libyal/libwtcdb/blob/main/documentation/Windows%20Explorer%20Thumbnail%20Cache%20database%20format.asciidoc",
],
evidence_strength: None,
evidence_caveats: &[
"The number in thumbcache_<N>.db is the maximum thumbnail EDGE length in pixels. The bucket set is VERSION-DEPENDENT and the cache-type ordinal->filename mapping is REDEFINED (not merely extended) per format version — read the 4-byte 'Cache type' field at header offset 8 first: v20/v21 (Vista/7) = 32/96/256/1024x768/sr; v30 (Win8) adds 16/48/wide/exif; v31 (Win8.1) adds 1600/wide_alternate; v32 (Win10/11) = 16/32/48/96/256/768/1280/1920/2560/sr/wide/exif/wide_alternate/custom_stream. The same ordinal names different files across versions (e.g. value 5 = 1024 in v30/31 but 768 in v32), so the version must be resolved before mapping. The 1280/1920/2560 buckets correspond to the pixel WIDTHS of 720p/1080p/1440p displays (a mnemonic; the spec gives explicit dimensions only for 32x32/96x96/256x256/1024x768)",
"Empty-vs-populated tell: an initialized-but-empty thumbcache_<N>.db is exactly the 24-byte 'CMMM' file header (signature @0, format version @4, cache type @8, first-cache-entry offset @12, first-available offset @16, entry count @20); a bucket much larger than 24 bytes holds actual cached thumbnails. Treat file size as 'larger than the 24-byte header', not a hard tens-of-MB threshold (a few small thumbnails are only a few KB)",
],
volatility: None,
volatility_rationale: "",
};
/// Windows Search database — indexed file/content search history.
///
/// ESE/JET database at the system level recording filenames, content excerpts,
/// and metadata for all indexed items. Survives file deletion.
pub static SEARCH_DB_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "search_db_user",
name: "Windows Search Database (Windows.db)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning:
"ESE database of indexed file metadata; reveals filenames and content even after deletion",
mitre_techniques: &["T1083"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/windows-search-index-forensics/",
"https://learn.microsoft.com/en-us/windows/win32/search/windows-search",
"https://cyber.aon.com/aon_cyber_labs/windows-search-index-the-forensic-artifact-youve-been-searching-for/",
"https://github.com/EricZimmerman/SQLECmd",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Windows credential artifacts ──────────────────────────────────────────
pub(crate) static DPAPI_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "guid",
value_type: ValueType::Text,
description: "GUID filename of the DPAPI master key or credential blob",
is_uid_component: true,
}];
/// DPAPI User Master Keys — key material protecting all user-encrypted data.
///
/// Each file is named by a GUID; the content is the DPAPI master key encrypted
/// with the user's password hash. Decrypting unlocks all DPAPI-protected secrets.
pub static DPAPI_MASTERKEY_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "dpapi_masterkey_user",
name: "DPAPI User Master Keys",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Roaming\Microsoft\Protect\*"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Master keys protecting all DPAPI-encrypted user secrets (credentials, browser passwords, WiFi PSKs)",
mitre_techniques: &["T1555.004"],
fields: DPAPI_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["dpapi_cred_user", "dpapi_credhist", "chrome_login_data"],
sources: &[
"https://www.sans.org/blog/dpapi-forensics-credentials-stored-in-windows/",
"https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
"https://www.sygnia.co/blog/the-downfall-of-dpapis-top-secret-weapon/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &["Presence expected for every user; useful for decrypting other artifacts"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Master keys persist; old keys backed up in AD",
};
/// DPAPI Credential Blobs (Local) — encrypted credential store entries.
///
/// GUID-named binary files; each contains a DPAPI-encrypted credential blob
/// protecting a username/password pair for a network resource or application.
pub static DPAPI_CRED_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "dpapi_cred_user",
name: "DPAPI Credential Blobs (Local)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Credentials"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning:
"DPAPI-encrypted credential blobs for network resources; decryptable with DPAPI master key",
mitre_techniques: &["T1555.004"],
fields: DPAPI_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["dpapi_masterkey_user", "windows_vault_user"],
sources: &[
"https://www.sans.org/blog/dpapi-forensics-credentials-stored-in-windows/",
"https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
"https://www.sygnia.co/blog/the-downfall-of-dpapis-top-secret-weapon/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &["Encrypted credential blobs; useful with DPAPI master key decryption"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Encrypted credential blobs; persist until explicit deletion",
};
/// DPAPI Credential Blobs (Roaming) — roaming profile credential store.
pub static DPAPI_CRED_ROAMING: ArtifactDescriptor = ArtifactDescriptor {
id: "dpapi_cred_roaming",
name: "DPAPI Credential Blobs (Roaming)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Roaming\Microsoft\Credentials"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning:
"Roaming DPAPI credential blobs; same structure as Local, synced across domain machines",
mitre_techniques: &["T1555.004"],
fields: DPAPI_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/dpapi-forensics-credentials-stored-in-windows/",
"https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static VAULT_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "policy_file",
value_type: ValueType::Text,
description: ".vpol policy file containing encryption key material",
is_uid_component: false,
},
FieldSchema {
name: "vcrd_file",
value_type: ValueType::Text,
description: ".vcrd credential file containing the encrypted credential",
is_uid_component: true,
},
];
/// Windows Vault (User) — Windows Credential Manager per-user vault.
///
/// `.vpol` file stores encrypted vault key; `.vcrd` files store individual
/// credentials. Credential Manager UI entries live here.
pub static WINDOWS_VAULT_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_vault_user",
name: "Windows Vault (User)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Vault"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Per-user Credential Manager vault (.vpol + .vcrd); contains WEB and WINDOWS saved credentials",
mitre_techniques: &["T1555.004"],
fields: VAULT_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-manager",
"https://blog.digital-forensics.it/2016/01/windows-revaulting.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Windows Vault (System) — system-wide Windows Credential Manager vault.
pub static WINDOWS_VAULT_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_vault_system",
name: "Windows Vault (System)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Vault"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "System-level Windows Credential Manager vault; contains machine-scoped credentials",
mitre_techniques: &["T1555.004"],
fields: VAULT_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-manager",
"https://blog.digital-forensics.it/2016/01/windows-revaulting.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static RDP_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "username_hint",
value_type: ValueType::Text,
description: "Last username used to connect to this RDP server",
is_uid_component: false,
}];
/// RDP Saved Server Connections — lateral movement evidence (T1021.001).
///
/// Each sub-key is a hostname/IP; the `UsernameHint` value shows the username
/// used for that connection. Evidence of RDP-based lateral movement.
pub static RDP_CLIENT_SERVERS: ArtifactDescriptor = ArtifactDescriptor {
id: "rdp_client_servers",
name: "RDP Client Saved Servers",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Terminal Server Client\Servers",
value_name: Some("UsernameHint"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning:
"Hostnames and usernames of previously-connected RDP servers; lateral movement evidence",
mitre_techniques: &["T1021.001"],
fields: RDP_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/windows-rdp-forensics/",
"https://forensafe.com/blogs/rdc.html",
"https://www.magnetforensics.com/blog/rdp-artifacts-in-incident-response/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Proves RDP was initiated FROM this machine; does not confirm success"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "MRU; rotated when max entries exceeded",
};
pub(crate) static RDP_MRU_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "server",
value_type: ValueType::Text,
description: "RDP server address from the most-recently-used list",
is_uid_component: true,
}];
/// RDP Client Default MRU — ordered list of recently connected RDP servers.
pub static RDP_CLIENT_DEFAULT: ArtifactDescriptor = ArtifactDescriptor {
id: "rdp_client_default",
name: "RDP Client Default MRU",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Terminal Server Client\Default",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning:
"MRU0-MRU9 ordered list of RDP server addresses; confirms specific hosts were targeted",
mitre_techniques: &["T1021.001"],
fields: RDP_MRU_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/windows-rdp-forensics/",
"https://forensafe.com/blogs/rdc.html",
"https://www.magnetforensics.com/blog/rdp-artifacts-in-incident-response/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static NTDS_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "path",
value_type: ValueType::Text,
description: "Full path to the NTDS.dit file",
is_uid_component: true,
}];
/// NTDS.dit — Active Directory database (DC only) (T1003.003).
///
/// Contains all domain user account hashes. Extracting and cracking these
/// grants access to every domain account. Requires VSS or offline access.
pub static NTDS_DIT: ArtifactDescriptor = ArtifactDescriptor {
id: "ntds_dit",
name: "Active Directory Database (NTDS.dit)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\NTDS\NTDS.dit"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Domain controller AD database; contains NTLM hashes for all domain accounts. A \
ntdsutil \"ac i ntds\" \"ifm\" \"create full <path>\" dump leaves a portable copy at an ad-hoc path: the \
target folder holds two sibling subdirs — Active Directory\\ (ntds.dit + ntds.jfm ESE flush map) and \
registry\\ (SYSTEM + SECURITY hives) — i.e. everything offline secretsdump needs, since the SYSTEM hive \
carries the BootKey/SYSKEY that decrypts the .dit.",
mitre_techniques: &["T1003.003"],
fields: NTDS_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["evtx_application", "shimcache"],
sources: &[
"https://www.sans.org/blog/protecting-ad-from-credential-theft/",
// MS ifm reference — media stored in an 'Active Directory' subfolder; full AD DS media includes the registry:
"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732530(v=ws.11)",
// MS — ESENT event source (Application-log 216/325/326/327 accompany the dump):
"https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/esent-event-327-326",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"All domain hashes present; requires parsing with secretsdump or ntdsutil",
"ntdsutil IFM dump footprint: an ad-hoc target folder with sibling Active Directory\\ (ntds.dit + ntds.jfm flush map) and registry\\ (SYSTEM + SECURITY) subdirs — per the MS IFM doc the media is stored in an 'Active Directory' subfolder and full AD DS media 'includes the registry'. A ntds.dit found anywhere other than the default %SystemRoot%\\NTDS\\ is strong evidence of extraction; the non-default PATH (not the accompanying ESENT event alone) is the discriminator",
"The Application-log ESENT events 216/325/326/327 (216=location change, 325=new DB, 326/327=database attach/detach) accompany a dump but also fire during legitimate VSS backups — corroborate the 325 destination path, not the event's mere presence",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "AD database; persists until account deleted",
};
pub(crate) static BROWSER_CRED_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "origin_url",
value_type: ValueType::Text,
description: "URL the credential is associated with",
is_uid_component: true,
},
FieldSchema {
name: "username_value",
value_type: ValueType::Text,
description: "Saved username",
is_uid_component: false,
},
];
/// Chrome/Edge Login Data — SQLite database of saved browser passwords (T1555.003).
pub static CHROME_LOGIN_DATA: ArtifactDescriptor = ArtifactDescriptor {
id: "chrome_login_data",
name: "Chrome/Edge Login Data (SQLite)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "SQLite DB with DPAPI-encrypted passwords for saved Chrome/Edge credentials",
mitre_techniques: &["T1555.003"],
fields: BROWSER_CRED_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["chrome_cookies", "dpapi_masterkey_user"],
sources: &[
"https://redcanary.com/threat-detection-report/techniques/t1555/",
"https://atropos4n6.com/windows/chrome-login-data-forensics/",
"https://www.foxtonforensics.com/blog/post/analysing-chrome-login-data",
"https://github.com/EricZimmerman/SQLECmd",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Credentials encrypted with DPAPI; require user masterkey to decrypt",
"May contain stale or user-deleted passwords",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "SQLite DB; credentials persist until deleted from browser",
};
pub(crate) static FIREFOX_CRED_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "hostname",
value_type: ValueType::Text,
description: "Hostname the Firefox credential is associated with",
is_uid_component: true,
}];
/// Firefox logins.json — JSON credential store (T1555.003).
///
/// NSS3-encrypted credentials; decryptable with `key4.db` and user's Firefox password.
pub static FIREFOX_LOGINS: ArtifactDescriptor = ArtifactDescriptor {
id: "firefox_logins",
name: "Firefox logins.json",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\logins.json"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning:
"NSS3-encrypted Firefox saved credentials; decryptable with key4.db and master password",
mitre_techniques: &["T1555.003"],
fields: FIREFOX_CRED_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &[
"https://redcanary.com/threat-detection-report/techniques/t1555/",
"https://atropos4n6.com/windows/chrome-login-data-forensics/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Encrypted with Firefox key4.db; requires key extraction for plaintext",
"Primary password (master password) prevents access if set",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "JSON file; credentials persist until deleted from browser",
};
pub(crate) static WIFI_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "ssid",
value_type: ValueType::Text,
description: "WiFi network SSID (network name)",
is_uid_component: true,
},
FieldSchema {
name: "key_material",
value_type: ValueType::Text,
description: "Pre-shared key or 802.1X EAP credentials (may be DPAPI-encrypted)",
is_uid_component: false,
},
];
/// Wireless Network Profiles — contains PSKs for previously joined networks (T1552.001).
///
/// XML files; `<keyMaterial>` field may contain the plaintext PSK or a
/// DPAPI-encrypted blob depending on profile type.
pub static WIFI_PROFILES: ArtifactDescriptor = ArtifactDescriptor {
id: "wifi_profiles",
name: "Wireless Network Profiles (WLAN)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "XML profiles for previously joined WiFi networks; may contain plaintext PSKs",
mitre_techniques: &["T1552.001"],
fields: WIFI_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/wireless-forensics/",
"https://forensafe.com/blogs/winwirelessnetworks.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &["Network profile history shows locations visited; useful for timeline and geographic profiling"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "WiFi profiles persist in registry until deleted",
};
// ═══════════════════════════════════════════════════════════════════════════
// Batch D — Linux persistence / execution / credential artifacts
// ═══════════════════════════════════════════════════════════════════════════
// ── Shared Linux field schemas ────────────────────────────────────────────
/// Cron / script line — single scheduled command or shell line.
pub(crate) static CRON_LINE_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "schedule_line",
value_type: ValueType::Text,
description: "Cron schedule expression and command, or shell script line",
is_uid_component: false,
}];
/// SSH public key entry.
pub(crate) static SSH_KEY_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "public_key",
value_type: ValueType::Text,
description: "SSH public key entry (key-type base64 comment)",
is_uid_component: true,
}];
/// Linux account entry (colon-delimited fields).
pub(crate) static ACCOUNT_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "username",
value_type: ValueType::Text,
description: "Account username",
is_uid_component: true,
},
FieldSchema {
name: "uid",
value_type: ValueType::UnsignedInt,
description: "Numeric user ID (0 = root)",
is_uid_component: false,
},
];
/// Log line / journal entry.
pub(crate) static LOG_LINE_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "log_line",
value_type: ValueType::Text,
description: "Log line or structured journal entry",
is_uid_component: false,
}];
// ── Linux persistence: cron ───────────────────────────────────────────────
/// System-wide crontab at `/etc/crontab` (T1053.003).
///
/// Format: `minute hour dom month dow user command`. Field `user` distinguishes
/// this from per-user crontabs. Any non-root `user` with unusual commands is suspicious.
pub static LINUX_CRONTAB_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_crontab_system",
name: "System Crontab (/etc/crontab)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/crontab"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "System-wide scheduled job definitions; user field allows cross-account execution",
mitre_techniques: &["T1053.003"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://linux.die.net/man/5/crontab",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Drop-in cron jobs directory `/etc/cron.d/` (T1053.003).
///
/// Files here follow the same format as `/etc/crontab` (with user field).
/// Attackers drop files here for system-level persistence without editing crontab.
pub static LINUX_CRON_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_cron_d",
name: "Cron Drop-in Directory (/etc/cron.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/cron.d"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Drop-in cron files with full crontab format; easy to add without touching crontab",
mitre_techniques: &["T1053.003"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Periodic cron directories (daily/hourly/weekly/monthly) (T1053.003).
///
/// Scripts placed here are executed by run-parts at the named interval.
/// No schedule expression needed — just a plain executable script.
pub static LINUX_CRON_PERIODIC: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_cron_periodic",
name: "Cron Periodic Directories (/etc/cron.{daily,hourly,weekly,monthly}/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/cron.daily"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Shell scripts executed periodically by crond/anacron; no schedule syntax required",
mitre_techniques: &["T1053.003"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Per-user crontab spool at `/var/spool/cron/crontabs/{user}` (T1053.003).
///
/// Each file is owned by and runs commands as the named user.
/// `crontab -e` edits this file. Direct edits by root are possible.
pub static LINUX_USER_CRONTAB: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_user_crontab",
name: "Per-User Crontab Spool",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/spool/cron/crontabs/*"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Per-user scheduled jobs; attacker can set up recurring execution without admin",
mitre_techniques: &["T1053.003"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Unexpected cron entries are definitive persistence indicators; compare against known-good baseline"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Crontab entry; persists until crontab -r",
};
/// Anacron configuration at `/etc/anacrontab`.
///
/// Anacron runs jobs that were missed due to system downtime — useful for
/// laptops. Format: `period delay job-id command`.
pub static LINUX_ANACRONTAB: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_anacrontab",
name: "Anacrontab (/etc/anacrontab)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/anacrontab"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Deferred cron jobs for irregular uptime; period-based rather than time-based",
mitre_techniques: &["T1053.003"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://linux.die.net/man/8/anacron"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux persistence: systemd ────────────────────────────────────────────
/// System-level systemd service units (T1543.002).
///
/// `.service` files in `/etc/systemd/system/` (admin-installed, highest priority)
/// or `/lib/systemd/system/` (package-installed). Key fields: `ExecStart`,
/// `WantedBy`, `After`. Malicious units often `WantedBy=multi-user.target`.
pub static LINUX_SYSTEMD_SYSTEM_UNIT: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_systemd_system_unit",
name: "systemd System Service Units",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/systemd/system"),
scope: DataScope::System,
os_scope: OsScope::LinuxSystemd,
decoder: Decoder::Identity,
meaning:
"Service definitions executed as root at boot; WantedBy=multi-user.target = auto-start",
mitre_techniques: &["T1543.002"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://www.freedesktop.org/software/systemd/man/systemd.unit.html",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Per-user systemd service units (T1543.002).
///
/// Stored in `~/.config/systemd/user/*.service`; executed as the user's
/// session starts. No root required. `systemctl --user enable` activates.
pub static LINUX_SYSTEMD_USER_UNIT: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_systemd_user_unit",
name: "systemd User Service Units",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.config/systemd/user"),
scope: DataScope::User,
os_scope: OsScope::LinuxSystemd,
decoder: Decoder::Identity,
meaning: "User-scope service definitions; executed without root on user login",
mitre_techniques: &["T1543.002"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.freedesktop.org/software/systemd/man/systemd.unit.html",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// systemd timer units — cron-like scheduling (T1053.006).
///
/// `.timer` files trigger associated `.service` units on a schedule.
/// More flexible than cron: supports calendar expressions and monotonic timers.
pub static LINUX_SYSTEMD_TIMER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_systemd_timer",
name: "systemd Timer Units",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/systemd/system"),
scope: DataScope::System,
os_scope: OsScope::LinuxSystemd,
decoder: Decoder::Identity,
meaning: "Timer-based scheduled execution; malicious timers trigger services on a schedule",
mitre_techniques: &["T1053.006"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.freedesktop.org/software/systemd/man/systemd.timer.html",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux persistence: init / rc.local ───────────────────────────────────
/// `/etc/rc.local` — legacy startup script (T1037.004).
///
/// Executed at the end of each multiuser runlevel. Still supported on most
/// distros. Must be executable (+x). Any command here runs as root at boot.
pub static LINUX_RC_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_rc_local",
name: "rc.local Startup Script",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/rc.local"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Legacy boot-time script executed as root; simple and widely supported",
mitre_techniques: &["T1037.004"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// SysV init scripts directory `/etc/init.d/`.
///
/// Scripts here are executed by the init system at specific runlevels.
/// Symlinks in `/etc/rc{N}.d/` control when they run. Legacy but still present.
pub static LINUX_INIT_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_init_d",
name: "SysV Init Scripts (/etc/init.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/init.d"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "SysV init scripts; malicious script here runs at boot across reboots",
mitre_techniques: &["T1543.002"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux persistence: shell startup files ────────────────────────────────
/// `~/.bashrc` — per-user Bash interactive shell startup (T1546.004).
///
/// Sourced for every non-login interactive bash shell. Attackers add aliases,
/// functions, or background processes here. Survives reboots.
pub static LINUX_BASHRC_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_bashrc_user",
name: "User ~/.bashrc",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.bashrc"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Sourced on every interactive bash session; persistent aliases, functions, or background processes",
mitre_techniques: &["T1546.004"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
"https://www.elastic.co/guide/en/security/current/bash-shell-profile-modification.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `~/.bash_profile` — Bash login shell startup (T1546.004).
pub static LINUX_BASH_PROFILE_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_bash_profile_user",
name: "User ~/.bash_profile",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.bash_profile"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Sourced on Bash login shells; runs at SSH login and console login",
mitre_techniques: &["T1546.004"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `~/.profile` — POSIX login shell startup.
pub static LINUX_PROFILE_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_profile_user",
name: "User ~/.profile",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.profile"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "POSIX login shell startup; sourced by sh, dash, and bash on login",
mitre_techniques: &["T1546.004"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `~/.zshrc` — per-user Zsh interactive startup (T1546.004).
pub static LINUX_ZSHRC_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_zshrc_user",
name: "User ~/.zshrc",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.zshrc"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Sourced on every interactive Zsh session; same persistence vector as .bashrc",
mitre_techniques: &["T1546.004"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `/etc/profile` — system-wide login shell startup.
pub static LINUX_PROFILE_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_profile_system",
name: "System /etc/profile",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/profile"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "System-wide login shell startup; modifications affect all users",
mitre_techniques: &["T1546.004"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `/etc/profile.d/` — drop-in system-wide shell startup scripts.
pub static LINUX_PROFILE_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_profile_d",
name: "System /etc/profile.d/ Drop-ins",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/profile.d"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Shell scripts sourced by /etc/profile for all users at login; drop-in persistence",
mitre_techniques: &["T1546.004"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux persistence: dynamic linker ────────────────────────────────────
/// `/etc/ld.so.preload` — system-wide library preload (T1574.006).
///
/// Libraries listed here are loaded into EVERY process before any other
/// library, including setuid binaries. This is a classic rootkit technique.
/// An empty or absent file is normal; ANY entry is highly suspicious.
pub static LINUX_LD_SO_PRELOAD: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_ld_so_preload",
name: "Dynamic Linker Preload (/etc/ld.so.preload)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/ld.so.preload"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Libraries preloaded into EVERY process system-wide; standard rootkit hiding mechanism",
mitre_techniques: &["T1574.006"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking",
"https://www.sentinelone.com/labs/leveraging-ld_audit-to-beat-the-traditional-linux-library-preloading-technique/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `/etc/ld.so.conf.d/` — linker search path configuration (T1574.006).
///
/// Adding a directory containing malicious `.so` files here allows library
/// hijacking without needing LD_PRELOAD.
pub static LINUX_LD_SO_CONF_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_ld_so_conf_d",
name: "Linker Config Directory (/etc/ld.so.conf.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/ld.so.conf.d"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Library search path config; malicious entry adds attacker directory to ldconfig paths",
mitre_techniques: &["T1574.006"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux persistence: SSH ────────────────────────────────────────────────
/// SSH authorized_keys — persistent backdoor public keys (T1098.004).
///
/// Any public key listed here allows passwordless SSH login as the owner.
/// Attackers add their key for persistent remote access.
pub static LINUX_SSH_AUTHORIZED_KEYS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_ssh_authorized_keys",
name: "SSH authorized_keys",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.ssh/authorized_keys"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Public keys permitting passwordless SSH login; attacker key = permanent backdoor",
mitre_techniques: &["T1098.004"],
fields: SSH_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/ssh-backdoors/",
"https://sandflysecurity.com/blog/detecting-unauthorized-ssh-keys-in-linux/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux persistence: PAM / privilege / kernel ───────────────────────────
/// `/lib/security/` — PAM loadable module directory (T1556.003).
///
/// Drop location for PAM shared-object (`.so`) modules loaded by the PAM
/// framework during authentication. PamDOORa drops `pam_linux.so` here as
/// an *additional* module referenced via an `auth optional pam_linux.so` line
/// in `/etc/pam.d/sshd`, avoiding replacement of the standard `pam_unix.so`.
/// Any `.so` file whose hash does not match a known-good system package is a
/// backdoor candidate. Also check `/lib/x86_64-linux-gnu/security/` (Debian).
pub static LINUX_PAM_MODULE_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_pam_module_dir",
name: "PAM Modules Directory (/lib/security/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/lib/security"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Drop location for PAM .so modules; PamDOORa adds pam_linux.so here as a credential-harvesting backdoor loaded via pam_exec config — any .so absent from the installed package manifest proves backdoor installation.",
mitre_techniques: &["T1556.003", "T1574.006"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["linux_pam_d", "linux_wtmp", "linux_btmp", "linux_lastlog", "linux_auth_log"],
sources: &[
"https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
"https://linux.die.net/man/8/pam",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Also check /lib/x86_64-linux-gnu/security/ (Debian/Ubuntu) and /usr/lib/x86_64-linux-gnu/security/; verify every .so against dpkg/rpm manifest",
"PamDOORa compiles to pam_linux.so — any non-system module name is an immediate IOC",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Files on disk in /lib/; persist until explicitly removed",
};
/// `/etc/pam.d/` — PAM module configuration (T1556.003).
///
/// Each file configures authentication for a service (e.g., `sshd`, `sudo`,
/// `su`). Replacing `pam_unix.so` or adding a malicious module intercepts
/// ALL authentication for that service.
pub static LINUX_PAM_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_pam_d",
name: "PAM Configuration (/etc/pam.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/pam.d"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "PAM module configs per service; malicious module intercepts and logs all passwords",
mitre_techniques: &["T1556.003"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[
"linux_pam_module_dir",
"linux_wtmp",
"linux_btmp",
"linux_lastlog",
"linux_utmp",
"linux_auth_log",
],
sources: &[
// PAM backdoor: replaces pam_unix.so to exfiltrate credentials via DNS
"https://x-c3ll.github.io/posts/PAM-backdoor-DNS/",
// T1556.003 coverage in Elastic persistence primer (PAM modification section)
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
// PamDOORa: pam_exec abuse and log tampering analysis
"https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Modification of PAM config proves auth interception capability; correlate with linux_pam_module_dir for dropped .so and auth logs for attacker session timestamps",
"PamDOORa uses pam_exec to load scripts rather than replacing pam_unix.so — check for optional/sufficient module lines referencing non-system paths",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Text files in /etc/pam.d/; persist until explicitly modified or restored",
};
/// `/etc/sudoers.d/` — drop-in sudoers rules (T1548.003).
///
/// `NOPASSWD` entries allow sudo without password. Attackers add entries for
/// specific commands or ALL commands without password prompting.
pub static LINUX_SUDOERS_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_sudoers_d",
name: "Sudoers Drop-ins (/etc/sudoers.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/sudoers.d"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Drop-in sudoers rules; NOPASSWD entries enable privilege escalation without credentials",
mitre_techniques: &["T1548.003"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
// T1548.003 sudoers abuse section with NOPASSWD drop-in coverage
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
"https://linux.die.net/man/5/sudoers",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Presence of unexpected rules is high-confidence privilege escalation indicator",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Files in /etc/sudoers.d/; persist until explicitly removed",
};
/// `/etc/modules-load.d/` — kernel modules loaded at boot (T1547.006).
///
/// Each `.conf` file lists module names to load. Attackers register a
/// rootkit or malicious kernel module here for persistent kernel-level access.
pub static LINUX_MODULES_LOAD_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_modules_load_d",
name: "Kernel Module Load Config (/etc/modules-load.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/modules-load.d"),
scope: DataScope::System,
os_scope: OsScope::LinuxSystemd,
decoder: Decoder::Identity,
meaning: "Kernel modules auto-loaded at boot; rootkit module here = persistent kernel access",
mitre_techniques: &["T1547.006"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
// Official systemd man page for modules-load.d format and directory precedence
"https://www.freedesktop.org/software/systemd/man/modules-load.d.html",
// Kernel module loading security — kernel.modules_disabled and LKM threat model
"https://linux-audit.com/increase-kernel-integrity-with-disabled-linux-kernel-modules-loading/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `/etc/update-motd.d/` — dynamic MOTD scripts executed on login (Debian/Ubuntu).
///
/// Every script here runs as root at SSH login to generate the MOTD.
/// A persistent backdoor can be hidden here as it looks like a status script.
pub static LINUX_MOTD_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_motd_d",
name: "Dynamic MOTD Scripts (/etc/update-motd.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/update-motd.d"),
scope: DataScope::System,
os_scope: OsScope::LinuxDebian,
decoder: Decoder::Identity,
meaning: "Scripts run as root at SSH login for MOTD generation; covert execution vector",
mitre_techniques: &["T1037.004"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
// T1037.004 MOTD persistence — /etc/update-motd.d/ section with auditd/osquery detection
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
// pberba Part 2, Section 10: motd scripts via pam_motd (Debian/Ubuntu)
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `/etc/udev/rules.d/` — udev device event rules (T1546).
///
/// Rules can execute commands when devices are connected. An attacker can
/// create a rule that runs a payload whenever a USB is inserted or a network
/// interface comes up.
pub static LINUX_UDEV_RULES_D: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_udev_rules_d",
name: "udev Rules (/etc/udev/rules.d/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/udev/rules.d"),
scope: DataScope::System,
os_scope: OsScope::LinuxSystemd,
decoder: Decoder::Identity,
meaning: "Device event rules; RUN+= directive executes payload on device attach/detach",
mitre_techniques: &["T1546"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
// T1546 udev rules persistence — RUN+= directive, three sub-methods, detection rules
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
// Official freedesktop udev rules syntax reference
"https://www.freedesktop.org/software/systemd/man/udev_rules.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Linux execution evidence ──────────────────────────────────────────────
/// `~/.bash_history` — Bash interactive command history (T1059.004).
///
/// Contains commands entered in interactive Bash sessions. Attackers often
/// clear this with `history -c` or `unset HISTFILE`. An absent or empty file
/// is itself suspicious.
pub static LINUX_BASH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_bash_history",
name: "Bash History (~/.bash_history)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.bash_history"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Interactive Bash command history; reveals lateral movement, exfil, and recon commands",
mitre_techniques: &["T1059.004", "T1552"],
fields: CRON_LINE_FIELDS,
retention: Some("HISTSIZE limit; default 500-2000 commands"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://bromiley.medium.com/torvalds-tuesday-bash-history-in-linux-forensics-7cc4c9b4db9f",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Circumstantial),
evidence_caveats: &[
"Trivially disabled with HISTSIZE=0 or HISTFILE=/dev/null",
"Written at shell exit; killed shells leave no history",
"Root can modify or delete",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Written at shell exit; max HISTSIZE entries",
};
/// `~/.zsh_history` — Zsh interactive command history.
pub static LINUX_ZSH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_zsh_history",
name: "Zsh History (~/.zsh_history)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.zsh_history"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Interactive Zsh command history; extended format optionally includes timestamps",
mitre_techniques: &["T1059.004", "T1552"],
fields: CRON_LINE_FIELDS,
retention: Some("HISTSIZE limit; default 500-2000 commands"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://bromiley.medium.com/torvalds-tuesday-bash-history-in-linux-forensics-7cc4c9b4db9f",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `/var/log/wtmp` — binary successful login history (T1078).
///
/// Utmp-format binary file; `last` command reads it. Records login, logout,
/// reboot, and shutdown events. Tampered by log-clearing tools.
pub static LINUX_WTMP: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_wtmp",
name: "Login History (/var/log/wtmp)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/log/wtmp"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Binary record of all successful logins/logouts/reboots; evidence of valid-account abuse",
mitre_techniques: &["T1078", "T1021.004"],
fields: LOG_LINE_FIELDS,
retention: Some("until rotated by logrotate"),
triage_priority: TriagePriority::High,
related_artifacts: &["linux_btmp", "linux_lastlog", "linux_utmp", "linux_auth_log", "linux_pam_d"],
sources: &[
"https://linux.die.net/man/5/wtmp",
"https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
"https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
"https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Binary format; utmpdump needed; can be edited by root",
"PamDOORa explicitly removes attacker login entries from wtmp; gaps in binary record sequence are a tampering indicator — cross-reference with lastlog and auth.log for timeline gaps",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Rotated by logrotate",
};
/// `/var/log/btmp` — binary failed login attempts.
///
/// Utmp-format binary; `lastb` command reads it. Brute-force evidence.
pub static LINUX_BTMP: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_btmp",
name: "Failed Login Attempts (/var/log/btmp)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/log/btmp"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Binary record of failed authentication attempts; brute-force and credential-stuffing evidence",
mitre_techniques: &["T1110"],
fields: LOG_LINE_FIELDS,
retention: Some("until rotated by logrotate"),
triage_priority: TriagePriority::High,
related_artifacts: &["linux_wtmp", "linux_lastlog", "linux_utmp", "linux_auth_log", "linux_pam_d"],
sources: &[
"https://linux.die.net/man/5/wtmp",
"https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
"https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
"https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Binary format; lastb command needed; can be zeroed by root",
"PAM backdoors (PamDOORa) deliberately remove their own btmp entries — absence of failed attempts from a source IP that appears in other logs indicates tampering",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Rotated by logrotate",
};
/// `/var/log/lastlog` — binary last-login-per-UID database.
///
/// Fixed-offset binary file indexed by UID. `lastlog` command reads it.
/// Each entry records last login time and source IP.
pub static LINUX_LASTLOG: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_lastlog",
name: "Last Login Database (/var/log/lastlog)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/log/lastlog"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Per-UID last-login record including source IP; never-logged-in vs recent entries",
mitre_techniques: &["T1078"],
fields: LOG_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["linux_wtmp", "linux_btmp", "linux_utmp", "linux_auth_log", "linux_pam_d"],
sources: &[
"https://linux.die.net/man/5/wtmp",
"https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
"https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Fixed-offset binary indexed by UID — zeroing an entry with write access is trivial; PamDOORa explicitly zeroes attacker UID entries to erase login history",
"A UID whose lastlog entry is all-zeros but appears in auth.log or wtmp is a high-confidence tampering indicator",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Not rotated; persists until explicitly overwritten; survives reboots",
};
/// `/var/log/auth.log` — authentication and sudo event log (Debian/Ubuntu).
///
/// Contains PAM authentication events, sudo commands, SSH logins, and su usage.
/// Red Hat equivalent: `/var/log/secure`.
pub static LINUX_AUTH_LOG: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_auth_log",
name: "Auth Log (/var/log/auth.log)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/log/auth.log"),
scope: DataScope::System,
os_scope: OsScope::LinuxDebian,
decoder: Decoder::Identity,
meaning: "PAM auth events, SSH logins, sudo commands, su usage; primary lateral-movement log",
mitre_techniques: &["T1078", "T1548.003"],
fields: LOG_LINE_FIELDS,
retention: Some("until rotated by logrotate"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["rsyslog/syslog-ng must be running; can be cleared by root"],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "logrotate weekly by default",
};
/// systemd journal directory `/var/log/journal/`.
///
/// Binary journal files; `journalctl` reads them. Contains all system and
/// service log messages. More tamper-resistant than syslog text files.
pub static LINUX_JOURNAL_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_journal_dir",
name: "systemd Journal (/var/log/journal/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/log/journal"),
scope: DataScope::System,
os_scope: OsScope::LinuxSystemd,
decoder: Decoder::Identity,
meaning:
"Structured binary system journal; includes boot IDs, service crashes, and audit events",
mitre_techniques: &["T1078", "T1059.004"],
fields: DIR_ENTRY_FIELDS,
retention: Some("50MB or 1 month default; configurable in journald.conf"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://systemd.io/JOURNAL_NATIVE_PROTOCOL/"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["systemd journal provides structured authentication and system events; requires journalctl for parsing"],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "systemd journal; rotated by journald size/time limits",
};
// ── Linux credential artifacts ────────────────────────────────────────────
/// `/etc/passwd` — local user account database (T1087.001).
///
/// World-readable; fields: `user:x:uid:gid:gecos:home:shell`.
/// UID=0 duplicates, unusual shells (`/bin/bash` for service accounts),
/// and accounts with homedir `/` are suspicious.
pub static LINUX_PASSWD: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_passwd",
name: "User Account Database (/etc/passwd)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/passwd"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Local user enumeration; UID=0 duplicates or unusual shells indicate backdoor accounts",
mitre_techniques: &["T1087.001", "T1136.001"],
fields: ACCOUNT_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &[
"https://linux.die.net/man/5/passwd",
"https://bromiley.medium.com/torvalds-tuesday-user-accounts-597b4ca9dcaf",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"World-readable; shows all accounts but no password hashes (those are in shadow)",
"Added accounts may be backdoors; compare against baseline",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "File; persists until account deleted",
};
/// `/etc/shadow` — password hash database (T1003.008).
///
/// Root-readable only. Hash formats: `$1$`=MD5, `$5$`=SHA256, `$6$`=SHA512,
/// `$y$`=yescrypt (modern). `*` or `!` prefix = locked account.
pub static LINUX_SHADOW: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_shadow",
name: "Shadow Password File (/etc/shadow)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/shadow"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Password hashes for all local accounts; crackable offline once read",
mitre_techniques: &["T1003.008"],
fields: ACCOUNT_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-password-security/",
"https://bromiley.medium.com/torvalds-tuesday-user-accounts-597b4ca9dcaf",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Requires root to read; contains hashed passwords",
"Hash format determines crackability; check for weak algorithms (MD5, SHA-256)",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "File; persists until account deleted or password changed",
};
/// SSH private key files — stolen keys enable impersonation (T1552.004).
///
/// Unencrypted keys (no `Proc-Type: ENCRYPTED` header) are immediately usable.
/// Encrypted keys require the passphrase but are still high-value targets.
pub static LINUX_SSH_PRIVATE_KEY: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_ssh_private_key",
name: "SSH Private Keys (~/.ssh/id_*)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.ssh/id_*"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"Private key material for SSH authentication; unencrypted keys = immediate lateral movement",
mitre_techniques: &["T1552.004"],
fields: SSH_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/ssh-backdoors/",
"https://sandflysecurity.com/blog/detecting-unauthorized-ssh-keys-in-linux/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Private key presence proves capability for lateral movement",
"Passphrase-protected keys require cracking; unprotected keys are immediately usable",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "File; persists until explicitly removed",
};
/// `~/.ssh/known_hosts` — previously connected SSH server fingerprints (T1021.004).
///
/// Records host key fingerprints of servers the user has connected to.
/// Reveals lateral movement destinations and external access patterns.
pub static LINUX_SSH_KNOWN_HOSTS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_ssh_known_hosts",
name: "SSH Known Hosts (~/.ssh/known_hosts)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.ssh/known_hosts"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Previously-connected SSH server fingerprints; lateral movement destination history",
mitre_techniques: &["T1021.004", "T1083"],
fields: SSH_KEY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/ssh-backdoors/",
"https://sandflysecurity.com/blog/detecting-unauthorized-ssh-keys-in-linux/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `~/.gnupg/private-keys-v1.d/` — GnuPG private key store (T1552.004).
///
/// Modern GnuPG (2.1+) stores one `.key` file per secret key.
/// Exporting these enables code-signing forgery and decryption of PGP messages.
pub static LINUX_GNUPG_PRIVATE: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_gnupg_private",
name: "GnuPG Private Key Store (~/.gnupg/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.gnupg"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "GnuPG private keys; enables message decryption and code-signing forgery",
mitre_techniques: &["T1552.004"],
fields: DPAPI_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `~/.aws/credentials` — AWS access key material (T1552.001).
///
/// INI-format file with `aws_access_key_id` and `aws_secret_access_key`.
/// May also contain `aws_session_token` for temporary credentials.
pub static LINUX_AWS_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_aws_credentials",
name: "AWS Credentials (~/.aws/credentials)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.aws/credentials"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "AWS long-term or temporary credentials; enables cloud infrastructure compromise",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html",
"https://www.sans.org/blog/cloud-forensics-and-incident-response/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// `~/.docker/config.json` — Docker registry auth tokens (T1552.001).
///
/// Contains base64-encoded `auth` tokens or `credsStore` references for
/// container registries. Grants push/pull access to private registries.
pub static LINUX_DOCKER_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_docker_config",
name: "Docker Config (~/.docker/config.json)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.docker/config.json"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Docker registry credentials; enables container image exfil or malicious image push",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://docs.docker.com/engine/reference/commandline/login/",
"https://www.sans.org/blog/container-forensics/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Batch E — Windows execution / persistence / credential ───────────────────
// ── Execution evidence ────────────────────────────────────────────────────────
pub static LNK_FILES: ArtifactDescriptor = ArtifactDescriptor {
id: "lnk_files",
name: "LNK / Shell Link Recent Files",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Windows\Recent\"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Shell Link (.lnk) files record target path, MAC timestamps, volume serial, \
and NetBIOS host — evidence of file access even after target deletion. \
BEEF0004 extension (Win8+) adds 48-bit MFT record, full 64-bit file size, \
reparse point tags (cloud sync markers), and OS version hint. \
StringData.Arguments is the primary indicator of weaponised LNKs (T1204.002). \
DriveType (FIXED/REMOVABLE/REMOTE) identifies source medium.",
mitre_techniques: &["T1547.009", "T1070.004", "T1204.002"],
fields: LNK_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["jump_list_auto", "mru_recent_docs"],
sources: &[
"https://github.com/EricZimmerman/LECmd",
"https://github.com/EricZimmerman/Lnk",
"https://github.com/kacos2000/Jumplist-Browser",
"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Can be spoofed; verify with corroborating artifacts"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Created on file open; max ~150 recent items",
};
pub static JUMP_LIST_AUTO: ArtifactDescriptor = ArtifactDescriptor {
id: "jump_list_auto",
name: "Jump Lists — AutomaticDestinations",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "OLE Compound Document per application; DestList stream records MRU-ordered \
file access with embedded LNK entries. Filename stem is a CRC64 AppID hash \
resolved via HKCU\\...\\Search\\JumplistData or AppIdlist.csv. \
DestList entries include BEEF0004 extension: 48-bit MFT record number, \
full 64-bit file size (LNK header truncates at 4 GB), reparse tags \
(cloud sync/WSL), and OS-version hint identifying which Windows version \
created the entry (useful for roaming profiles). Also tracks Pin Entry order \
and Quick Access position for pinned items.",
mitre_techniques: &["T1547.009", "T1070.004"],
fields: JUMP_LIST_AUTO_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["lnk_files", "mru_recent_docs", "jump_list_appid_registry"],
sources: &[
"https://github.com/EricZimmerman/JLECmd",
"https://github.com/EricZimmerman/JumpList",
"https://github.com/kacos2000/Jumplist-Browser",
"https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Application-specific; some apps don't integrate with jump lists"],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Updated on file access; max entries per app",
};
pub static JUMP_LIST_CUSTOM: ArtifactDescriptor = ArtifactDescriptor {
id: "jump_list_custom",
name: "Jump Lists — CustomDestinations",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Application-defined jump list groups (Tasks/Recent/Pinned) stored as a \
sequence of embedded LNK records separated by group markers (0xAB FB BF BA). \
May persist after file deletion, revealing attacker-pinned tools or \
exfiltrated document access. StringData.Arguments in each embedded LNK \
is the primary weaponisation indicator — legitimate entries are empty, \
malicious entries carry PowerShell commands, encoded payloads, or C2 URLs. \
Group 'Tasks' entries are application-defined and often reveal \
installed capabilities (e.g. browser private mode, admin tools).",
mitre_techniques: &["T1547.009", "T1070.004", "T1204.002"],
fields: JUMP_LIST_CUSTOM_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["lnk_files", "jump_list_auto"],
sources: &[
"https://github.com/EricZimmerman/JLECmd",
"https://github.com/EricZimmerman/JumpList",
"https://github.com/kacos2000/Jumplist-Browser",
"https://github.com/kacos2000/Jumplist-Browser/blob/master/CustomDestinations-ms.md",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Pinned items reflect user intent; can be manually set without file access",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Pinned by user; persists until app unpins",
};
pub static EVTX_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_dir",
name: "Windows Event Log Directory (EVTX)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\winevt\Logs\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Binary EVTX log files — Security.evtx (4624/4625/4688), System.evtx, \
PowerShell/Operational.evtx. Primary execution, logon, and process-creation record.",
mitre_techniques: &["T1070.001", "T1059.001"],
fields: DIR_ENTRY_FIELDS,
retention: Some("configurable; default ~20MB rolling per channel"),
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://github.com/EricZimmerman/evtx"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static MFT_FILE: ArtifactDescriptor = ArtifactDescriptor {
id: "mft_file",
name: "Master File Table ($MFT)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\$MFT"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Complete NTFS filesystem map. Every file record contains 8 timestamps: 4 from \
$STANDARD_INFORMATION (SI, user-space writable via SetFileTime) and 4 from \
$FILE_NAME (FN, kernel-maintained — harder to forge). SI/FN divergence is the \
primary timestomping indicator (T1070.006). Record slack (PhysicalSize - LogicalSize) \
may contain prior attribute remnants. LSN links each record to its $LogFile \
transaction for chronological ordering. Unallocated records (flag bit 15 = 0) \
persist until overwritten — primary deleted-file recovery source.",
mitre_techniques: &["T1070.006", "T1070.004", "T1083", "T1564.001"],
fields: MFT_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["usnjrnl", "usn_journal", "recycle_bin", "prefetch_file", "logfile_ntfs"],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table",
"https://github.com/EricZimmerman/MFTECmd",
// kacos2000/MFT_Browser: authoritative field offsets for all NTFS attributes,
// LSN (0x08), hard link count (0x12), record slack, USN in $SI (+64),
// 8-timestamp dual MACE set ($SI + $FN), $Object_ID UUID creation time
"https://github.com/kacos2000/MFT_Browser",
"https://www.sans.org/blog/windows-file-system-forensics-ntfs-master-file-table/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Timestamps susceptible to timestomping ($STANDARD_INFORMATION vs $FILE_NAME)",
"$FILE_NAME timestamps harder to tamper; compare both",
],
volatility: Some(crate::volatility::VolatilityClass::Residual),
volatility_rationale: "Metadata persists in unallocated MFT entries after deletion",
};
pub static USN_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
id: "usn_journal",
name: "USN Journal ($UsnJrnl:$J)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"\\.\C:\$Extend\$UsnJrnl:$J"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "NTFS change journal records file create/delete/rename operations with USN sequence \
number; persists even after file deletion, proving prior file existence.",
mitre_techniques: &["T1070.004", "T1059"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[
"shimcache",
"amcache_app_file",
"bam_user",
"prefetch_file",
"mft_file",
],
sources: &[
"https://github.com/EricZimmerman/MFTECmd",
"https://windowsir.blogspot.com/2022/11/challenge-7-write-up.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Circular; entries overwritten; may not have full history"],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Circular journal; oldest entries overwritten first",
};
// ── Persistence ───────────────────────────────────────────────────────────────
pub static WMI_MOF_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "wmi_mof_dir",
name: "WMI MOF Subscription Repository",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\wbem\Repository\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "WMI CIM repository stores EventFilter, EventConsumer, and FilterToConsumerBinding \
objects; persistence survives reboots and is invisible to registry-only tools.",
mitre_techniques: &["T1546.003"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/receiving-a-wmi-event",
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/monitoring-and-responding-to-events-with-standard-consumers",
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer",
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/--filtertoconsumerbinding",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static BITS_DB: ArtifactDescriptor = ArtifactDescriptor {
id: "bits_db",
name: "BITS Job Queue Database",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Network\Downloader\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Background Intelligent Transfer Service queue DB (qmgr0.dat); records download \
jobs including URL, destination, and command-to-notify — abused for stealthy malware staging.",
mitre_techniques: &["T1197"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/bits/background-intelligent-transfer-service-portal",
"https://learn.microsoft.com/en-us/powershell/module/bitstransfer/get-bitstransfer?view=windowsserver2025-ps",
"https://www.sans.org/white-papers/39195",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static WMI_SUB_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "filter_name",
description: "WMI EventFilter name",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "consumer_type",
description: "Consumer type (Script/CommandLine)",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "consumer_value",
description: "Script or command executed on trigger",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "query",
description: "WQL query that triggers the subscription",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static WMI_SUBSCRIPTIONS: ArtifactDescriptor = ArtifactDescriptor {
id: "wmi_subscriptions",
name: "WMI Event Subscriptions (Registry)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\WBEM\ESS\//./root/subscription",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::MultiSz,
meaning: "Registry-side index of WMI subscriptions; cross-reference with MOF repository for \
complete picture of WMI-based persistence.",
mitre_techniques: &["T1546.003"],
fields: WMI_SUB_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/receiving-a-wmi-event",
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/monitoring-and-responding-to-events-with-standard-consumers",
"https://learn.microsoft.com/en-us/windows/win32/wmisdk/--filtertoconsumerbinding",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LOGON_SCRIPTS: ArtifactDescriptor = ArtifactDescriptor {
id: "logon_scripts",
name: "Logon Scripts (UserInitMprLogonScript)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
key_path: r"Environment",
value_name: Some("UserInitMprLogonScript"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Script executed at logon via WinLogon; per-user value allowing unprivileged \
persistence that survives password resets.",
mitre_techniques: &["T1037.001"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/opensecurity-persistence/",
"https://www.hexacorn.com/blog/2013/07/04/beyond-good-ol-run-key-part-15/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static WINSOCK_LSP: ArtifactDescriptor = ArtifactDescriptor {
id: "winsock_lsp",
name: "Winsock Layered Service Provider",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "LSP DLLs intercept all Winsock traffic; malicious LSPs can log credentials from \
plaintext protocols. Rare but high-signal indicator of network interception.",
mitre_techniques: &["T1547.010"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/opensecurity-persistence/",
"https://www.hexacorn.com/blog/2013/07/04/beyond-good-ol-run-key-part-15/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static APPSHIM_DB: ArtifactDescriptor = ArtifactDescriptor {
id: "appshim_db",
name: "Application Shim Database",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\apppatch\Custom\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Custom SDB shim databases; attackers inject shims to redirect API calls, \
disable security checks, or load malicious DLLs without modifying the target binary.",
mitre_techniques: &["T1546.011"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.hexacorn.com/blog/2013/07/04/beyond-good-ol-run-key-part-15/",
"https://www.sans.org/blog/application-shimming/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static PASSWORD_FILTER_DLL: ArtifactDescriptor = ArtifactDescriptor {
id: "password_filter_dll",
name: "Password Filter DLL (Notification Packages)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Control\Lsa",
value_name: Some("Notification Packages"),
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::MultiSz,
meaning: "DLLs registered here receive cleartext passwords during every password change; \
malicious filter captures and exfiltrates credentials.",
mitre_techniques: &["T1556.002"],
fields: DLL_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/opensecurity-persistence/",
"https://docs.microsoft.com/en-us/windows/win32/secmgmt/password-filter-programming-considerations",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static OFFICE_NORMAL_DOTM: ArtifactDescriptor = ArtifactDescriptor {
id: "office_normal_dotm",
name: "Office Normal Template (Normal.dotm)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Templates\Normal.dotm"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Global Word template auto-loaded on every document open; malicious macros \
embedded here achieve persistence across all Word sessions.",
mitre_techniques: &["T1137.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/opensecurity-persistence/",
"https://docs.microsoft.com/en-us/office/vba/word/concepts/customizing-word/using-events-with-the-application-object",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static POWERSHELL_PROFILE_ALL: ArtifactDescriptor = ArtifactDescriptor {
id: "powershell_profile_all",
name: "PowerShell All-Users Profile (profile.ps1)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "System-wide PowerShell profile executed for every user on every PS session start; \
SYSTEM-writable, provides privileged persistence without registry modification.",
mitre_techniques: &["T1546.013"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/opensecurity-persistence/",
"https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Credentials ───────────────────────────────────────────────────────────────
pub static DPAPI_SYSTEM_MASTERKEY: ArtifactDescriptor = ArtifactDescriptor {
id: "dpapi_system_masterkey",
name: "DPAPI System Master Key",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "DPAPI master keys for the SYSTEM account; used to decrypt SYSTEM-scope secrets \
such as LSA secrets, service credentials, and scheduled task credentials.",
mitre_techniques: &["T1555.004"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &["lsa_secrets", "dpapi_masterkey_user"],
sources: &[
"https://github.com/gentilkiwi/mimikatz",
"https://blog.gentilkiwi.com/securite/mimikatz/dpapi-domain-backup-keys-theft",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Required to decrypt SYSTEM-scope DPAPI blobs; requires SYSTEM privilege",
"Loss of this key means DPAPI-protected data is unrecoverable",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "System DPAPI master key; persists in SYSTEM hive",
};
pub static DPAPI_CREDHIST: ArtifactDescriptor = ArtifactDescriptor {
id: "dpapi_credhist",
name: "DPAPI CREDHIST File",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Protect\CREDHIST"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Chain of previous DPAPI master key derivation entries; enables decryption of \
secrets encrypted with old passwords after a password change.",
mitre_techniques: &["T1555.004"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["dpapi_masterkey_user"],
sources: &[
"https://github.com/gentilkiwi/mimikatz",
"https://blog.gentilkiwi.com/securite/mimikatz/dpapi-domain-backup-keys-theft",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static CHROME_COOKIES: ArtifactDescriptor = ArtifactDescriptor {
id: "chrome_cookies",
name: "Chrome/Edge Cookies (SQLite)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "SQLite database of browser session/authentication cookies; adversaries can replay \
these to bypass MFA and impersonate authenticated sessions (pass-the-cookie).",
mitre_techniques: &["T1539", "T1185"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["chrome_login_data"],
sources: &["https://github.com/EricZimmerman/SQLECmd"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static EDGE_WEBCACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "edge_webcache",
name: "IE/Edge Legacy WebCacheV01.dat",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%LOCALAPPDATA%\Microsoft\Windows\WebCache\WebCacheV01.dat"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "ESE (JET Blue) database recording IE / Edge Legacy web activity, organised into \
named containers by the Containers master table, each mapped to a Container_<id> table: History \
(navigated URLs), Content (cache metadata), Cookies (per-container CookieEntryEx_<id> tables holding \
cookie name/value/domain/expiry), iedownload (download records), DOMStore, plus per-day MSHist* \
history containers; LeakFiles tracks orphaned cache files. The History container stores the raw \
navigated URL verbatim, INCLUDING file:///C:/folder/file entries for local and network file opens via \
Explorer/IE — evidence of local file access, not only web browsing. Reveals browsing patterns, \
downloads, cookie origins, and locally-opened files.",
mitre_techniques: &["T1539", "T1217"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Low,
related_artifacts: &[],
sources: &[
"https://github.com/EricZimmerman/SQLECmd",
"https://www.sans.org/blog/digital-forensics-windows-browser-artifacts/",
// plaso msie_webcache.py — byte-level container/table map (Containers, Container_#, CookieEntryEx_#):
"https://github.com/log2timeline/plaso/blob/main/plaso/parsers/esedb_plugins/msie_webcache.py",
// libyal libesedb — ESE database format reference:
"https://github.com/libyal/libesedb",
],
evidence_strength: None,
evidence_caveats: &[
"Recent activity may reside in the V01.log / V01nnnn.log transaction logs (with V01.chk) rather than in WebCacheV01.dat until a clean shutdown flushes them; the .dat is locked live by taskhostw and is often 'dirty' when copied, requiring esentutl /r recovery before parsing",
"The History container records all navigation URLs including file:///C:/folder/file — this is evidence of local/network file access via the shell/IE, distinct from web browsing, and should not be read as internet activity",
],
volatility: None,
volatility_rationale: "",
};
pub static VPN_RAS_PHONEBOOK: ArtifactDescriptor = ArtifactDescriptor {
id: "vpn_ras_phonebook",
name: "VPN Credentials — RAS Phonebook",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Plain-text INI phonebook storing VPN connection entries including server address \
and saved credential references; reveals network pivoting paths.",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Low,
related_artifacts: &[],
sources: &[
"https://docs.microsoft.com/en-us/windows/win32/rras/ras-phone-book-files",
"https://www.sans.org/blog/digital-forensics-windows-artifact-profiles/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static WINDOWS_HELLO_NGC: ArtifactDescriptor = ArtifactDescriptor {
id: "windows_hello_ngc",
name: "Windows Hello / NGC Folder",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Ngc\"),
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "Stores Windows Hello credential provider keys (PIN protectors, biometric keys); \
compromise reveals authentication material bypassing traditional password forensics.",
mitre_techniques: &["T1555"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/",
"https://www.sans.org/blog/digital-forensics-windows-artifact-profiles/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static USER_CERT_PRIVATE_KEY: ArtifactDescriptor = ArtifactDescriptor {
id: "user_cert_private_key",
name: "User Certificate Private Keys",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\SystemCertificates\My\"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "DPAPI-protected user certificate private keys for code signing, S/MIME, and \
smart-card emulation; exfiltration enables impersonation and signing of malicious artifacts.",
mitre_techniques: &["T1552.004"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval",
"https://github.com/gentilkiwi/mimikatz",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static MACHINE_CERT_STORE: ArtifactDescriptor = ArtifactDescriptor {
id: "machine_cert_store",
name: "Machine Certificate Private Keys",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Machine-scope RSA private keys protected by DPAPI SYSTEM; used for TLS mutual \
auth, code signing, and IPSec — high-value credential exfiltration target.",
mitre_techniques: &["T1552.004"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval",
"https://github.com/gentilkiwi/mimikatz",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Batch F — Linux extended credentials / execution ─────────────────────────
pub static LINUX_AT_QUEUE: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_at_queue",
name: "AT Job Queue (/var/spool/at/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/spool/at/"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "One-shot delayed execution jobs from the `at` command; each file contains a shell \
script to run at a specified time, used for stealthy one-shot persistence.",
mitre_techniques: &["T1053.001"],
fields: CRON_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/linux-persistence-mechanisms/",
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_SSHD_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_sshd_config",
name: "SSH Daemon Configuration (/etc/ssh/sshd_config)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/ssh/sshd_config"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "SSH server config; look for unauthorized AuthorizedKeysFile overrides, \
ForceCommand bypass, PermitRootLogin yes, or AllowUsers modifications.",
mitre_techniques: &["T1098.004", "T1021.004"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://www.sans.org/blog/ssh-backdoors/",
"https://linux.die.net/man/5/sshd_config",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_ETC_GROUP: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_etc_group",
name: "Group Accounts (/etc/group)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/group"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Group membership database; cross-reference with /etc/passwd and sudo log to \
detect unauthorized group additions (e.g., added to `sudo` or `docker` group).",
mitre_techniques: &["T1087.001", "T1078.003"],
fields: ACCOUNT_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://linux.die.net/man/5/group",
"https://bromiley.medium.com/torvalds-tuesday-user-accounts-597b4ca9dcaf",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_GNOME_KEYRING: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_gnome_keyring",
name: "GNOME Keyring (keyrings/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.local/share/keyrings/"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "GNOME keyring stores WiFi PSK, SSH passphrases, web service passwords, and \
browser master passwords encrypted with user login credential.",
mitre_techniques: &["T1555.003"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &["https://wiki.gnome.org/Projects/GnomeKeyring"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Encrypted with user login password; accessible after user session unlock",
"Contains Wi-Fi keys, VPN credentials, and application secrets",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Keyring database file; persists until secrets removed",
};
pub static LINUX_KDE_KWALLET: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_kde_kwallet",
name: "KDE KWallet (kwalletd/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.local/share/kwalletd/"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "KDE wallet encrypted credential store; stores passwords, SSH keys, and browser \
credentials for KDE applications.",
mitre_techniques: &["T1555.003"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &["https://userbase.kde.org/KWallet"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Encrypted; requires wallet password or auto-unlock to access",
"Coverage depends on which KDE applications store credentials here",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "KWallet database file; persists until secrets removed",
};
pub static LINUX_CHROME_LOGIN_LINUX: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_chrome_login_linux",
name: "Chrome/Chromium Login Data (Linux)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.config/google-chrome/Default/Login Data"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "SQLite database of saved Chrome passwords on Linux; encryption key stored in \
GNOME Keyring or plaintext depending on configuration.",
mitre_techniques: &["T1555.003"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &["https://github.com/AlessandroZ/LaZagne"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"On Linux, Chrome uses GNOME Keyring or KWallet for encryption key storage",
"Plaintext accessible if keyring is unlocked",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "SQLite DB; credentials persist until deleted from browser",
};
pub static LINUX_FIREFOX_LOGINS_LINUX: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_firefox_logins_linux",
name: "Firefox logins.json (Linux)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.mozilla/firefox/"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"JSON-encoded saved Firefox credentials protected by NSS (key4.db); \
can be decrypted with master password or via memory forensics of the Firefox process.",
mitre_techniques: &["T1555.003"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Critical,
related_artifacts: &[],
sources: &["https://github.com/AlessandroZ/LaZagne"],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Same format as Windows Firefox logins; key4.db required for decryption",
"Primary password prevents access if set",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "JSON file; credentials persist until deleted from browser",
};
pub static LINUX_UTMP: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_utmp",
name: "Current Login Sessions (/run/utmp)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/run/utmp"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Binary utmp records of currently logged-in users; cross-reference with wtmp \
to detect sessions not present in persistent logs (anti-forensics via utmp wiper).",
mitre_techniques: &["T1078"],
fields: LOG_LINE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["linux_wtmp", "linux_btmp", "linux_lastlog", "linux_auth_log", "linux_pam_d"],
sources: &[
"https://linux.die.net/man/5/utmp",
"https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
"https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
"https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Lives in /run (tmpfs on most modern distros); lost on reboot",
"PAM backdoors can wipe their active session entry — a session visible in network connections (ss/netstat) but absent from utmp is a strong anti-forensics indicator",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "Stored in /run (tmpfs); lost on reboot",
};
pub static LINUX_GCP_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_gcp_credentials",
name: "GCP Application Default Credentials",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.config/gcloud/"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "GCP access tokens and service account keys stored by gcloud CLI; \
exfiltration enables cloud resource takeover without password.",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://cloud.google.com/sdk/docs/authorizing",
"https://www.sans.org/blog/cloud-forensics-and-incident-response/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_AZURE_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_azure_credentials",
name: "Azure CLI Credentials (~/.azure/)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.azure/"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Azure CLI access tokens and service principal credentials; \
msal_token_cache.json contains active OAuth tokens enabling lateral movement in Azure.",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli",
"https://www.sans.org/blog/cloud-forensics-and-incident-response/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_KUBE_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_kube_config",
name: "Kubernetes Config (~/.kube/config)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.kube/config"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "kubectl cluster credentials including bearer tokens, client certificates, \
and cluster API endpoints; enables full cluster takeover if exfiltrated.",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/",
"https://www.sans.org/blog/cloud-forensics-and-incident-response/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_GIT_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_git_credentials",
name: "Git Credential Store (~/.git-credentials)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.git-credentials"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Plaintext git credential store: URL + username + PAT/password per line; \
personal access tokens here can access source repositories and CI/CD pipelines.",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &["https://git-scm.com/docs/git-credential-store"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_NETRC: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_netrc",
name: "Netrc Credential File (~/.netrc)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.netrc"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Auto-authentication file for ftp, curl, and legacy tools; stores plaintext \
hostname/login/password triplets, often forgotten and highly sensitive.",
mitre_techniques: &["T1552.001"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://linux.die.net/man/5/netrc"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Batch G — LinuxPersist-sourced persistence artifacts ─────────────────────
// Source: https://github.com/GuyEldad/LinuxPersist
pub static LINUX_ETC_ENVIRONMENT: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_etc_environment",
name: "System Environment Variables (/etc/environment)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/environment"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"System-wide environment variable definitions loaded for every login session and \
PAM-based authentication. Attackers inject PATH hijacks or LD_PRELOAD values here \
to redirect binary execution system-wide without modifying shell configuration files.",
mitre_techniques: &["T1546.004"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://linux.die.net/man/7/environ"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_XDG_AUTOSTART_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_xdg_autostart_user",
name: "XDG User Autostart (.desktop files)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.config/autostart/"),
scope: DataScope::User,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Per-user XDG autostart .desktop files executed when a desktop session starts \
(GNOME/KDE/XFCE). Exec= field runs arbitrary commands at GUI login without \
root privileges — frequently overlooked by server-focused forensic checklists.",
mitre_techniques: &["T1547.014"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_XDG_AUTOSTART_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_xdg_autostart_system",
name: "XDG System Autostart (.desktop files)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/xdg/autostart/"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning:
"System-wide XDG autostart .desktop entries executed for all users at desktop session \
start. Provides privileged persistence targeting all GUI logins on a workstation.",
mitre_techniques: &["T1547.014"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_NETWORKMANAGER_DISPATCHER: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_networkmanager_dispatcher",
name: "NetworkManager Dispatcher Scripts",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/NetworkManager/dispatcher.d/"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "Scripts executed by NetworkManager when network interfaces change state (up/down). \
Provides network-event-triggered persistence — scripts fire on VPN connect, \
WiFi association, or interface cycling, making detection harder than at-boot persistence.",
mitre_techniques: &["T1547.013"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &[
"https://networkmanager.dev/docs/api/latest/NetworkManager-dispatcher.html",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LINUX_APT_HOOKS: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_apt_hooks",
name: "APT Package Manager Hook Scripts",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/apt/apt.conf.d/"),
scope: DataScope::System,
os_scope: OsScope::LinuxDebian,
decoder: Decoder::Identity,
meaning: "APT configuration snippets that can define DPkg::Pre-Install-Pkgs, \
DPkg::Post-Invoke, or APT::Update::Post-Invoke hooks; execute as root during \
every package install or update — long-lived trigger-based privilege persistence.",
mitre_techniques: &["T1546.004"],
fields: PERSIST_CMD_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &[],
sources: &["https://wiki.debian.org/DpkgTriggers"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Batch H — Jump List / LNK / Prefetch / SRUM tables / EVTX channels ──────
/// JumplistData registry key — AppID hash → application name index.
///
/// Stores CRC64 AppID hashes with their corresponding application display names.
/// Without this key, AutomaticDestinations filenames (e.g. `db53b23fd1edbd46.automaticDestinations-ms`)
/// cannot be resolved to human-readable application names without an external AppIdlist.csv lookup.
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
/// https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/
pub static JUMP_LIST_APPID_REGISTRY: ArtifactDescriptor = ArtifactDescriptor {
id: "jump_list_appid_registry",
name: "JumplistData — AppID Hash Registry Index",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
// Source: https://github.com/kacos2000/Jumplist-Browser README (confirmed via tool)
key_path: r"Software\Microsoft\Windows\CurrentVersion\Search\JumplistData",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Maps 8-byte CRC64 AppID hashes to application display names. \
AutomaticDestinations filenames use the AppID hash as the stem \
(e.g. db53b23fd1edbd46 = WINZIP64). Without this key, filename-to-app \
resolution requires an external lookup database. \
Presence or absence of an AppID confirms whether an application has \
ever been run on the system — useful for anti-forensics detection \
(attacker may delete jump list files but forget this index key).",
mitre_techniques: &["T1547.009", "T1070.004"],
fields: &[
FieldSchema {
name: "app_id_hash",
value_type: ValueType::Text,
description: "8-byte CRC64 hash (registry value name); \
matches the filename stem of .automaticDestinations-ms files",
is_uid_component: true,
},
FieldSchema {
name: "app_name",
value_type: ValueType::Text,
description: "Application display name (registry value data)",
is_uid_component: false,
},
],
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["jump_list_auto", "jump_list_custom"],
sources: &[
"https://github.com/kacos2000/Jumplist-Browser",
"https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Taskband Favorites — taskbar pinned application order.
///
/// Stores a binary blob encoding the order of pinned taskbar items. Attackers may
/// pin malicious tools to the taskbar to ensure they survive reboots and are
/// visually accessible, or to establish user trust by mimicking legitimate apps.
///
/// Source: https://github.com/kacos2000/Jumplist-Browser README (confirmed via tool)
pub static TASKBAND_FAVORITES: ArtifactDescriptor = ArtifactDescriptor {
id: "taskband_favorites",
name: "Taskband Favorites — Taskbar Pinned Applications",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
// Source: https://github.com/kacos2000/Jumplist-Browser README
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband",
value_name: Some("Favorites"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Binary blob (REG_BINARY) encoding taskbar-pinned application order. \
Contains embedded Shell Link (LNK) data for each pinned item. \
FavoritesResolve value (same key) stores the resolved path for each entry. \
Attackers may pin malicious tools here to survive reboots, \
or to mimic legitimate application icons. \
Changes to this key indicate a user (or malware) pinned/unpinned an application.",
mitre_techniques: &["T1547.009"],
fields: &[
FieldSchema {
name: "entry_order",
value_type: ValueType::Integer,
description: "Position of pinned item in taskbar order (0-based)",
is_uid_component: false,
},
FieldSchema {
name: "lnk_target",
value_type: ValueType::Text,
description: "Embedded LNK target path for the pinned application",
is_uid_component: true,
},
],
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["jump_list_auto", "lnk_files"],
sources: &["https://github.com/kacos2000/Jumplist-Browser"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static JUMP_LIST_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "jump_list_system",
name: "Jump Lists — System AutomaticDestinations",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\ProgramData\Microsoft\Windows\Recent\AutomaticDestinations\"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "System-scope jump lists shared across all users; distinct from per-user \
%APPDATA% copies. Each .automaticDestinations-ms is an OLE CFB containing \
a DestList stream (AppID → target MRU) plus embedded LNK blocks.",
mitre_techniques: &["T1547.009", "T1070.004"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["jump_list_auto", "jump_list_custom"],
sources: &[
"https://www.sans.org/blog/computer-forensics-windows-7-jump-lists/",
"https://windowsir.blogspot.com/2011/05/jump-lists-in-win7.html",
"https://github.com/EricZimmerman/JLECmd",
"https://github.com/EricZimmerman/JumpList",
"https://forensics.wiki/jump_lists/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static LNK_FILES_OFFICE: ArtifactDescriptor = ArtifactDescriptor {
id: "lnk_files_office",
name: "Office Recent LNK Files",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"%APPDATA%\Microsoft\Office\Recent\"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Office-specific shell link files created for every document opened via Office. \
Separate from Windows Recent; survives clearing of Windows Recent Items. \
Reveals document access including network shares and USB paths.",
mitre_techniques: &["T1547.009", "T1070.004"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["lnk_files", "mru_recent_docs"],
sources: &[
"https://www.sans.org/blog/lnk-files-analysis-in-windows/",
"https://windowsir.blogspot.com/2009/01/lnk-files-are-your-friends.html",
"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/",
"https://www.magnetforensics.com/blog/forensic-analysis-of-lnk-files/",
"https://github.com/EricZimmerman/LECmd",
"https://github.com/EricZimmerman/Lnk",
"https://forensics.wiki/lnk/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static PREFETCH_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "executable_name",
description: "Name of the prefetched executable (up to 29 UTF-16 chars from SCCA header offset 0x10)",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
// SCCA header offset 0x0000: u32 LE.
// Selects correct timestamp-array and run-count offsets.
// Source: https://github.com/kacos2000/Prefetch-Browser
name: "format_version",
description: "SCCA format version: 17=XP/2003, 23=Vista/7, 26=Win8, 30/31=Win10/11",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "run_count",
description: "Cumulative execution count (offset varies by format_version)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "last_run_time",
description: "Most recent execution timestamp (FILETIME UTC, 100ns precision)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
name: "previous_run_times",
description: "Up to 7 prior execution timestamps (FILETIME array, v26/30/31 only)",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "volume_path",
description: "Volume device path string (e.g. \\DEVICE\\HARDDISKVOLUME3) from Volumes Information block",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
// Volumes Information block per-volume FILETIME at relative offset +8.
// Pivot: matches $MFT $Volume_Information creation time for origin identification.
// Source: https://github.com/kacos2000/Prefetch-Browser
name: "volume_creation_time",
description: "FILETIME (UTC) when the source volume was created; pivot to $MFT $Volume_Information",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
// Volumes Information block per-volume u32 at relative offset +0x10.
// Source: https://github.com/kacos2000/Prefetch-Browser
name: "volume_serial_number",
description: "u32 volume serial number from Volumes Information; corroborates $VOLUME_INFORMATION in $MFT",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "referenced_files",
description: "Full device paths of DLLs and files loaded during first 10 seconds of execution",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
// File Metrics entry field. Present only when entry flag bit 0x100 is set.
// 48-bit value: upper 48 bits of the NTFS FileReference u64.
// Source: https://github.com/kacos2000/Prefetch-Browser
name: "mft_record_number",
description: "48-bit MFT record number of a referenced file (File Metrics flag 0x100); pivot to $MFT for timestomping detection",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "prefetch_hash",
description: "8-hex SCCA path hash at header offset 0x4C (LE u32 of full executable device path)",
value_type: ValueType::Text,
is_uid_component: true,
},
];
pub static PREFETCH_FILE: ArtifactDescriptor = ArtifactDescriptor {
id: "prefetch_file",
name: "Prefetch File (.pf)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\Prefetch\*.pf"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Binary execution record: executable name, 8-run-timestamp history (Win8+), \
run count, path hash, and referenced DLL list. Win10+ files are MAM-compressed \
(4-byte magic 0x4D 0x41 0x4D 0x04) — decompress with xpress_huff before parsing. \
Versions: v17 (XP), v23 (Vista/7), v26 (Win8), v30/v31 (Win10+).",
mitre_techniques: &["T1059", "T1070.004"],
fields: PREFETCH_FIELDS,
retention: Some("128 entries; oldest evicted"),
triage_priority: TriagePriority::High,
related_artifacts: &[
"shimcache",
"amcache_app_file",
"evtx_security",
"srum_app_resource",
],
sources: &[
"https://www.sans.org/blog/computer-forensic-artifacts-windows-7-prefetch-files/",
"https://13cubed.com/downloads/Windows_Forensic_Analysis_Poster.pdf",
"https://isc.sans.edu/diary/Forensic+Value+of+Prefetch/29168",
"https://www.magnetforensics.com/blog/forensic-analysis-of-prefetch-files-in-windows/",
"https://github.com/EricZimmerman/PECmd",
"https://github.com/EricZimmerman/Prefetch",
// kacos2000/Prefetch-Browser: MAM compressed wrapper, Volumes Information block,
// File Metrics MFT reference flag 0x100, per-version SCCA field offsets
"https://github.com/kacos2000/Prefetch-Browser",
// libscca: authoritative SCCA format specification (all versions)
"https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
// Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
"https://training.13cubed.com/p/courses/investigating-windows-endpoints",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Prefetch is disabled by default on Windows Server; absence does not imply non-execution on server systems",
"Prefetch can be disabled on workstations via registry (EnablePrefetcher=0); absence does not prove non-execution",
"Volume Serial Number embedded in .pf files can link an executable to a specific removable media source",
"SDelete's own .pf file records the full list of files it deleted — anti-forensic tool use leaves execution evidence of the deletion itself",
"Deleting .pf files with Shift+Delete bypasses the Recycle Bin but leaves recoverable MFT entries; USN Journal also records the deletion",
"Win10+ stores up to 8 last-run timestamps per .pf file; Win7/8 stores only 1 — a single .pf covers broader history on modern Windows",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Max 1024 entries, FIFO eviction on Win10+",
};
pub(crate) static SRUM_NET_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id",
description: "Application identifier (path or service name)",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "user_id",
description: "SID of the user account",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
description: "ESE column TimeStamp (UTC)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
name: "bytes_sent",
description: "Total bytes sent by this app in the interval",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "bytes_received",
description: "Total bytes received by this app in the interval",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "interface_luid",
description: "Network interface LUID (resolve to adapter name via registry)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
// ESE column: L2ProfileId. Present only when interface is wireless.
// Null/zero for wired (ethernet) sessions.
// Source: https://github.com/MarkBaggett/srum-dump
name: "l2_profile_id",
description: "Wireless SSID (L2ProfileId) when network is WiFi; null for ethernet",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static SRUM_NETWORK_USAGE: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_network_usage",
name: "SRUM Network Data Usage Table",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{973F5D5C-1D90-4944-BE8E-24B94231A174}"),
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning:
"ESE table {973F5D5C-1D90-4944-BE8E-24B94231A174} records per-app bytes sent/received \
per network interface per hour. ~30-day retention. Proves data exfiltration volume \
even after log deletion; correlate AppId + UserId + BytesSent for exfil attribution.",
mitre_techniques: &["T1049", "T1048"],
fields: SRUM_NET_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["evtx_security", "srum_app_resource", "prefetch_file"],
sources: &[
"https://www.sans.org/white-papers/36660/",
"https://www.sans.org/blog/srum-forensics/",
"https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
"https://github.com/EricZimmerman/Srum",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Aggregated bytes sent/received per process; not per-connection detail",
"Clock skew between SRUM and event logs possible",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "SRUM network table; rotated by Windows on schedule",
};
/// SRUM Network Connections table field schema.
///
/// ESE column names from srum-dump (github.com/MarkBaggett/srum-dump).
/// `interface_type` values: 6 = ethernet, 71 = 802.11 wireless.
pub(crate) static SRUM_NET_CONN_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id",
description: "Application identifier (path or service name)",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "user_id",
description: "SID of the user account",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
description: "Connection start time (UTC)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
// InterfaceType ESE column. 6 = IF_TYPE_ETHERNET_CSMACD, 71 = IF_TYPE_IEEE80211.
// Source: https://github.com/MarkBaggett/srum-dump
name: "interface_type",
description: "Network interface type: 6=ethernet, 71=wireless (802.11)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
// ConnectedTime ESE column. Duration of the network session in seconds.
// Source: https://github.com/MarkBaggett/srum-dump
name: "connected_time",
description: "Duration of the network connection in seconds",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "l2_profile_id",
description: "Wireless SSID when interface is WiFi; null for ethernet",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "l2_profile_flags",
description: "Wireless profile flags (0 = managed/infrastructure, 1 = ad-hoc)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
];
/// SRUM Network Connections table — per-app connection-level timeline (Win8+).
///
/// ESE table `{DD6636C4-8929-4683-974E-22C046A43763}` records one row per
/// network connection attempt by each application. Distinct from Network Data
/// Usage (`{973F5D5C-...}`) which records bytes; this table records *when*
/// connections happened and *which type* of network (ethernet vs WiFi).
///
/// Key forensic pivot: interface_type=71 (wireless) rows with a specific
/// `l2_profile_id` SSID reveal which WiFi network was in use during malicious
/// activity — correlates with location (home, hotel, airport, VPN-bypass).
pub static SRUM_NETWORK_CONNECTIONS: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_network_connections",
name: "SRUM Network Connections Table",
artifact_type: ArtifactLocation::EseDatabase,
hive: None,
key_path: "",
value_name: None,
file_path: Some(
r"C:\Windows\System32\sru\SRUDB.dat:{DD6636C4-8929-4683-974E-22C046A43763}",
),
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning: "ESE table {DD6636C4-8929-4683-974E-22C046A43763} records per-app \
connection start time, interface type (ethernet/WiFi), duration, and SSID. \
Proves which WiFi network was in use during execution — geo-context \
for lateral movement and exfil timeline.",
mitre_techniques: &["T1049", "T1048"],
fields: SRUM_NET_CONN_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::High,
related_artifacts: &["srum_network_usage", "srum_app_resource", "networklist_profiles"],
sources: &[
"https://github.com/MarkBaggett/srum-dump",
"https://www.sans.org/white-papers/36660/",
"https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static SRUM_APP_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id",
description: "Application path or service name",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "user_id",
description: "SID of the user account",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
description: "Interval timestamp (UTC)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
name: "foreground_cpu_time",
description: "CPU time used in foreground (100ns units)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "background_cpu_time",
description: "CPU time used in background (100ns units)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "foreground_cycles",
description: "CPU cycle count in foreground",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "background_cycles",
description: "CPU cycle count in background",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
];
pub static SRUM_APP_RESOURCE: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_app_resource",
name: "SRUM Application Resource Usage Table",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}"),
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning: "ESE table {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89} records per-app CPU cycles \
(foreground + background) per hour per user. Proves execution even without Prefetch \
or Event Log entries — CPU cycles are non-zero only if the process actually ran.",
mitre_techniques: &["T1059", "T1070.004"],
fields: SRUM_APP_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["srum_network_usage", "prefetch_file", "evtx_security"],
sources: &[
"https://www.sans.org/white-papers/36660/",
"https://www.sans.org/blog/srum-forensics/",
"https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
"https://github.com/EricZimmerman/Srum",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &["CPU and memory usage metrics; useful for corroborating execution, not proving it"],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "SRUM ESE database; rotated by Windows on schedule",
};
pub(crate) static SRUM_ENERGY_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id",
description: "Application path",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "user_id",
description: "SID of the user account",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
description: "Interval timestamp (UTC)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
name: "charge_level",
description: "Battery charge level at sample time",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "designed_capacity",
description: "Battery designed capacity (mWh)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "full_charge_capacity",
description: "Current full charge capacity (mWh)",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
];
pub static SRUM_ENERGY_USAGE: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_energy_usage",
name: "SRUM Energy Usage Table",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{FEE4E14F-02A9-4550-B5CE-5FA2DA202E37}"),
scope: DataScope::System,
os_scope: OsScope::Win8Plus,
decoder: Decoder::Identity,
meaning: "ESE table {FEE4E14F-02A9-4550-B5CE-5FA2DA202E37} records battery charge levels \
at each sampling interval — enables timeline reconstruction of device on/off events \
and correlates app activity with physical device presence.",
mitre_techniques: &["T1059"],
fields: SRUM_ENERGY_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/white-papers/36660/",
"https://github.com/EricZimmerman/Srum",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static SRUM_PUSH_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id",
description: "Application that received notification",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "user_id",
description: "SID of the user account",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
description: "Notification timestamp (UTC)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
name: "notification_type",
description: "WNS notification type code",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
FieldSchema {
name: "payload_size",
description: "Notification payload size in bytes",
value_type: ValueType::UnsignedInt,
is_uid_component: false,
},
];
pub static SRUM_PUSH_NOTIFICATION: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_push_notification",
name: "SRUM Push Notification Activity Table",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{D10CA2FE-6FCF-4F6D-848E-B2E99266FA86}"),
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "ESE table {D10CA2FE-6FCF-4F6D-848E-B2E99266FA86} records Windows Push Notification \
(WNS) activity per app — reveals C2-style notification-triggered execution in \
malicious UWP/PWA apps and confirms app network activity.",
mitre_techniques: &["T1059"],
fields: SRUM_PUSH_FIELDS,
retention: Some("~30 days"),
triage_priority: TriagePriority::High,
related_artifacts: &[],
sources: &[
"https://www.sans.org/white-papers/36660/",
"https://github.com/EricZimmerman/Srum",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static EVTX_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "event_id",
description: "Windows Event ID",
value_type: ValueType::UnsignedInt,
is_uid_component: true,
},
FieldSchema {
name: "timestamp",
description: "Event timestamp (UTC)",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
FieldSchema {
name: "computer",
description: "Source computer name",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "subject_user_sid",
description: "SID of the subject user",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "subject_user_name",
description: "Username of the subject",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "message",
description: "Full event message XML",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static EVTX_SECURITY: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_security",
name: "Security Event Log (Security.evtx)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\winevt\Logs\Security.evtx"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Primary security audit log. Key event IDs: 4624/4625 (logon success/fail), \
4634/4647 (logoff), 4648 (explicit-cred logon), 4688/4689 (process create/exit), \
4698/4702 (scheduled task create/modify), 4720/4732 (account create/group add), \
4616 (system time change — primary timestomping/clock-manipulation indicator; \
records user, previous time, new time, and process that changed the clock; \
back-dated logon records and impossible session durations are downstream symptoms), \
5152 (WFP blocked a packet — pivot for EDR-silencer detection and inbound \
recon/exploitation; source IP recorded but direction is usually inbound), \
5379 (Credential Manager credential read — detects tools like CredentialsFileView harvesting stored passwords), \
4776 (NTLM credential validation — 'The computer attempted to validate the credentials \
for an account'; generated ONLY on the computer authoritative for the account: the DC \
for domain accounts, the local machine for local accounts. Records the Logon Account and \
the SOURCE Workstation the NTLM auth came FROM (never the destination server), plus a \
Status code (0x0 success, 0xC000006A bad password, 0xC0000234 locked). On a DC this is a \
central view of all NTLM auth for domain accounts including the source workstation — a \
primary pass-the-hash / NTLM lateral-movement pivot that 4624 alone does not give), \
5140 (network share object accessed — Audit File Share; ShareName in \\\\*\\SHARE form, so \
admin-share access shows as \\\\*\\C$, \\\\*\\ADMIN$, \\\\*\\IPC$ — an SMB admin-share \
lateral-movement signal when the Source IpAddress is a remote host), \
5145 (detailed network share object check — Audit Detailed File Share, off by default and \
high-volume; fires per file/folder with RelativeTargetName + a fuller AccessMask and an \
AccessReason SDDL trail, giving file-level visibility of what a remote account touched over \
SMB, e.g. staged tools or exfiltrated files under an admin share), \
1102 (audit log cleared — high-priority anti-forensics indicator).",
mitre_techniques: &["T1070.001", "T1059", "T1078", "T1555", "T1550.002", "T1021.002", "T1021.001", "T1039"],
fields: EVTX_FIELDS,
retention: Some("configurable; default ~20MB rolling per channel"),
triage_priority: TriagePriority::Critical,
related_artifacts: &[
"srum_network_usage",
"srum_app_resource",
"prefetch_file",
"shimcache",
],
sources: &[
"https://www.sans.org/posters/windows-forensic-analysis/",
// Microsoft — Event 4776 (NTLM credential validation): Logon Account + Source Workstation + Status:
"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776",
// Microsoft — Event 5140 (network share accessed): IpAddress, ShareName (\\*\SHARE), ShareLocalPath:
"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140",
// Microsoft — Event 5145 (detailed file share): RelativeTargetName, Accesses, AccessReason:
"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145",
// Microsoft — Event 4624 LogonType table + Source Network Address:
"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624",
"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-security-audit-policies",
"https://www.13cubed.com/downloads/windows_event_log_cheat_sheet.pdf",
"https://www.magnetforensics.com/blog/the-importance-of-powershell-logs-in-digital-forensics/",
"https://github.com/EricZimmerman/evtx",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.3_Windows_Event_Core.md",
// Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152
// — Microsoft documents Event 5152 (Windows Filtering Platform blocked a
// packet); fields include Process ID, Direction, Source/Destination
// address+port, Protocol, Filter Run-Time ID, Layer Name+Run-Time ID.
"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152",
// Source: https://windowsir.blogspot.com/2023/08/events-ripper-updates.html
// — Carvey adds filter.pl Events Ripper plugin for 5152 (WFP packet
// block) as analyst pivot; called out as "may see connection
// attempts from other subnets, or from public IP addresses".
"https://windowsir.blogspot.com/2023/08/events-ripper-updates.html",
// Source: https://windowsir.blogspot.com/2023/06/events-ripper-update.html
// — Carvey adds timechange.pl Events Ripper plugin for Event ID 4616
// (Security-Auditing system time change). Investigation surfaced
// back-dated Security Event Log records (logons in 2020 on a 2024
// image) and negative session durations as downstream symptoms of
// clock manipulation; 4616 is the host artifact that records who
// changed the clock, from what to what, via which process.
"https://windowsir.blogspot.com/2023/06/events-ripper-update.html",
// Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616
// — Microsoft documents Event 4616 fields: SubjectUserSid,
// SubjectUserName, SubjectDomainName, SubjectLogonId,
// PreviousTime, NewTime, ProcessName, ProcessId.
"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616",
// Source: Ahmed Thabit / Ahmed Abdo, LinkedIn (2025) — tested on Windows 10 Pro 20H2.
// Event 4624 WorkstationName is populated by the authenticating client for Type 3
// (Network/SMB) but by the destination host for Type 10 (RDP without NLA). Using
// WorkstationName as the source in RDP investigations misattributes the victim
// machine as the actor. Reproduced in EvtxECmd "Remote Host" column and Events-Ripper
// sessions/logins plugins. Always use IpAddress for Type 10 source attribution.
"https://www.linkedin.com/posts/ahmed-thabit_dfir-digitalforensics-incidentresponse-activity",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Log can be cleared (event 1102/104); absence of log is itself evidence",
"Requires appropriate audit policy to be enabled",
"Event 4624 WorkstationName semantics differ by logon type: \
Type 3 (Network/SMB) — WorkstationName = source machine; \
Type 10 (RDP without NLA) — WorkstationName = destination machine, not source. \
For RDP source attribution always use IpAddress (Source Network Address), \
never WorkstationName alone. Using WorkstationName as the source on a Type 10 \
event misattributes the victim host as the actor.",
"Event 4624 LogonType isolates the logon vector for a lateral-movement timeline: Type 3 \
(Network) = authenticated to this host from the network — the inbound SMB / net-use / \
admin-share (C$/ADMIN$/IPC$) and pass-the-hash vector; Type 10 (RemoteInteractive) = Terminal \
Services / RDP; Type 2 (Interactive) = local console. Filtering Security.evtx 4624 by LogonType \
separates remote network auth (Type 3) from RDP (Type 10) and local logons (Type 2) when \
reconstructing how an actor moved between hosts. Key logon types (Microsoft): 2 Interactive, \
3 Network, 4 Batch, 5 Service, 7 Unlock, 8 NetworkCleartext, 9 NewCredentials, \
10 RemoteInteractive, 11 CachedInteractive.",
"Event 4776 is generated only on the account-authoritative host (DC for domain accounts) and \
records the SOURCE workstation, not the destination — it also fires on workstation-unlock and \
does NOT fire when a domain account logs on locally at a DC; a Type-3 4624 alone does not \
attribute the NTLM source the way DC-side 4776 does",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Circular EVTX log; default 128 MB max",
};
pub static EVTX_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_system",
name: "System Event Log (System.evtx)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\winevt\Logs\System.evtx"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning:
"System-level events. Key IDs: 7045 (service installed), 7036 (service state change), \
7031 (Service Control Manager — service crash; analyst pivot for \
EDR/AV agent tamper attempts and failed persistence-via-service installs), \
6005/6006 (event log start/stop — boot/shutdown boundary), \
104 (System log cleared). Service installation (7045) is a primary \
lateral-movement and persistence indicator. Attackers abuse sc.exe to create services \
whose binPath uses %COMSPEC% to launch powershell.exe with -encodedcommand and \
-w hidden flags, embedding base64-encoded (often UTF-16LE or gzip-compressed) \
payloads directly in the event log entry. Subsequent Event IDs 7000 and 7009 \
(service timeout/failure) are misleading — the PowerShell payload still executes \
successfully even when Windows reports the service failed to start. \
DistributedCOM (Source: Microsoft-Windows-DistributedCOM) also writes DCOM \
activation-permission events, relevant to DCOM lateral movement (T1021.003 — abuse of \
MMC20.Application / ShellWindows / ShellBrowserWindow / Excel.Application objects). Event \
10036 is SERVER-SIDE ('The server-side authentication level policy does not allow the \
user <DOMAIN>\\<user> SID (<SID>) from address <IP> to activate DCOM server') and, as a \
by-product of the CVE-2021-26414 DCOM hardening (KB5004442; \
RequireIntegrityActivationAuthenticationLevel DWORD under \
HKLM\\SOFTWARE\\Microsoft\\Ole\\AppCompat), records the SOURCE IP and SID of a remote \
DCOM activation attempt — an activation-source pivot even when the activation is blocked. \
Its client-side counterparts are 10037 (explicitly-set auth level) and 10038 (default \
auth level). Event 10016 records a denied DCOM activation-permission grant (CLSID, APPID, \
user SID, 'from address') but is overwhelmingly benign by-design noise — Microsoft \
documents the LocalHost/LRPC records for NT AUTHORITY\\LOCAL SERVICE / SYSTEM against \
ShellExperienceHost and generic shell CLSIDs as expected and safely ignored. Filter \
10016/10036 to the forensic subset: 'from address' = a REMOTE host (not LocalHost / \
(Using LRPC)) paired with an interactive or domain user SID and a non-standard CLSID.",
mitre_techniques: &["T1543.003", "T1070.001", "T1059.001", "T1021.003"],
fields: EVTX_FIELDS,
retention: Some("configurable; default ~20MB rolling per channel"),
triage_priority: TriagePriority::High,
related_artifacts: &["evtx_security", "scheduled_tasks_dir", "services_imagepath"],
sources: &[
"https://www.sans.org/posters/windows-forensic-analysis/",
"https://learn.microsoft.com/en-us/windows/win32/eventlog/event-logging",
"https://github.com/EricZimmerman/evtx",
// Microsoft: Event 10016 (DistributedCOM) fields CLSID/APPID/SID/from-address;
// states LocalHost/LRPC records for LOCAL SERVICE/SYSTEM are by-design "can be safely ignored":
"https://learn.microsoft.com/en-us/troubleshoot/windows-client/application-management/event-10016-logged-when-accessing-dcom",
// Microsoft KB5004442 (CVE-2021-26414 DCOM hardening): server-side Event 10036 text incl.
// "from address" (client IP) + RequireIntegrityActivationAuthenticationLevel:
"https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c",
// Source: https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html
// — PowerShell-as-service abuse via 7045, misleading 7000/7009 errors,
// base64+gzip deobfuscation chain
"https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html",
// Source: https://windowsir.blogspot.com/2023/08/events-ripper-updates.html
// — Carvey adds scm.pl Events Ripper plugin checking for SCM/7031
// (service crash) as analyst pivot; explicitly excludes 7039 due
// to noise.
"https://windowsir.blogspot.com/2023/08/events-ripper-updates.html",
// Source: https://www.manageengine.com/products/eventlog/kb/event-7031-service-crash-help.html
// — ManageEngine documents SCM Event ID 7031 service crash semantics
// referenced by Carvey's scm.pl plugin.
"https://www.manageengine.com/products/eventlog/kb/event-7031-service-crash-help.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Service install/start events useful; can be noisy with false positives"],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Circular EVTX log; default 20 MB max",
};
pub static EVTX_APPLICATION_MSIINSTALLER: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_application_msiinstaller",
name: "Application Event Log — MsiInstaller Provider",
artifact_type: ArtifactLocation::EventLog,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\winevt\Logs\Application.evtx"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Records written to Application.evtx by the Microsoft Installer \
service (Source: MsiInstaller) on every MSI install/uninstall/reconfigure. \
Key host-based artifact for MSI-borne malware (Raspberry Robin, USB-LNK \
droppers that invoke `msiexec.exe /i <url>`, malicious .msi sideloading) \
that open reports routinely omit. Key Event IDs: \
1022 (product update applied), 1033 (install completed — Product Name, \
Product Version, Manufacturer, Install Success/Failure), \
1034 (product removal completed), 1035 (configuration change), \
1036 (windows installer reconfigured), 1040 (transaction begun), \
1042 (transaction ended), 11707 (Installer completed installation \
successfully — friendly product name and language ID), 11708 \
(Installer failed — exit code in event payload), 11724 (uninstall \
succeeded). The MsiInstaller provider records persist in \
Application.evtx independent of msiexec.exe Prefetch evidence and \
survive Defender removal of the dropped MSI itself.",
mitre_techniques: &["T1218.007", "T1204.002", "T1091"],
fields: EVTX_FIELDS,
retention: Some("configurable; Application.evtx default ~20MB rolling"),
triage_priority: TriagePriority::High,
related_artifacts: &[
"evtx_application",
"run_key_hkcu_once",
"run_key_hklm_once",
"prefetch_file",
],
sources: &[
// Source: https://www.huntress.com/blog/evolution-of-usb-borne-malware-raspberry-robin
// — Huntress documents MsiInstaller records (Source=MsiInstaller, Event ID
// 1040/1042/11707) generated by Raspberry Robin's `msiexec /q /i <URL>`
// chain; explicitly cited by Carvey as the gap in Red Canary's coverage.
"https://www.huntress.com/blog/evolution-of-usb-borne-malware-raspberry-robin",
// Source: https://windowsir.blogspot.com/2023/09/the-state-of-windows-digital-analysis_19.html
// — Carvey, "The State of Windows Digital Analysis, pt II"; calls out that
// Red Canary, Cybereason, and Microsoft Raspberry Robin reports all
// miss the MsiInstaller Application Event Log records.
"https://windowsir.blogspot.com/2023/09/the-state-of-windows-digital-analysis_19.html",
// Source: https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
// — Microsoft documents the MsiInstaller event source, log channel, and
// the canonical IDs (1022/1033/1034/1035/1036/1040/1042/11707/11708/11724).
"https://learn.microsoft.com/en-us/windows/win32/msi/event-logging",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static EVTX_POWERSHELL: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_powershell",
name: "PowerShell Operational Log",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(
r"C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx",
),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning:
"PowerShell script execution telemetry. Event 4103 (module logging — pipeline output), \
4104 (ScriptBlock logging — full script text including deobfuscated content). \
4104 captures AMSI-deobfuscated scripts even when encoded; \
highest-fidelity PS forensic source when enabled.",
mitre_techniques: &["T1059.001", "T1027"],
fields: EVTX_FIELDS,
retention: Some("configurable; default ~20MB rolling per channel"),
triage_priority: TriagePriority::High,
related_artifacts: &[
"evtx_security",
"powershell_history",
"powershell_profile_all",
],
sources: &[
"https://www.sans.org/blog/detecting-malicious-powershell/",
"https://redcanary.com/threat-detection-report/techniques/t1059.001/",
"https://github.com/EricZimmerman/evtx",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Requires script block logging to be enabled (4104)",
"AMSI bypass can prevent logging of obfuscated content",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Circular EVTX log; oldest events overwritten at max size",
};
pub static EVTX_SYSMON: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_sysmon",
name: "Sysmon Operational Log",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx"),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning:
"Sysmon telemetry (requires deployment). Event 1 (process create + hashes + cmdline), \
3 (network connection), 7 (image load), 8 (CreateRemoteThread), \
10 (ProcessAccess — LSASS reads), 11 (file create), 22 (DNS query). \
Gold standard for EDR-quality forensics without commercial tooling.",
mitre_techniques: &["T1059", "T1055", "T1003.001"],
fields: EVTX_FIELDS,
retention: Some("configurable; default ~20MB rolling per channel"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["evtx_security", "prefetch_file", "srum_app_resource"],
sources: &[
"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
"https://www.sans.org/blog/threat-hunting-using-sysmon/",
"https://www.thedfirspot.com/post/sysmon-when-visibility-is-key",
"https://github.com/EricZimmerman/evtx",
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.3_Windows_Event_Core.md",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Requires Sysmon to be installed and configured",
"Sysmon config determines what is logged",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "Circular EVTX log; size depends on Sysmon config",
};
/// Microsoft-Windows-Windows Defender/Operational — Microsoft Defender AV
/// telemetry channel (separate from Application.evtx).
///
/// Carvey ("Events Ripper Updates", windowsir.blogspot.com, 2023-08-02)
/// added a `defender.pl` plugin that pivots on Event ID 2050 because it
/// fingerprints exactly which file path + hash Defender shipped to the
/// MAPS cloud — high-value DFIR pivot when the dropped binary has been
/// deleted post-infection. Event 2051 is the negative pair (sample could
/// not be uploaded). The 1116/1117 (malware detected/blocked) plus 5001
/// (real-time protection disabled) and 5007 (config changed) IDs are
/// the classic AV-disable + detection pivots.
pub static EVTX_DEFENDER_OPERATIONAL: ArtifactDescriptor = ArtifactDescriptor {
id: "evtx_defender_operational",
name: "Microsoft-Windows-Windows Defender/Operational",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(
r"C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx",
),
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning:
"Microsoft Defender AV operational telemetry (separate channel from Application.evtx). \
Key Event IDs: 1116 (malware detected — name, severity, file path, user context), \
1117 (malware action taken — quarantined/cleaned/removed), \
1118/1119 (action failed/critically failed — file still on disk), \
2050 (sample uploaded to MAPS cloud — file name and hash recorded; \
high-value DFIR pivot when the dropped binary has been deleted), \
2051 (sample could NOT be uploaded — sometimes indicates the \
sample was already exfiltrated/deleted before MAPS submission), \
5001 (real-time protection disabled — primary AV-tamper indicator), \
5004/5007 (real-time protection config / Defender config changed — \
attackers add path/process exclusions before dropping malware), \
5010 (scanning for malware disabled), 5012 (scanning for viruses disabled). \
Channel survives the dropped malware itself: 2050's file-hash record \
is often the only artifact left after the malware has been cleaned.",
mitre_techniques: &["T1562.001", "T1059", "T1027"],
fields: EVTX_FIELDS,
retention: Some("configurable; default ~1MB rolling per channel"),
triage_priority: TriagePriority::High,
related_artifacts: &[
"evtx_security",
"evtx_application",
"evtx_application_msiinstaller",
"prefetch_file",
],
sources: &[
// Source: https://windowsir.blogspot.com/2023/08/events-ripper-updates.html
// — Carvey adds defender.pl Events Ripper plugin for 2050 (sample
// uploaded to MAPS) recording file path + hash; pairs with 2051
// (cannot upload) from his earlier 2022 post.
"https://windowsir.blogspot.com/2023/08/events-ripper-updates.html",
// Source: https://windowsir.blogspot.com/2022/10/events-ripper.html
// — Carvey's earlier 2022 Events Ripper post introducing the 2051
// "could not send sample" pivot referenced by the 2023-08 update.
"https://windowsir.blogspot.com/2022/10/events-ripper.html",
// Source: https://kirannr.com/2020/07/02/__trashed/
// — Kiran NR documents Defender Event 2050 ("Every time Windows
// Defender AV...") records the file name and hash on every
// MAPS submission, the basis for Carvey's defender.pl pivot.
"https://kirannr.com/2020/07/02/__trashed/",
// Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
// — Microsoft documents the Microsoft-Windows-Windows Defender/Operational
// channel and the canonical Defender event ID set (1116, 1117,
// 2050, 5001, 5007, etc.).
"https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus",
"https://github.com/EricZimmerman/evtx",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static TYPED_PATHS_FIELDS: &[FieldSchema] = &[FieldSchema {
name: "typed_path",
description: "Path manually entered into Explorer address bar history",
value_type: ValueType::Text,
is_uid_component: true,
}];
pub static TYPED_PATHS: ArtifactDescriptor = ArtifactDescriptor {
id: "typed_paths",
name: "Explorer Typed Paths",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Explorer address-bar history of manually entered local, removable, UNC, or shell paths; useful for proving interactive navigation to shares and staged locations.",
mitre_techniques: &["T1083", "T1135"],
fields: TYPED_PATHS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["typed_urls", "opensave_mru", "lastvisited_mru"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/typed_paths.py",
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static RUN_MRU_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "mru_order",
description: "Run dialog MRU letter ordering string",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "command",
description: "Command line entered via the Run dialog",
value_type: ValueType::Text,
is_uid_component: true,
},
];
pub static RUN_MRU: ArtifactDescriptor = ArtifactDescriptor {
id: "run_mru",
name: "Run Dialog MRU",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "History of commands launched from the Windows Run dialog, including the user-maintained MRU ordering string and typed execution targets.",
mitre_techniques: &["T1059"],
fields: RUN_MRU_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["wordwheel_query", "powershell_history", "prefetch_file"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/runmru.py",
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
"https://github.com/EricZimmerman/RegistryPlugins/blob/master/RegistryPlugin.RunMRU/RunMRU.cs",
],
evidence_strength: None,
evidence_caveats: &[
"Each command value ends with a trailing \\1 marker (backslash + '1'); it is a storage/terminator artifact appended by Explorer, not part of the user-typed command — strip it before display (EZ RunMRU.cs strips the literal \\1, regipy strips a 0x01 byte; the two tools disagree on the exact byte form, but either way it is a terminator, not typed text)",
"Command entries use single-character value names (a, b, c, …); the separate MRUList value is an ordering string of those letters whose FIRST character identifies the most recently used entry. Only that most-recent entry can be time-anchored to the key's LastWrite time — the remaining entries carry no individual timestamp",
],
volatility: None,
volatility_rationale: "",
};
pub(crate) static NETWORK_DRIVES_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "drive_letter",
description: "Mapped drive letter under HKCU\\Network",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "remote_path",
description: "UNC path of the mapped network drive",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static NETWORK_DRIVES: ArtifactDescriptor = ArtifactDescriptor {
id: "network_drives",
name: "Mapped Network Drives",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Network",
value_name: Some("RemotePath"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Per-user mapped network drives including drive letter to UNC mapping; useful for share-access reconstruction and lateral movement scoping.",
mitre_techniques: &["T1135"],
fields: NETWORK_DRIVES_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["rdp_client_servers", "networklist_profiles"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/network_drives.py",
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Mapped drive destinations reveal lateral movement targets; UNC paths may expose internal host names"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Mapped drive registry entry; persists until unmapped",
};
pub(crate) static APP_PATHS_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "application",
description: "Executable name registered under App Paths",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "path",
description: "Default executable path resolved for the application name",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "architecture",
description: "Architecture bucket inferred from x64 or Wow6432Node path",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static APP_PATHS: ArtifactDescriptor = ArtifactDescriptor {
id: "app_paths",
name: "App Paths Registry Entries",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows\CurrentVersion\App Paths",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Executable name resolution entries under App Paths and Wow6432Node App Paths; useful for installed-software discovery and hijack-style execution redirection review.",
mitre_techniques: &["T1574"],
fields: APP_PATHS_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["services_imagepath", "winlogon_shell"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/software/apppaths.py",
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static MOUNTED_DEVICES_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "value_name",
description: "MountedDevices value name such as a drive letter or volume GUID",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "mount_point",
description: "Resolved drive letter or volume mount point",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "device_path",
description: "Decoded device path or partition signature data",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "usb_serial",
description: "USB device iSerialNumber decoded from the REG_BINARY device path — the instance-ID segment (<serial>&0) that precedes the trailing #{volume-interface GUID}; joins to the USBSTOR instance ID under SYSTEM\\CurrentControlSet\\Enum\\USBSTOR. A serial whose second character is '&' is generally a Windows-generated (non-unique) identifier for a device lacking a spec-compliant unique serial",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "volume_guid",
description: "Volume GUID from a \\??\\Volume{GUID} value name; the same GUID appears as a subkey under each user's NTUSER MountPoints2, which is the join that attributes the device to a specific user account",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static MOUNTED_DEVICES: ArtifactDescriptor = ArtifactDescriptor {
id: "mounted_devices",
name: "Mounted Devices",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"MountedDevices",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Drive-letter and volume mappings under HKLM\\SYSTEM\\MountedDevices. Value names are either \\DosDevices\\<letter>: (a drive-letter assignment) or \\??\\Volume{GUID} (a volume record); the REG_BINARY data is a UTF-16-LE device path whose trailing {53f5630d-b6bf-11d0-94f2-00a0c91efb8b} is GUID_DEVINTERFACE_VOLUME (MOUNTDEV_MOUNTED_DEVICE_GUID). Supports two attribution joins for removable-media analysis: (1) device serial → drive letter / Volume GUID — the USBSTOR iSerialNumber embedded in the device path links a \\DosDevices\\<letter>: entry (which letter the device mounted as) and a \\??\\Volume{GUID} entry (its Volume GUID) back to the same physical device in SYSTEM\\...\\Enum\\USBSTOR; (2) Volume GUID → user — the \\??\\Volume{GUID} value's GUID is matched against the subkeys of each user's NTUSER MountPoints2, identifying which user account mounted the device. Non-USBSTOR entries instead carry a 12-byte MBR record (4-byte disk signature + 8-byte partition offset) or a 24-byte GPT record (partition GUID + offset).",
mitre_techniques: &["T1091"],
fields: MOUNTED_DEVICES_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["usb_enum", "wifi_profiles", "usb_stor_enum", "mountpoints2"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/system/mountdev.py",
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
// Microsoft WDK — GUID_DEVINTERFACE_VOLUME / MOUNTDEV_MOUNTED_DEVICE_GUID {53f5630d-...}:
"https://learn.microsoft.com/en-us/windows-hardware/drivers/install/guid-devinterface-volume",
// RegRipper mp2.pl (canonical) — the Volume-GUID -> MountPoints2 user join Analysis Tip:
"https://github.com/keydet89/RegRipper3.0/blob/master/plugins/mp2.pl",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"The two joins attribute a device and a user reliably, but MountedDevices carries no timestamp — pair with USBSTOR/setupapi.dev.log/EMDMgmt for the connection timeline",
"A drive letter is reused across devices over time; the current MountedDevices value reflects only the latest assignment for that letter",
"A device serial whose second character is '&' is generally a Windows-generated (non-unique) identifier, so serial-based device identity is weaker for those devices",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry values in the SYSTEM hive; persist until overwritten by a new assignment or the key is cleared",
};
pub(crate) static NETWORKLIST_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "profile_guid",
description: "GUID of a network profile under NetworkList",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "profile_name",
description: "Human-readable network profile name",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "date_last_connected",
description: "Timestamp of the most recent recorded connection",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
];
pub static NETWORKLIST_PROFILES: ArtifactDescriptor = ArtifactDescriptor {
id: "networklist_profiles",
name: "Network List Profiles",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Network profile history including profile names, categories, and created/last-connected dates for wired and wireless networks.",
mitre_techniques: &["T1016"],
fields: NETWORKLIST_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["wifi_profiles", "network_drives"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/software/networklist.py",
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &["Profile name set by router; can be spoofed by attacker-controlled AP"],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Network profiles persist in registry",
};
pub(crate) static PUTTY_SESSION_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "session_name",
description: "Saved PuTTY session name",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "hostname",
description: "Target host configured in the PuTTY session",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "username",
description: "User name configured for the saved session",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static PUTTY_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
id: "putty_sessions",
name: "PuTTY Saved Sessions",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\SimonTatham\PuTTY\Sessions",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "PuTTY saved sessions, including target hostname, port, protocol, and optional proxy or keyfile settings for SSH and other remote connections.",
mitre_techniques: &["T1021.004"],
fields: PUTTY_SESSION_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["rdp_client_servers", "winscp_saved_sessions"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/putty.py",
"https://the.earth.li/~sgtatham/putty/0.78/htmldoc/AppendixC.html",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static WINSCP_SESSION_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "session_name",
description: "Saved WinSCP session name",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "host_name",
description: "Target host configured in the saved WinSCP session",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "user_name",
description: "User name configured for the saved WinSCP session",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static WINSCP_SAVED_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
id: "winscp_saved_sessions",
name: "WinSCP Saved Sessions",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Martin Prikryl\WinSCP 2\Sessions",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "WinSCP saved sessions, including host, username, protocol, and optionally recoverable obfuscated credentials or connection defaults.",
mitre_techniques: &["T1021.004", "T1555"],
fields: WINSCP_SESSION_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["putty_sessions", "rdp_client_servers"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/winscp_saved_sessions.py",
"https://winscp.net/eng/docs/ui_pref_storage",
"https://az4n6.blogspot.com/2013/03/winscp-saved-password.html",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// WinSCP portable configuration file — lateral movement & exfil staging evidence.
///
/// `WinSCP.ini` is a text-format INI file written by WinSCP at session close.
/// For the **portable** version it sits next to `WinSCP.exe`; for the installed
/// version it is at `%APPDATA%\WinSCP.ini`. Unlike the registry artifact
/// (`winscp_saved_sessions`), this file is written **unconditionally** — even if
/// the user never explicitly saved a session, WinSCP records every host connected
/// to in `[Configuration\CDCache]`.
///
/// Key forensic properties:
/// - `[Configuration\CDCache]` — `user@host=<hex path>` entries survive session
/// deletion; host list is the most reliable lateral-movement indicator
/// - `[Configuration\History\LocalTarget]` — local paths where files were saved
/// from the remote system (exfil staging directories)
/// - `[Configuration\Interface\Commander\LocalPanel] LastPath` — last open local
/// directory; often points directly to exfil staging folder
/// - `[Sessions\*]` — saved sessions with hostname, username, and reversible
/// XOR-obfuscated password; only present if user explicitly saved the session
///
/// Tip: `.ini` mtime − Prefetch last-run-time ≈ session duration.
///
/// # Sources
/// - <https://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html>
/// Full CDCache / LocalTarget / LastPath / Sessions field analysis; SRUM pivot
/// - <https://github.com/winscp/winscp/blob/master/source/core/Security.cpp>
/// Password obfuscation algorithm (XOR, reversible without key)
pub(crate) static WINSCP_INI_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "connected_hosts",
value_type: ValueType::Text,
description: "user@host entries from [Configuration\\CDCache]; \
recorded for every connection regardless of whether the session was saved; \
hex-encoded path suffix is last-accessed path on remote host",
is_uid_component: true,
},
FieldSchema {
name: "local_target_dirs",
value_type: ValueType::Text,
description: "[Configuration\\History\\LocalTarget] — local directories \
where remote files were saved; directly identifies exfil staging paths \
even if files were subsequently deleted",
is_uid_component: true,
},
FieldSchema {
name: "last_local_path",
value_type: ValueType::Text,
description: "[Configuration\\Interface\\Commander\\LocalPanel] LastPath — \
last local directory open at session close; often the exfil staging folder",
is_uid_component: false,
},
FieldSchema {
name: "session_hostname",
value_type: ValueType::Text,
description: "[Sessions\\<name>] HostName — target host of a saved session; \
only present if user explicitly saved the session workspace",
is_uid_component: false,
},
FieldSchema {
name: "session_username",
value_type: ValueType::Text,
description: "[Sessions\\<name>] UserName — account used for the saved session",
is_uid_component: false,
},
FieldSchema {
name: "session_password",
value_type: ValueType::Text,
description: "[Sessions\\<name>] Password — XOR-obfuscated credential; \
reversible without a key per github.com/winscp/winscp source/core/Security.cpp; \
only present in saved sessions",
is_uid_component: false,
},
FieldSchema {
name: "local_directory",
value_type: ValueType::Text,
description: "[Sessions\\<name>] LocalDirectory — local panel path at last save; \
corroborates local_target_dirs",
is_uid_component: false,
},
FieldSchema {
name: "remote_directory",
value_type: ValueType::Text,
description: "[Sessions\\<name>] RemoteDirectory — last accessed path on the \
remote host; pivot to logs on the target system",
is_uid_component: false,
},
];
pub(crate) static WINSCP_INI: ArtifactDescriptor = ArtifactDescriptor {
id: "winscp_ini",
name: "WinSCP INI Configuration File",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("WinSCP.ini"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "WinSCP portable configuration file. Records all hosts connected to \
([Configuration\\CDCache]) even without an explicit session save — making it \
the primary indicator of WinSCP-based lateral movement. Also records local \
directories where remote files were saved ([Configuration\\History\\LocalTarget]), \
revealing exfil staging paths. If sessions were saved, contains target hostnames, \
usernames, and reversible obfuscated passwords. The file is updated at session \
close: .ini last-modified vs. WinSCP.exe Prefetch run-time approximates session \
duration. Correlate with SRUM network-usage table for bytes transferred.",
mitre_techniques: &["T1021.004", "T1048", "T1560"],
fields: WINSCP_INI_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &[
"winscp_saved_sessions",
"srum_network_usage",
"prefetch_file",
],
sources: &[
// Source: CDCache / LocalTarget / LastPath field analysis; SRUM pivot
"https://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html",
// Source: XOR password obfuscation algorithm (reversible without key)
"https://github.com/winscp/winscp/blob/master/source/core/Security.cpp",
"https://winscp.net/eng/docs/ui_pref_storage",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"CDCache records all hosts connected to, but reflects last-session state only; \
entries persist across explicit session deletion but the file itself can be wiped by a cleanup-aware attacker",
"Absence does not prove WinSCP was not used — an attacker may have deleted the file or used a version \
that writes elsewhere (portable build path varies)",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Updated at WinSCP session close; persistent between reboots until manually deleted",
};
pub(crate) static WINRAR_HISTORY_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "operation",
description: "Archive opened, created, or extracted",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "file_path",
description: "Archive or extraction path from WinRAR history",
value_type: ValueType::Text,
is_uid_component: true,
},
];
pub static WINRAR_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
id: "winrar_history",
name: "WinRAR Archive History",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"SOFTWARE\WinRAR",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "WinRAR registry history of archive opens, archive creation targets, and extraction paths; useful for exfiltration staging and archive reconstruction.",
mitre_techniques: &["T1560.001"],
fields: WINRAR_HISTORY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["powershell_history", "opensave_mru"],
sources: &[
"https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/winrar.py",
"https://www.win-rar.com/switches/settings.htm",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static NETWORK_INTERFACE_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "interface_guid",
description: "TCP/IP interface GUID under the Interfaces key",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "ip_address",
description: "Static or DHCP-assigned address values associated with the interface",
value_type: ValueType::Text,
is_uid_component: false,
},
];
pub static NETWORK_INTERFACES: ArtifactDescriptor = ArtifactDescriptor {
id: "network_interfaces",
name: "TCP/IP Network Interfaces",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: r"CurrentControlSet\Services\Tcpip\Parameters\Interfaces",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Interface GUIDs with DHCP or static addressing details used to tie network activity and lease information back to a host and adapter.",
mitre_techniques: &["T1016"],
fields: NETWORK_INTERFACE_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["networklist_profiles", "srum_network_usage"],
sources: &[
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static PAGEFILE_SYS: ArtifactDescriptor = ArtifactDescriptor {
id: "pagefile_sys",
name: "Pagefile.sys",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\pagefile.sys"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Virtual memory paging file containing memory-resident strings and fragments from paged-out processes when full RAM capture is unavailable.",
mitre_techniques: &["T1005"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["hiberfil_sys", "evtx_security"],
sources: &["https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv", "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static HIBERFIL_SYS: ArtifactDescriptor = ArtifactDescriptor {
id: "hiberfil_sys",
name: "Hibernation File (hiberfil.sys)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\hiberfil.sys"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Compressed hibernation snapshot containing a point-in-time copy of system memory, including processes, sockets, and in-memory strings.",
mitre_techniques: &["T1005"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::High,
related_artifacts: &["pagefile_sys", "evtx_security"],
sources: &[
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://forensics.wiki/hiberfil.sys/",
"https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/storport/nf-storport-storportmarkdumpmemory",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static MOUNTPOINTS2_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "mount_point",
description: "Subkey name identifying the mounted resource: a volume GUID ({...}), a drive letter (A-Z), or a mapped network/UNC share encoded as ##server#share (each backslash in \\\\server\\share replaced by # because backslashes are illegal in key names)",
value_type: ValueType::Text,
is_uid_component: true,
},
FieldSchema {
name: "resource_class",
description: "Resource class derived from the subkey-name prefix: '{' = volume GUID (removable/fixed media), 'A'-'Z' = drive letter, '#' = mapped network/UNC share (##server#share)",
value_type: ValueType::Text,
is_uid_component: false,
},
FieldSchema {
name: "subkey_last_write",
description: "LastWrite time of the individual resource subkey — consistent with when this user last mounted (connected) that volume/share; the per-subkey time, not the parent key's, is the forensically valuable one",
value_type: ValueType::Timestamp,
is_uid_component: false,
},
];
pub static MOUNTPOINTS2: ArtifactDescriptor = ArtifactDescriptor {
id: "mountpoints2",
name: "MountPoints2",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2",
value_name: None,
file_path: None,
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Per-user record of resources Explorer has mounted — removable/fixed media (volume-GUID subkeys), drive letters, and mapped network/UNC shares (subkeys named ##server#share). Each subkey's LastWrite time is consistent with when this user last mounted that resource, and entries persist after disconnection, so the key attributes device and network-share interaction to a specific logged-in user.",
mitre_techniques: &["T1091"],
fields: MOUNTPOINTS2_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["mounted_devices", "usb_enum"],
sources: &[
"https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
"https://github.com/EricZimmerman/RECmd",
"https://github.com/EricZimmerman/RegistryPlugins",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"The per-SUBKEY LastWrite dates the mount, not the parent key's LastWrite; read each resource subkey's own time",
"Entries are retained after a device is removed or a mapped drive is disconnected, so presence does not imply the resource is still mounted",
"LastWrite-as-last-mount is the accepted convention but carries no explicit event record — corroborate with USBSTOR/MountedDevices/setupapi.dev.log for the connection timeline",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Subkeys are written when the user mounts a resource; persist in NTUSER.DAT after disconnection",
};
pub static PORTABLE_DEVICES: ArtifactDescriptor = ArtifactDescriptor {
id: "portable_devices",
name: "Windows Portable Devices Mapping",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: r"Microsoft\Windows Portable Devices\Devices",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Maps portable device identities to user-visible names or drive assignments, helping correlate USB serials and mounted letters during media analysis.",
mitre_techniques: &["T1091"],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["mounted_devices", "mountpoints2", "usb_enum"],
sources: &["https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub static RDP_BITMAP_CACHE: ArtifactDescriptor = ArtifactDescriptor {
id: "rdp_bitmap_cache",
name: "RDP Bitmap Cache",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Terminal Server Client\Cache"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Client-side cached bitmap fragments from RDP sessions that can reveal what was rendered on screen during remote administration or attacker activity.",
mitre_techniques: &["T1021.001"],
fields: DIR_ENTRY_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["rdp_client_servers", "rdp_client_default"],
sources: &["https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv"],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── macOS artifacts ───────────────────────────────────────────────────────────
/// Apple Unified Logging system (`/var/db/diagnostics/`). macOS 10.12+.
///
/// Provides timestamped, structured log entries for process activity, crashes,
/// and security events. Primary timeline source on macOS.
pub static MACOS_UNIFIED_LOG: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_unified_log",
name: "macOS Unified Log",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/db/diagnostics/"),
scope: DataScope::System,
os_scope: OsScope::MacOS12Plus,
decoder: Decoder::Identity,
meaning: "Apple Unified Logging system. Contains all system and application logs since macOS 10.12. Provides timestamped, structured log entries for process activity, crashes, and security events.",
mitre_techniques: &["T1070.001", "T1059"],
fields: &[],
retention: Some("Rotated by OS; typically weeks to months"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_install_history"],
sources: &[
"https://www.mandiant.com/resources/blog/reviewing-macos-unified-logs",
"https://developer.apple.com/documentation/os/logging",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Per-user LaunchAgent plist files (`~/Library/LaunchAgents/`).
///
/// Loaded automatically at user login. Primary persistence mechanism for
/// malware targeting individual users.
pub static MACOS_LAUNCH_AGENTS_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_launch_agents_user",
name: "macOS User LaunchAgents",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/LaunchAgents/"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Per-user LaunchAgent plist files. Automatically loaded at user login. Primary persistence mechanism for malware targeting individual users.",
mitre_techniques: &["T1543.001"],
fields: &[],
retention: Some("Persistent until removed"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["macos_launch_agents_system", "macos_launch_daemons"],
sources: &[
"https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
"https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"LaunchAgent plists in ~/Library/LaunchAgents prove user-context persistence",
"Legitimate software also uses LaunchAgents; cross-reference signing and bundle ID",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "LaunchAgent plist persists until deleted; survives reboots",
};
/// System-wide LaunchAgent plist files (`/Library/LaunchAgents/`).
///
/// Requires root to install; used by system-level malware and legitimate software.
pub static MACOS_LAUNCH_AGENTS_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_launch_agents_system",
name: "macOS System LaunchAgents",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/Library/LaunchAgents/"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "System-wide LaunchAgent plist files loaded for all users. Requires root to install; used by system-level malware and legitimate software.",
mitre_techniques: &["T1543.001"],
fields: &[],
retention: Some("Persistent until removed"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["macos_launch_agents_user", "macos_launch_daemons"],
sources: &[
"https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
"https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"System LaunchAgents require root installation; elevated-privilege persistence indicator",
"Apple-signed plists are expected; unsigned or ad-hoc signed warrant investigation",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "System-wide LaunchAgent plist; requires root to modify",
};
/// System LaunchDaemon plist files (`/Library/LaunchDaemons/`).
///
/// Run as root at system boot, independent of user login. High-value
/// persistence for privileged malware.
pub static MACOS_LAUNCH_DAEMONS: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_launch_daemons",
name: "macOS LaunchDaemons",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/Library/LaunchDaemons/"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "System LaunchDaemon plist files. Run as root at system boot, independent of user login. High-value persistence for privileged malware.",
mitre_techniques: &["T1543.004"],
fields: &[],
retention: Some("Persistent until removed"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["macos_launch_agents_system"],
sources: &[
"https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
"https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"LaunchDaemons run as root; highest-privilege persistence mechanism on macOS",
"Correlate with install history and Gatekeeper records for origin attribution",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "LaunchDaemon plist; persists across reboots, requires root",
};
/// Transparency, Consent, and Control database (`~/Library/Application Support/com.apple.TCC/TCC.db`).
///
/// Records which applications have been granted privacy permissions. Attackers
/// may modify TCC.db to bypass privacy controls.
pub static MACOS_TCC_DB: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_tcc_db",
name: "macOS TCC Database",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Application Support/com.apple.TCC/TCC.db"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Transparency, Consent, and Control database. Records which applications have been granted permissions (camera, microphone, Full Disk Access, etc.). Attackers may modify TCC.db to bypass privacy controls.",
mitre_techniques: &["T1548"],
fields: &[],
retention: Some("Persistent; updated on permission grant/revoke"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_launch_agents_user"],
sources: &[
"https://www.sentinelone.com/blog/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/",
"https://eclecticlight.co/2020/11/04/tcc-in-big-sur-more-permissions-issues/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Quarantine events database (`~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2`).
///
/// SQLite database recording all files downloaded from the internet. Proves a
/// file was downloaded even after deletion from Downloads.
pub static MACOS_QUARANTINE_EVENTS: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_quarantine_events",
name: "macOS Quarantine Events Database",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "SQLite database recording all files downloaded from the internet with their origin URL, download date, and quarantine agent. Proves a file was downloaded even after deletion.",
mitre_techniques: &["T1204.002"],
fields: &[],
retention: Some("Persistent; entries accumulate unless cleared"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_safari_downloads"],
sources: &[
"https://www.jaiminton.com/cheatsheet/DFIR/#quarantine-events",
"https://eclecticlight.co/2021/06/05/checking-quarantine-flags-in-big-sur/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Safari browser history SQLite database (`~/Library/Safari/History.db`).
///
/// Contains URLs, timestamps, and visit counts. Key artifact for establishing
/// attacker research, C2 communication attempts, and data exfiltration.
pub static MACOS_SAFARI_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_safari_history",
name: "macOS Safari Browser History",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Safari/History.db"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "SQLite database containing Safari browsing history with URLs, timestamps, and visit counts. Key artifact for establishing attacker research, C2 communication attempts, and data exfiltration.",
mitre_techniques: &["T1217"],
fields: &[],
retention: Some("Rotated; typically weeks to months of history"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_safari_downloads", "macos_quarantine_events"],
sources: &[
"https://www.sans.org/blog/mac-artifact-safari/",
"https://www.magnetforensics.com/blog/artifacts-for-ios-investigations/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Safari downloads plist (`~/Library/Safari/Downloads.plist`).
///
/// Records all files downloaded via Safari. Corroborates quarantine events database.
pub static MACOS_SAFARI_DOWNLOADS: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_safari_downloads",
name: "macOS Safari Downloads",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Safari/Downloads.plist"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Plist file recording all files downloaded via Safari with source URL, local path, and download date. Corroborates quarantine events database.",
mitre_techniques: &["T1217"],
fields: &[],
retention: Some("Persistent; entries accumulate"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["macos_safari_history", "macos_quarantine_events"],
sources: &[
"https://www.sans.org/blog/mac-artifact-safari/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// KnowledgeC database (`~/Library/Application Support/Knowledge/knowledgeC.db`).
///
/// Maintained by the Duet Activity Scheduler. Rich timeline source for user
/// activity reconstruction including app usage and device lock events.
pub static MACOS_KNOWLEDGEC: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_knowledgec",
name: "macOS KnowledgeC Database",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Application Support/Knowledge/knowledgeC.db"),
scope: DataScope::User,
os_scope: OsScope::MacOS12Plus,
decoder: Decoder::Identity,
meaning: "SQLite database maintained by the Duet Activity Scheduler. Records application usage, device lock/unlock events, browser activity, and screen time. Rich timeline source for user activity reconstruction.",
mitre_techniques: &["T1083"],
fields: &[],
retention: Some("Rolling window; typically 30 days"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_unified_log"],
sources: &[
"https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-ios-to-determine-precise-user-and-application-usage",
"https://github.com/mac4n6/APOLLO",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Per-session bash history files (`~/.bash_sessions/`).
///
/// Contains command history per terminal session. macOS Catalina+ uses zsh by
/// default but bash_sessions may persist for users who previously used bash.
pub static MACOS_BASH_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_bash_sessions",
name: "macOS Bash Session History",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/.bash_sessions/"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Per-session bash history files. macOS Catalina+ uses zsh by default but bash_sessions may persist for users who used bash previously. Contains command history per terminal session.",
mitre_techniques: &["T1059.004"],
fields: &[],
retention: Some("Persistent per session"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["macos_unified_log"],
sources: &[
"https://eclecticlight.co/2019/07/08/why-mojave-could-be-your-last-bash/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Software package install history plist (`/Library/Receipts/InstallHistory.plist`).
///
/// Records all software packages installed via macOS installer. Useful for
/// identifying unauthorized software installation.
pub static MACOS_INSTALL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_install_history",
name: "macOS Software Install History",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/Library/Receipts/InstallHistory.plist"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Plist recording all software packages installed via macOS installer. Includes package name, version, date, and source. Useful for identifying unauthorized software installation.",
mitre_techniques: &["T1204"],
fields: &[],
retention: Some("Persistent; accumulates over system lifetime"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["macos_launch_daemons"],
sources: &[
"https://www.forensicmike1.com/2019/12/17/macos-forensic-artifacts-install-history/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Gatekeeper policy database (`/var/db/SystemPolicy-prefs.plist`).
///
/// Records which applications were allowed or blocked by Gatekeeper. Useful
/// for detecting Gatekeeper bypass attempts.
pub static MACOS_GATEKEEPER_LOGS: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_gatekeeper_logs",
name: "macOS Gatekeeper Assessment Logs",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/var/db/SystemPolicy-prefs.plist"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Gatekeeper policy database and assessment logs. Records which applications were allowed or blocked by Gatekeeper. Useful for detecting Gatekeeper bypass attempts.",
mitre_techniques: &["T1553.001"],
fields: &[],
retention: Some("Persistent; updated on policy decisions"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_tcc_db"],
sources: &[
"https://support.apple.com/en-us/102445",
"https://www.sentinelone.com/blog/gatekeeper-bypass-macos-security/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// User keychain database (`~/Library/Keychains/login.keychain-db`).
///
/// Stores passwords, certificates, and private keys. Unlocked at login with
/// user password. Attackers with user access can dump all stored credentials.
pub static MACOS_KEYCHAIN_USER: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_keychain_user",
name: "macOS User Keychain",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Keychains/login.keychain-db"),
scope: DataScope::User,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "User keychain database storing passwords, certificates, and private keys. Unlocked at login with user password. Attackers with user access can dump all stored credentials.",
mitre_techniques: &["T1555.001"],
fields: &[],
retention: Some("Persistent; updated on credential add/remove"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["macos_tcc_db"],
sources: &[
"https://www.hexnode.com/blogs/macos-keychain-forensics/",
"https://github.com/n0fate/chainbreaker",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Keychain DB requires user unlock; credential entries show what accounts were stored",
"Cannot be read without unlocking; useful post-acquisition with user password",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Keychain DB; persists until item deletion or keychain reset",
};
/// emond plist rules directory (`/etc/emond.d/rules/`).
///
/// Rules executed by the Event Monitor Daemon. Deprecated in macOS 12 but
/// exploited for persistence on older versions via event-triggered commands.
pub static MACOS_EMOND: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_emond",
name: "macOS Event Monitor Daemon Rules",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/emond.d/rules/"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "emond plist rules executed by the Event Monitor Daemon. Deprecated in macOS 12 but exploited for persistence on older versions. Rules can execute commands on system events.",
mitre_techniques: &["T1546"],
fields: &[],
retention: Some("Persistent until removed"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_launch_daemons"],
sources: &[
"https://www.xorrior.com/emond-persistence/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// CoreAnalytics execution reports directory (`/Library/Logs/DiagnosticReports/`).
///
/// CoreAnalytics `.ca_report` files record process execution metadata including
/// SHA256 hashes. Provides execution evidence similar to Windows Prefetch.
pub static MACOS_COREANALYTICS: ArtifactDescriptor = ArtifactDescriptor {
id: "macos_coreanalytics",
name: "macOS CoreAnalytics Execution Reports",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/Library/Logs/DiagnosticReports/"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "Execution reports generated by macOS diagnostics. CoreAnalytics .ca_report files record process execution metadata including SHA256 hashes. Provides execution evidence similar to Windows Prefetch.",
mitre_techniques: &["T1059"],
fields: &[],
retention: Some("Rolling; older reports auto-deleted"),
triage_priority: TriagePriority::High,
related_artifacts: &["macos_unified_log"],
sources: &[
"https://www.crowdstrike.com/blog/reconstructing-command-line-activity-on-macos/",
"https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
// ── Memory forensics artifacts ───────────────────────────────────────────────
pub(crate) static MEM_RUNNING_PROCESSES_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "pid",
value_type: ValueType::UnsignedInt,
description: "Process identifier",
is_uid_component: true,
},
FieldSchema {
name: "name",
value_type: ValueType::Text,
description: "Process image name",
is_uid_component: false,
},
FieldSchema {
name: "path",
value_type: ValueType::Text,
description: "Full executable path from process object",
is_uid_component: false,
},
];
pub static MEM_RUNNING_PROCESSES: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_running_processes",
name: "Running Processes (Memory)",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "Live process list from RAM; reveals injected processes, hollowing, and malware hiding from OS APIs",
mitre_techniques: &["T1057", "T1055"],
fields: MEM_RUNNING_PROCESSES_FIELDS,
retention: Some("RAM only; lost on power-off"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["mem_loaded_modules", "mem_network_connections"],
sources: &[
"https://volatilityfoundation.org/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Live RAM only; requires active acquisition"],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "RAM; lost on power-off",
};
pub(crate) static MEM_NETWORK_CONNECTIONS_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "local_addr",
value_type: ValueType::Text,
description: "Local IP address and port",
is_uid_component: true,
},
FieldSchema {
name: "remote_addr",
value_type: ValueType::Text,
description: "Remote IP address and port",
is_uid_component: true,
},
FieldSchema {
name: "state",
value_type: ValueType::Text,
description: "TCP connection state (ESTABLISHED, LISTEN, etc.)",
is_uid_component: false,
},
FieldSchema {
name: "pid",
value_type: ValueType::UnsignedInt,
description: "Owning process identifier",
is_uid_component: false,
},
FieldSchema {
name: "protocol",
value_type: ValueType::Text,
description: "Transport protocol and IP version (TCPv4, TCPv6, UDPv4, UDPv6) — netscan 'Proto' column, derived from the object type (TCP vs UDP vs listener) and the address family",
is_uid_component: false,
},
FieldSchema {
name: "owner_process",
value_type: ValueType::Text,
description: "Owning process image name (netscan 'Owner' column), resolved from the owning EPROCESS",
is_uid_component: false,
},
FieldSchema {
name: "created",
value_type: ValueType::Timestamp,
description: "Endpoint creation time (netscan 'Created' column); carried by TCP listeners/endpoints and UDP endpoints (TcpL/TcpE/UdpA all expose CreateTime), enabling C2 beacon-timing correlation",
is_uid_component: false,
},
FieldSchema {
name: "offset",
value_type: ValueType::UnsignedInt,
description: "Offset of the pool-tagged network object in the memory image (netscan 'Offset' column)",
is_uid_component: false,
},
];
pub static MEM_NETWORK_CONNECTIONS: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_network_connections",
name: "Network Connections (Memory)",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "Active and recently closed network connections from kernel socket structures; reveals C2 channels and lateral movement paths. Volatility3's netscan renders 10 columns (Offset, Proto, LocalAddr, LocalPort, ForeignAddr, ForeignPort, State, PID, Owner, Created) by pool-tag scanning for TcpL (listener), TcpE (endpoint) and UdpA (UDP) objects; the extra TTcb tag applies on Windows Server 2022 (build 20348). The Created timestamp on TCP/UDP endpoints supports C2 beacon-timing correlation.",
mitre_techniques: &["T1049"],
fields: MEM_NETWORK_CONNECTIONS_FIELDS,
retention: Some("RAM only; connections may close during acquisition"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["mem_running_processes"],
sources: &[
"https://volatilityfoundation.org/",
// Volatility3 netscan.py — the 10-column layout, pool tags (TcpL/TcpE/UdpA, TTcb@20348), Created:
"https://github.com/volatilityfoundation/volatility3/blob/develop/volatility3/framework/plugins/windows/netscan.py",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"Volatile; connections may close during acquisition",
"Pool-tag scanning recovers active AND recently-closed/freed endpoints, so a listed connection may already have terminated; the Created time bounds when the endpoint object was allocated",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "RAM; lost on power-off",
};
pub(crate) static MEM_LOADED_MODULES_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "base_addr",
value_type: ValueType::UnsignedInt,
description: "Module base address in process virtual memory",
is_uid_component: true,
},
FieldSchema {
name: "name",
value_type: ValueType::Text,
description: "Module image name",
is_uid_component: false,
},
FieldSchema {
name: "path",
value_type: ValueType::Text,
description: "Full path of the loaded DLL or module",
is_uid_component: false,
},
];
pub static MEM_LOADED_MODULES: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_loaded_modules",
name: "Loaded Modules (Memory)",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "DLLs and modules loaded into process address spaces; detects reflective DLL injection and unsigned in-memory modules",
mitre_techniques: &["T1055"],
fields: MEM_LOADED_MODULES_FIELDS,
retention: Some("RAM only; lost on power-off"),
triage_priority: TriagePriority::High,
related_artifacts: &["mem_running_processes"],
sources: &[
"https://volatilityfoundation.org/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Live RAM only; requires active acquisition; unlisted modules indicate injection"],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "RAM; lost on power-off",
};
pub(crate) static MEM_REGISTRY_HIVES_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "hive_name",
value_type: ValueType::Text,
description: "Name of the in-memory registry hive",
is_uid_component: true,
},
FieldSchema {
name: "base_addr",
value_type: ValueType::UnsignedInt,
description: "Hive CM_HIVE base address in kernel memory",
is_uid_component: false,
},
];
pub static MEM_REGISTRY_HIVES: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_registry_hives",
name: "In-Memory Registry Hives",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "Registry hives as held in kernel memory; may reveal keys deleted on disk, transient values, and malware-created volatile hives not flushed to disk",
mitre_techniques: &["T1012"],
fields: MEM_REGISTRY_HIVES_FIELDS,
retention: Some("RAM only; lost on power-off"),
triage_priority: TriagePriority::High,
related_artifacts: &["mem_running_processes"],
sources: &[
"https://volatilityfoundation.org/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Live RAM only; in-memory hive state may differ from on-disk"],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "RAM; lost on power-off",
};
pub(crate) static MEM_USER_CREDENTIALS_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "account",
value_type: ValueType::Text,
description: "Account name associated with the credential material",
is_uid_component: true,
},
FieldSchema {
name: "credential_type",
value_type: ValueType::Text,
description: "Type of credential (NTLM hash, Kerberos ticket, cleartext, etc.)",
is_uid_component: false,
},
];
pub static MEM_USER_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_user_credentials",
name: "User Credentials in Memory (LSASS)",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "NTLM hashes, Kerberos tickets, and cleartext credentials cached in LSASS process memory; most valuable live artifact for credential theft detection",
mitre_techniques: &["T1003.001"],
fields: MEM_USER_CREDENTIALS_FIELDS,
retention: Some("RAM only; lost on power-off"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["mem_running_processes"],
sources: &[
"https://volatilityfoundation.org/",
"https://www.sans.org/blog/protecting-privileged-domain-accounts-lsa-secrets-good-times/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &["Credentials in memory (LSASS); most valuable live artifact"],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "RAM; lost on power-off",
};
// ── Global catalog entries ────────────────────────────────────────────────────
/// Field schema for the NTFS `Zone.Identifier` alternate data stream
/// (Mark-of-the-Web). The stream is INI-formatted under a `[ZoneTransfer]` section.
/// Source: MS-FSCC named streams; Microsoft Attachment Manager Zone.Identifier docs.
pub(crate) static ZONE_IDENTIFIER_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "zone_id",
value_type: ValueType::UnsignedInt,
description: "ZoneId under [ZoneTransfer]: 0=Local machine, 1=Local intranet, 2=Trusted sites, 3=Internet, 4=Restricted sites. A value of 3 or 4 is the Mark-of-the-Web, indicating the file originated from an untrusted zone",
is_uid_component: false,
},
FieldSchema {
name: "host_url",
value_type: ValueType::Text,
description: "HostUrl (Windows 10+): the direct URL the file was downloaded from — direct attribution of a downloaded binary or document to its source",
is_uid_component: false,
},
FieldSchema {
name: "referrer_url",
value_type: ValueType::Text,
description: "ReferrerUrl (Windows 10+): the page or location from which the download was initiated (may reveal the delivery site even when HostUrl is a CDN or storage endpoint)",
is_uid_component: false,
},
];
/// NTFS `Zone.Identifier` alternate data stream — Mark-of-the-Web (MOTW).
///
/// Windows Attachment Manager writes a `Zone.Identifier` alternate data stream to
/// files saved from an untrusted origin (web browsers, email clients, archive
/// extraction). INI-formatted under `[ZoneTransfer]`, it carries the ZoneId plus,
/// on Windows 10+, HostUrl and ReferrerUrl.
///
/// Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/
/// Source: https://learn.microsoft.com/en-us/windows/win32/shell/attachment-manager
pub static ZONE_IDENTIFIER: ArtifactDescriptor = ArtifactDescriptor {
id: "zone_identifier",
name: "NTFS Zone.Identifier ADS (Mark-of-the-Web)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"<any-file>:Zone.Identifier"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "An NTFS alternate data stream named 'Zone.Identifier' that Windows Attachment \
Manager writes to files saved from an untrusted origin (browsers, email, archive extraction). \
INI-formatted under [ZoneTransfer]: ZoneId (0=Local, 1=Intranet, 2=Trusted, 3=Internet, \
4=Restricted) plus, on Windows 10+, HostUrl (the direct download URL) and ReferrerUrl (the \
originating page). Presence with ZoneId 3 or 4 is the Mark-of-the-Web and proves the file was \
downloaded from an untrusted zone; the URLs attribute a downloaded tool or malware to its source. \
The stream is lost when the file is moved to a non-NTFS volume (FAT/exFAT/network) or when the \
MOTW is deliberately stripped (right-click Unblock, PowerShell Unblock-File, or Remove-Item \
-Stream), so absence does not prove local origin.",
mitre_techniques: &["T1553.005", "T1105"],
fields: ZONE_IDENTIFIER_FIELDS,
retention: Some("Persists with the file on NTFS until the file or the stream is removed; not carried to non-NTFS volumes"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["mft", "mft_file", "lnk_files"],
sources: &[
"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/",
"https://learn.microsoft.com/en-us/windows/win32/shell/attachment-manager",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
/// Field schema for the per-folder `Thumbs.db` OLE compound-file thumbnail cache.
/// The XP-format Catalog stream indexes cached items by original filename + modified
/// time; the modern network/UNC variant is OLE without the Catalog stream.
/// Source: forensics.wiki Thumbs.db; libyal libolecf; Parsonage "Under My Thumbs".
pub(crate) static THUMBS_DB_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "catalog_entry_filename",
value_type: ValueType::Text,
description: "Original filename of the cached item, recorded in the Thumbs.db Catalog stream (XP format). Recoverable even after the source file is deleted, so it proves the named file once existed in the folder",
is_uid_component: false,
},
FieldSchema {
name: "catalog_entry_modified",
value_type: ValueType::Timestamp,
description: "Modified time recorded for the catalog entry in the Catalog stream",
is_uid_component: false,
},
FieldSchema {
name: "catalog_entry_id",
value_type: ValueType::UnsignedInt,
description: "Catalog index / thumbnail identifier tying a Catalog entry to its thumbnail stream within the OLE compound file",
is_uid_component: false,
},
];
/// Thumbs.db — per-folder OLE compound-file thumbnail cache (Mark: distinct from the
/// centralized `thumbcache`).
///
/// Source: https://forensics.wiki/thumbs.db/
/// Source: https://github.com/libyal/libolecf
/// Source: http://computerforensics.parsonage.co.uk/thumbs/thumbs.htm
pub static THUMBS_DB: ArtifactDescriptor = ArtifactDescriptor {
id: "thumbs_db",
name: "Thumbs.db (per-folder thumbnail cache)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"<folder>\Thumbs.db"),
scope: DataScope::User,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "A hidden per-folder OLE compound-file thumbnail cache written by Windows Explorer in \
each folder viewed in Thumbnails/Filmstrip mode. Default on Windows XP; on Vista+ the cache moved to \
the centralized thumbcache_*.db, but a per-folder Thumbs.db is STILL created when a folder is reached \
over the network or via a UNC path (for example \\\\localhost\\c$), so its presence on a modern system \
is a behavioural fingerprint that the folder was accessed by a network path rather than normal local \
browsing. The XP Catalog stream records each cached item's original filename and modified time; the \
modern UNC variant is an OLE container without the Catalog stream. Cached thumbnails and metadata \
survive deletion of the source files, so a Thumbs.db can prove a now-deleted image existed in the \
folder. Decode with an OLE compound-file parser (e.g. Vinetto).",
mitre_techniques: &[],
fields: THUMBS_DB_FIELDS,
retention: Some("Persists in the folder until deleted or the folder is removed; may survive deletion of the images it cached"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["thumbcache", "mft", "recycle_bin"],
sources: &[
"https://forensics.wiki/thumbs.db/",
"https://github.com/libyal/libolecf",
"http://computerforensics.parsonage.co.uk/thumbs/thumbs.htm",
],
evidence_strength: None,
evidence_caveats: &[],
volatility: None,
volatility_rationale: "",
};
pub(crate) static CDP_GDID_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "device_puid",
value_type: ValueType::Text,
description: "The 64-bit MSA Device PUID stored as 16 hex digits in the LID value (e.g. 0018000FC8CB93CC). This is the same identifier Microsoft's device graph writes as g:<decimal> (the court's g:6755467234350028 == 0x0018000FC8CB93CC). Server-assigned at Microsoft Account provisioning; identifies a Windows installation, not the underlying hardware",
is_uid_component: true,
},
FieldSchema {
name: "puid_class_prefix",
value_type: ValueType::Text,
description: "Leading 4 hex digits classify the PUID: 0018 = device PUID (the GDID), 0003 = user account PUID. Lets an examiner confirm the value is the device identifier rather than the signed-in user's PUID",
is_uid_component: false,
},
];
/// Connected Devices Platform (CDP) Global Device Identifier (GDID) — the persistent
/// 64-bit MSA Device PUID.
///
/// Distinct from the ActivitiesCache.db timeline (`windows_timeline`): same CDP
/// subsystem, but a registry-resident device-identity value rather than the SQLite
/// activity store. Surfaced publicly in the July 2026 Scattered Spider complaint
/// (US v. Stokes, N.D. Ill.) as `Global Device Identifier g:6755467234350028`.
///
/// The blog that surfaced this (hackingpassion.com) is a discovery pointer only; the
/// facts below are grounded in the independent primary sources cited in `sources`.
///
/// Source: US v. Peter Stokes, N.D. Ill. (Jul 2026) — court filing naming the GDID [COURT]
/// Source: https://github.com/SmtimesIWndr/gdid-reversal — ETW + static RE, Win11 26200 [OBSERVED/STATIC]
/// Source: Microsoft Delivery Optimization / UCDOStatus.GlobalDeviceId column docs [VENDOR]
pub static CDP_GDID: ArtifactDescriptor = ArtifactDescriptor {
id: "cdp_gdid",
name: "CDP Global Device Identifier (GDID / MSA Device PUID)",
artifact_type: ArtifactLocation::RegistryValue,
hive: Some(HiveTarget::NtUser),
key_path: r"Software\Microsoft\IdentityCRL\ExtendedProperties",
value_name: Some("LID"),
file_path: None,
scope: DataScope::User,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "A persistent, device-level identifier for a Windows installation, minted by the \
Microsoft Account service (wlidsvc: CDeviceIdentityBase::CreateNewDeviceIdentity -> \
DeviceIdStore::LogToRegistry) via a SOAP exchange with login.live.com, which returns a \
server-assigned 64-bit Passport Unique ID (PUID). The Connected Devices Platform (cdp.dll, \
services CDPSvc + CDPUserSvc) reads this PUID and registers it into Microsoft's Device \
Directory Service (DDS) as the string g:<decimal> (format string \"g:%s\"), and Delivery \
Optimization reports it as the documented UCDOStatus.GlobalDeviceId. Because the PUID is \
server-assigned, it stays constant across OS updates but changes on a clean reinstall, so it \
identifies an installation rather than fixed hardware. Forensically it is an attribution pivot: \
the local LID value shows the device's PUID, and Microsoft-held DDS/telemetry records tie that \
same GDID to the account, IP addresses, geolocation and last-seen times across sessions, so it \
can link one machine across VPNs and locations over time. Present since Windows 10 (2015); CDP \
also has an anonymous device path, so a GDID can exist without a Microsoft Account.",
mitre_techniques: &[],
fields: CDP_GDID_FIELDS,
retention: Some("Persists in NTUSER.DAT; server-backed, so it survives local deletion (re-fetched from Microsoft on next CDP sync) and OS updates; changes only on reinstall/re-provision"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["windows_timeline", "windows_timeline_devicecache", "apple_hardware_uuid", "apple_dsid", "apple_idfa", "linux_machine_id"],
sources: &[
// Primary: US federal criminal complaint naming the GDID (Scattered Spider case).
"https://www.justice.gov/usao-ndil",
// Press corroboration of the arrest tied to the Windows device id (reporting/interpretation, not a court-stated mechanism).
"https://www.theregister.com/cyber-crime/2026/07/07/windows-is-watching-anti-piracy-tool-fingers-scattered-spider-suspect/",
// Reverse-engineering writeup: ETW capture + static RE against Windows 11 (26200) public PDBs.
"https://github.com/SmtimesIWndr/gdid-reversal",
// Microsoft vendor doc: Delivery Optimization UCDOStatus.GlobalDeviceId column.
"https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/ucdostatus",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"The LID value is the device PUID; correlating it to a person requires Microsoft-held records (DDS device graph, account, IP, geolocation, last-seen) obtained by legal process",
"A clean reinstall yields a NEW server-assigned PUID, so the value identifies an installation, not hardware; a changed or absent GDID does not exclude the same physical machine",
"Server-backed: deleting the LID key does not durably remove the GDID — CDP re-populates it from Microsoft on the next sync (observed returning identical after opening the Microsoft Store)",
"Present with a Microsoft Account sign-in; CDP's anonymous device path can also produce a GDID without an MSA — verify per build",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Server-backed device PUID persisted in NTUSER.DAT; survives local deletion (re-fetched from Microsoft) and OS updates",
};
pub(crate) static APPLE_HARDWARE_UUID_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "hardware_uuid",
value_type: ValueType::Text,
description: "36-char RFC-4122 UUID identifying the Mac logic board (e.g. 801920CF-222C-595E-83F7-D71BD49D8BB4); read from IOPlatformUUID or recovered as the ~/Library/Keychains/<UUID>/ folder name",
is_uid_component: true,
},
FieldSchema {
name: "provisioning_udid",
value_type: ValueType::Text,
description: "Apple Silicon second machine identifier in <8-hex ChipID>-<16-hex ECID> form (e.g. 00008122-000850493AE9001C); required to register an Apple Silicon Mac; distinct from the 36-char Hardware UUID",
is_uid_component: false,
},
];
/// Apple Hardware UUID (IOPlatformUUID / Provisioning UDID) — the firmware/SMBIOS
/// machine identifier for a specific Mac logic board.
///
/// The Apple counterpart to the Windows `cdp_gdid`: a machine-identity value rather
/// than an account identifier. Its highest-value on-disk locus is the Data-Protection
/// ("Local Items") keychain directory `~/Library/Keychains/<Hardware-UUID>/keychain-2.db`,
/// whose folder name IS the Hardware UUID — recoverable from a dead image.
///
/// Source: Apple Developer documentation — provisioning / Hardware UUID [VENDOR]
/// Source: Forensic Focus — Apple keychain decryption deep dive [OBSERVED]
/// Source: MITRE ATT&CK T1555.001 (Keychain) [FRAMEWORK]
pub static APPLE_HARDWARE_UUID: ArtifactDescriptor = ArtifactDescriptor {
id: "apple_hardware_uuid",
name: "Apple Hardware UUID (IOPlatformUUID / Provisioning UDID)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("~/Library/Keychains/<Hardware-UUID>/keychain-2.db"),
scope: DataScope::System,
os_scope: OsScope::MacOS,
decoder: Decoder::Identity,
meaning: "A 128-bit RFC-4122 UUID identifying a specific Mac logic board, exposed by IOKit as \
the IOPlatformUUID property of IOPlatformExpertDevice (ioreg -rd1 -c IOPlatformExpertDevice | grep \
IOPlatformUUID; kIOPlatformUUIDKey) and shown in System Information as 'Hardware UUID' (macOS 10.15 \
and earlier) or 'Provisioning UDID' (macOS 11+). It is derived from the SMBIOS System UUID baked \
into the logic-board firmware, not stored on the boot volume, so it survives OS reinstalls. Its \
highest-value on-disk locus is the Data-Protection ('Local Items') keychain directory \
~/Library/Keychains/<Hardware-UUID>/keychain-2.db, whose folder name IS the Hardware UUID and which \
feeds keychain key derivation on non-T2 Macs -- recoverable from a dead image without the live \
registry. Intel and Apple Silicon diverge: Intel exposes a 36-char UUID; Apple Silicon adds a \
separate 'Provisioning UDID' in <8-hex ChipID>-<16-hex ECID> form (e.g. 00008122-...), required to \
register the Mac with Apple's developer portal, so an Apple Silicon Mac has two distinct machine \
identifiers. Forensically it identifies hardware (not a person) and pivots keychains, Unified Logs \
/ MDM command correlation, and software-licensing records; malware routinely reads \
IOPlatformExpertDevice/IOPlatformUUID as a victim tag.",
mitre_techniques: &["T1555.001", "T1082"],
fields: APPLE_HARDWARE_UUID_FIELDS,
retention: Some("Firmware/SMBIOS-derived, not on the OS volume: survives OS reinstall, updates, and disk erase-and-reinstall; changes only on logic-board replacement or in a VM/spoofed SMBIOS"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["apple_dsid", "apple_idfa", "cdp_gdid", "linux_machine_id"],
sources: &[
"https://help.apple.com/xcode/mac/current/en.lproj/dev93ef696c6.html",
"https://www.forensicfocus.com/articles/a-deep-dive-into-apple-keychain-decryption/",
"https://eclecticlight.co/2023/08/07/an-introduction-to-keychains-and-how-theyve-changed/",
"https://github.com/AsahiLinux/docs/issues/187",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Identifies hardware, not a person; it does not prove who used the Mac",
"Virtual machines present a synthetic UUID: VMware guests take the SMBIOS uuid.bios and VMware-generated UUIDs often begin with 564D (ASCII 'VM') -- a non-Apple-pattern UUID is a VM/emulation tell, not bare metal",
"Logic-board replacement changes it, so one physical chassis can present different UUIDs over its life and a keychain keyed to the old UUID can break",
"A disk image restored onto different hardware shows a mismatch between the on-disk ~/Library/Keychains/<UUID>/ folder name and the live ioreg value -- that mismatch is itself an artifact (image moved between machines)",
"On Apple Silicon the 36-char Hardware UUID and the ChipID-ECID Provisioning UDID are different strings for the same machine; mismatched fields across sources may both be legitimate",
"UNVERIFIED: a widely-repeated claim that on older Intel Macs the IOPlatformUUID was derived from the built-in Ethernet MAC could not be confirmed against a primary source -- do not rely on it",
"UNVERIFIED: whether the Hardware UUID specifically appears in /var/log/install.log was not confirmed",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Firmware/SMBIOS-derived machine UUID; the ~/Library/Keychains/<UUID>/ folder name reflects it and is recreated to match after reinstall",
};
pub(crate) static APPLE_DSID_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "dsid",
value_type: ValueType::Text,
description: "Server-assigned decimal numeric identifier for the Apple ID / iCloud account; stable across Apple ID email changes; the ~/Library/Application Support/iCloud/Accounts/<DSID> folder is named by it. Canonical digit-length not authoritatively documented",
is_uid_component: true,
},
FieldSchema {
name: "account_class",
value_type: ValueType::Text,
description: "Which account the DSID belongs to -- iCloud vs Media/iTunes & App Store can be different Apple IDs and thus different DSIDs on one device; attribution must state which",
is_uid_component: false,
},
];
/// Apple DSID (Directory Services Identifier) — Apple's server-assigned decimal
/// account number for an Apple ID / iCloud account.
///
/// The account-pivot counterpart to `cdp_gdid`: it ties a device/backup/purchases to
/// one Apple account and (via Apple) to a person. Stable across Apple ID email changes,
/// so it is the preferred value to compel from Apple and is frequently the only
/// unredacted personal identifier in Apple's returned data-request records.
///
/// Source: d204n6 — iOS device-migration DSID tracking [OBSERVED]
/// Source: Forensafe / cyberengage — Apple account artifacts on iOS/macOS [OBSERVED]
/// Source: ElcomSoft — iCloud authentication tokens keyed by DSID [VENDOR]
pub static APPLE_DSID: ArtifactDescriptor = ArtifactDescriptor {
id: "apple_dsid",
name: "Apple DSID (Directory Services Identifier -- Apple ID / iCloud account number)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/private/var/mobile/Library/Preferences/com.apple.icloud.fmfd.plist"),
scope: DataScope::User,
os_scope: OsScope::IOS,
decoder: Decoder::Identity,
meaning: "DSID (Directory Services Identifier) is Apple's server-assigned decimal numeric \
identifier for an Apple ID / iCloud account -- the account's stable internal key. It does NOT \
change when the user changes their Apple ID email, which makes it the preferred value to compel \
from Apple under legal process and, in Apple's returned data-request records, frequently the only \
personal identifier left entirely unredacted. On iOS it is recoverable from \
com.apple.icloud.fmfd.plist and com.apple.itunescloud(.daemon).plist, from the Accounts database \
/private/var/mobile/Library/Accounts/Accounts3.sqlite, from the iCloud Drive account.1 file, and \
correlates with device-migration records in /private/var/root/Library/Lockdown/data_ark.plist; on \
macOS it lives in ~/Library/Accounts/Accounts4.sqlite and, notably, the token directory \
~/Library/Application Support/iCloud/Accounts/<DSID> is literally NAMED by the DSID (ElcomSoft \
Phone Breaker requires the DSID to decrypt those tokens). Forensically it ties a \
device/backup/purchases/iCloud data to one Apple account -> (via Apple) to a person, and the same \
DSID across those plists on multiple devices ties them to a single account. Present since the \
MobileMe/iCloud era.",
mitre_techniques: &[],
fields: APPLE_DSID_FIELDS,
retention: Some("Server-backed account identifier; persists across device wipe and re-add of the SAME Apple ID; on-device value changes only when a DIFFERENT Apple ID signs in; Apple retains the DSID<->account mapping for the life of the account"),
triage_priority: TriagePriority::High,
related_artifacts: &["apple_hardware_uuid", "apple_idfa", "cdp_gdid", "linux_machine_id"],
sources: &[
"https://blog.d204n6.com/2021/06/ios-tracking-device-migration.html",
"https://forensafe.com/blogs/AppleAccounts.html",
"https://www.cyberengage.org/post/understanding-macos-app-preference-files-mru-files-shared-file-lists-and-account-artifacts-for-di",
"https://blog.elcomsoft.com/2017/11/extracting-and-using-icloud-authentication-tokens/",
"https://pxlnv.com/blog/oh-the-places-your-apple-id-will-go/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"iCloud vs Media (iTunes & App Store) can be different Apple IDs on one device -> two different DSIDs; attribution must state WHICH account a given DSID belongs to",
"Family Sharing surfaces multiple related DSIDs (organiser + members) for shared purchases/subscriptions; a purchase-account DSID is not necessarily the device owner",
"Sign-out/sign-in of a different Apple ID changes the on-device DSID; backups and cached plists may still carry a PRIOR account's DSID, so a DSID on disk is not proof it was the current account at time X without temporal correlation",
"UNVERIFIED: the exact SQLite table/column (or ZACCOUNTPROPERTY ZKEY) storing the raw DSID inside Accounts3/4.sqlite was not confirmed; the fmfd/itunescloud plists and the iCloud/Accounts/<DSID> folder name are the reliably-cited carriers",
"UNVERIFIED: the DSID vs altDSID vs aDSID distinction -- altDSID and DSID are observed as coexisting fields on one account, but the precise semantics are Apple-internal",
"UNVERIFIED: the DSID's canonical digit-length/format is not authoritatively documented (a large decimal integer)",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Server-assigned per-account identifier reflected in on-device plists/DBs; survives wipe + re-add of the same Apple ID",
};
pub(crate) static APPLE_IDFA_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "idfa",
value_type: ValueType::Text,
description: "Per-device resettable advertising UUID (ASIdentifierManager.advertisingIdentifier); returns all-zeros 00000000-0000-0000-0000-000000000000 when App Tracking Transparency is not authorised, which is the default state since iOS 14.5",
is_uid_component: true,
},
FieldSchema {
name: "ad_tracking_state",
value_type: ValueType::Text,
description: "Ad-tracking preference state from com.apple.AdLib.plist (e.g. allowIdentifierForAdvertising / forceLimitAdTracking) -- typically more durable than the transient API value",
is_uid_component: false,
},
];
/// Apple IDFA (Identifier for Advertisers) — a per-device, user-resettable,
/// ATT-zeroed advertising UUID.
///
/// A weak, corroborative Apple identifier alongside the machine-level
/// `apple_hardware_uuid` and account-level `apple_dsid`. Since iOS 14.5 it is gated by
/// App Tracking Transparency and returns the all-zeros nil UUID unless the user grants
/// permission — so all-zeros is the NORMAL post-14.5 state, not tampering.
///
/// Source: Apple Developer — user privacy and data use (ATT) [VENDOR]
/// Source: blochberger/IDFA — advertisingIdentifier behaviour [OBSERVED]
/// Source: Firebase — supporting iOS 14 / device.advertising_id [VENDOR]
pub static APPLE_IDFA: ArtifactDescriptor = ArtifactDescriptor {
id: "apple_idfa",
name: "Apple IDFA (Identifier for Advertisers)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/private/var/mobile/Library/Preferences/com.apple.AdLib.plist"),
scope: DataScope::User,
os_scope: OsScope::IOS,
decoder: Decoder::Identity,
meaning: "IDFA (Identifier for Advertisers) is a per-device, user-resettable RFC-4122 UUID \
Apple provides to apps for advertising attribution via ASIdentifierManager.advertisingIdentifier \
(AdSupport framework). Since iOS/iPadOS/tvOS 14.5 it is gated by App Tracking Transparency: unless \
the user grants permission it returns the all-zeros nil UUID 00000000-0000-0000-0000-000000000000 \
(also returned when the device-wide 'Allow Apps to Request to Track' toggle is off, or on the iOS \
Simulator) -- so all-zeros is the NORMAL post-14.5 state, not tampering. There is no single OS file \
holding the live app-visible IDFA; forensically it surfaces as (a) the ad-tracking preference state \
in com.apple.AdLib.plist (keys such as allowIdentifierForAdvertising / forceLimitAdTracking -- often \
more durable than the transient API value), (b) cached copies inside ad/analytics/attribution SDK \
stores in app sandboxes (AppsFlyer, Adjust, Branch, Meta -- SQLite/plist queues under .../Library/), \
(c) server-side, e.g. Firebase/GA4 BigQuery export device.advertising_id, and (d) network captures \
to attribution endpoints. Contrast IDFV (identifierForVendor): per app-vendor, NOT ATT-gated, stable \
while any of a vendor's apps is installed. IDFA is a weak, corroborative identifier -- per device \
not per account, resettable, and usually zeroed -- and should never be sole proof of device or user \
identity.",
mitre_techniques: &[],
fields: APPLE_IDFA_FIELDS,
retention: Some("Ephemeral: user-resettable at any time (mints a new UUID with no link to the old), zeroed whenever App Tracking Transparency is not authorised, and reset on device erase or backup restore"),
triage_priority: TriagePriority::Low,
related_artifacts: &["apple_hardware_uuid", "apple_dsid", "cdp_gdid", "linux_machine_id"],
sources: &[
"https://developer.apple.com/app-store/user-privacy-and-data-use/",
"https://github.com/blochberger/IDFA",
"https://www.eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now",
"https://firebase.google.com/docs/ios/supporting-ios-14",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"All-zeros (00000000-0000-0000-0000-000000000000) is the norm post-iOS 14.5 (most users do not authorise ATT) and means 'tracking not authorised / Simulator / Limit Ad Tracking' -- not a corrupt or missing record",
"A user reset mints a NEW IDFA with no logged link to the prior value: two different IDFAs can be the same device at different times, and one IDFA is not one device forever",
"Some SDKs fall back to sending IDFV when the IDFA is blank -- do not mistake a vendor-scoped IDFV for a device-scoped IDFA in a captured payload; IDFV also changes when all of a vendor's apps are uninstalled",
"The iOS Simulator always returns all-zeros regardless of ATT state",
"UNVERIFIED: the exact iOS path /private/var/mobile/Library/Preferences/com.apple.AdLib.plist and its key names are from community consensus (the macOS per-sandbox-container path ~/Library/Containers/<bundleId>/.../com.apple.AdLib.plist is primary-sourced); the iOS path and keys want confirmation against a live acquisition",
"UNVERIFIED: named per-SDK cache DB filenames (AppsFlyer/Adjust/Firebase) were not confirmed to a documented path",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "User-resettable, ATT-zeroed advertising UUID; the live value is API-only and unstable, only preference state and cached historical values persist",
};
pub(crate) static LINUX_MACHINE_ID_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "machine_id",
value_type: ValueType::Text,
description: "The 128-bit local machine ID as a single newline-terminated, lowercase, 32-hex-character string (e.g. 3d9a1c2f5b6e4780a1b2c3d4e5f60718); per machine-id(5) it may not be all zeros, and the literal \"uninitialized\" or an empty file denote a first-boot/unset state",
is_uid_component: true,
},
FieldSchema {
name: "dbus_machine_id",
value_type: ValueType::Text,
description: "The D-Bus copy at /var/lib/dbus/machine-id, normally a symlink to /etc/machine-id and thus the same value; a non-symlink copy that DIFFERS from /etc/machine-id is itself an artifact (image moved, manual edit, or a legacy pre-systemd D-Bus id)",
is_uid_component: false,
},
];
/// Linux machine-id (/etc/machine-id) -- the systemd/D-Bus 128-bit local-install
/// identifier, the Linux counterpart to the Windows `cdp_gdid` and Apple
/// `apple_hardware_uuid`. Stable across reboots/updates/hardware change, world-readable,
/// and read by apps as a device fingerprint -- but Strong, not Definitive: a fallback
/// chain lets VM clones share one and it is root-editable.
///
/// Sourced from the systemd man pages (machine-id(5), sd_id128_get_machine(3)) and the
/// D-Bus spec; the ransomware.sh post that surfaced it is a discovery pointer only.
///
/// Source: systemd machine-id(5) -- format, first-boot, confidential clause [VENDOR/PRIMARY]
/// Source: sd_id128_get_machine_app_specific(3) -- per-app HMAC-SHA256 derivation [VENDOR/PRIMARY]
/// Source: D-Bus specification -- machine UUID origin [VENDOR/PRIMARY]
pub static LINUX_MACHINE_ID: ArtifactDescriptor = ArtifactDescriptor {
id: "linux_machine_id",
name: "Linux machine-id (/etc/machine-id -- systemd/D-Bus local install ID)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some("/etc/machine-id"),
scope: DataScope::System,
os_scope: OsScope::Linux,
decoder: Decoder::Identity,
meaning: "The 128-bit local machine identifier that systemd/D-Bus assigns to one Linux \
installation, written to /etc/machine-id as a single newline-terminated, lowercase, 32-character \
hex string (16 bytes; per machine-id(5) it may not be all zeros). It is set at install time by \
systemd-machine-id-setup(1) or, failing that, generated on first boot, and -- per the man page -- \
does NOT change across reboots, kernel changes, OS updates or hardware replacement, which makes it \
a stable attribution pivot for a specific install (the Linux analogue of the Windows CDP GDID and \
the Apple Hardware UUID). It shares the D-Bus machine-id format and is also found at \
/var/lib/dbus/machine-id, usually a symlink to /etc/machine-id. systemd documents the value as \
\"confidential\" and says it must not be exposed in untrusted environments, in particular on the \
network; when a program needs an externally-shared id it should call \
sd_id128_get_machine_app_specific(3), an HMAC-SHA256 keyed by the machine-id that yields a stable \
but per-application value which cannot be reversed or matched across apps. Nothing enforces that, \
and the file is world-readable, so any process can read the raw id -- the common desktop path is \
the node-machine-id package, which hashes `cat /var/lib/dbus/machine-id /etc/machine-id` with a \
fixed (non-per-app) SHA-256, producing the SAME fingerprint in every app, so telemetry/analytics \
can line one host's accounts up against each other. Since systemd v30 newly-generated ids are \
Variant-1 Version-4 RFC-4122 UUIDs. Malware and licensing code routinely read it as a victim/host \
tag.",
mitre_techniques: &["T1082"],
fields: LINUX_MACHINE_ID_FIELDS,
retention: Some("Set at install or first boot; persists unchanged across reboots, kernel changes, OS updates and hardware replacement (machine-id(5)); changes only on explicit reset (file wipe + regenerate), a fresh install, or a clone that regenerates it"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["cdp_gdid", "apple_hardware_uuid", "apple_dsid", "apple_idfa"],
sources: &[
// Primary vendor spec: format, first-boot semantics, the "confidential" clause.
"https://man7.org/linux/man-pages/man5/machine-id.5.html",
// Primary vendor spec: per-app HMAC-SHA256 derivation systemd recommends for sharing.
"https://man7.org/linux/man-pages/man3/sd_id128_get_machine.3.html",
// D-Bus specification: the machine UUID the format originates from.
"https://dbus.freedesktop.org/doc/dbus-specification.html#uuids",
// Observed app-read vector (SHA-256 of the raw file, no per-app key) into desktop apps.
"https://github.com/automation-stack/node-machine-id",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"NOT guaranteed unique: on a blank/first-boot file systemd walks a fallback chain (D-Bus id, then kernel container_uuid, then KVM DMI product_uuid, then devicetree vm,uuid, then Xen id, and only then a random UUID), so VMs cloned from one image or containers off one base can SHARE a machine-id -- a match is strong correlation, not proof of one physical host",
"Root-editable and regenerable (rm + systemd-machine-id-setup, or the systemd.machine_id= / --machine-id= override): the value is spoofable and a changed id does not exclude the same machine, so this is Strong, never Definitive",
"First-boot / stateless states: the literal string \"uninitialized\" or an empty file both mean 'first boot' (systemd overmounts a temporary id); an all-zeros value is invalid per machine-id(5)",
"The /var/lib/dbus/machine-id copy is normally a symlink to /etc/machine-id; a divergence between the two (a non-symlink copy with a different value) is itself an artifact worth noting",
"node-machine-id and similar (SHA-256 of the raw file, no per-app key) produce identical hashes across apps, so a fingerprint in telemetry can be reversed to a host by hashing a candidate /etc/machine-id -- whereas per-app sd_id128_get_machine_app_specific values cannot be correlated at all",
"Sandboxing changes it: flatpak read-only-binds the host machine-id INTO the sandbox (so it leaks through and does NOT protect), whereas firejail --machine-id presents a fresh in-sandbox id -- verify whether a read came from a sandbox",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Stable local-install identifier persisted in /etc/machine-id; unchanged across reboots, kernel changes, OS updates and hardware replacement per machine-id(5)",
};
pub(crate) static NTFS_I30_INDEX_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "recovered_filename",
value_type: ValueType::Text,
description: "Filename of a removed directory entry recovered from B-tree slack in the $INDEX_ALLOCATION. Because the entry is a copy of the file's $FILE_NAME attribute, it survives Shift+Delete and $MFT-record reuse — often the only proof a now-deleted file once existed in the folder",
is_uid_component: true,
},
FieldSchema {
name: "from_slack",
value_type: ValueType::Bool,
description: "True when the entry was carved from index slack (a stale entry left behind by B-tree node splits/merges) rather than read from the live index. MFTECmd reports this as 'From Slack' = true",
is_uid_component: false,
},
FieldSchema {
name: "fn_macb",
value_type: ValueType::Timestamp,
description: "The four $FILE_NAME timestamps (Created / Modified / MFT-modified / Accessed) preserved in the slack entry. These are the $FN set — set at file creation and harder to spoof than $STANDARD_INFORMATION — reflecting state when the entry was written, not the deletion time",
is_uid_component: false,
},
FieldSchema {
name: "logical_size",
value_type: ValueType::UnsignedInt,
description: "Logical file size recorded in the slack $FILE_NAME entry; corroborates the recovered filename and can differ from any surviving $DATA run",
is_uid_component: false,
},
FieldSchema {
name: "parent_reference",
value_type: ValueType::Text,
description: "MFT reference (entry number + sequence) of the parent directory whose $I30 index holds this entry, locating where the deleted file resided",
is_uid_component: false,
},
];
/// NTFS directory index ($I30) slack — deleted-filename recovery from B-tree slack.
///
/// A directory's filename index is named `$I30` after the $FILE_NAME attribute type
/// code (0x30) it sorts on. It is a virtual view of three attributes on the
/// directory's $MFT record: $INDEX_ROOT (0x90, the resident B-tree root),
/// $INDEX_ALLOCATION (0xA0, non-resident INDX blocks — each begins with the "INDX"
/// signature), and $BITMAP (0xB0, which INDX blocks are in use). B-tree rebalancing
/// (node splits/merges on add/remove) leaves *slack* — stale entry copies — distinct
/// from file slack. Each entry is a copy of a file's $FILE_NAME attribute, so a
/// removed file's name, logical size and $FN MACB set survive in slack even after
/// Shift+Delete and reuse of its $MFT record. Complements $MFT recovery: it can name
/// a file whose $MFT entry is already overwritten.
///
/// Source: Brian Carrier, "File System Forensic Analysis" (2005) ch.13 — NTFS indexes,
/// B-trees and $INDEX_ALLOCATION (authoritative reference).
/// Source: https://github.com/libyal/libfsntfs — index entry / $INDEX_ALLOCATION layout.
/// Source: https://github.com/EricZimmerman/MFTECmd — surfaces slack entries (From Slack).
pub static NTFS_I30_INDEX: ArtifactDescriptor = ArtifactDescriptor {
id: "ntfs_i30_index",
name: "NTFS Directory Index ($I30) slack",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"<NTFS directory>:$I30:$INDEX_ALLOCATION"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "The filename index of an NTFS directory ($I30, named after the $FILE_NAME \
attribute type 0x30). It is a B-tree spread across the directory's $INDEX_ROOT (0x90, \
resident root), $INDEX_ALLOCATION (0xA0, non-resident blocks each starting with the INDX \
signature) and $BITMAP (0xB0). Node splits and merges during add/remove leave slack — stale \
copies of entries — that retain a removed file's name, logical size and full $FILE_NAME MACB \
set. Because those copies persist independently of the file's $MFT record, a deleted \
filename can be recovered from $I30 slack even after Shift+Delete and after the $MFT entry \
is reused, making it frequently the only proof a file existed in a folder. Parse from $MFT / \
raw disk with MFTECmd, which flags carved entries as From Slack = true.",
mitre_techniques: &["T1070.004"],
fields: NTFS_I30_INDEX_FIELDS,
retention: Some("Slack entries persist in $INDEX_ALLOCATION until B-tree rebalancing or new entries overwrite the slack region"),
triage_priority: TriagePriority::High,
related_artifacts: &["mft", "mft_file", "usn_journal", "recycle_bin"],
sources: &[
// Carrier, File System Forensic Analysis (2005) ch.13 — NTFS indexes / B-trees (book, no stable URL).
"https://github.com/libyal/libfsntfs",
"https://github.com/EricZimmerman/MFTECmd",
"https://forensics.wiki/ntfs/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Slack entries can be partially overwritten by later B-tree rebalancing; a recovered name may be truncated and its size/timestamps stale",
"The $FN timestamps reflect when the entry was written (file creation), not the deletion time; do not read them as a deletion timestamp",
"Presence proves the name existed in the directory index; it does not prove the file content survived, nor which user created or deleted it",
"Requires raw disk / $MFT access; MFTECmd marks carved entries From Slack = true",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Index-slack entries persist in the directory's $INDEX_ALLOCATION until rebalancing or new entries overwrite the slack region",
};
pub(crate) static NTFS_ADS_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "stream_name",
value_type: ValueType::Text,
description: "Name of the alternate $DATA stream (the <stream name> in <filename>:<stream name>:$DATA). Empty for default file content; non-empty names such as 'Zone.Identifier', '$J', or an arbitrary attacker-chosen name identify an ADS. Any legal filename character, including spaces, is permitted",
is_uid_component: true,
},
FieldSchema {
name: "stream_type",
value_type: ValueType::Text,
description: "The <stream type> component, normally '$DATA' for a data stream (directories use '$INDEX_ALLOCATION'; the default directory index is '$I30'). Confirms the attribute is a data stream rather than an index",
is_uid_component: false,
},
FieldSchema {
name: "stream_size",
value_type: ValueType::UnsignedInt,
description: "Logical byte length of the named stream from its $DATA attribute — the size Explorer and plain `dir` do NOT report for the host file. A non-trivial size on an otherwise small file is a hiding indicator",
is_uid_component: false,
},
FieldSchema {
name: "host_path",
value_type: ValueType::Text,
description: "Full path of the host file or directory that owns the stream (the <filename> component), tying the hidden stream to its visible carrier for pivoting to the $MFT record",
is_uid_component: true,
},
];
/// Generic NTFS Alternate Data Stream — any named $DATA attribute.
///
/// Distinct from `zone_identifier` (the specific Zone.Identifier/MOTW ADS with its own
/// [ZoneTransfer] INI schema): this is the generic parent for arbitrary named streams
/// and their hiding/execution abuse.
///
/// Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3 ([MS-FSCC] NTFS Streams: naming syntax, default ::$DATA, dir /R visibility)
/// MITRE: T1564.004 (Hide Artifacts: NTFS File Attributes)
pub static NTFS_ADS: ArtifactDescriptor = ArtifactDescriptor {
id: "ntfs_ads",
name: "NTFS Alternate Data Stream (generic named $DATA stream)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"<any-file-or-dir>:<stream-name>:$DATA"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "An NTFS file or directory may carry more than one $DATA attribute. The first, unnamed \
$DATA attribute is the ordinary file content; any additional NAMED $DATA attribute is an Alternate \
Data Stream (ADS). Per [MS-FSCC] a stream's full name is <filename>:<stream name>:<stream type>, so \
default content is file.txt::$DATA and a named ADS is file.txt:secret:$DATA. Any character legal in a \
filename (including spaces) is legal in a stream name, and directories can carry named data streams. \
ADS are NOT shown by default `dir` or Explorer (which report only the unnamed stream's size); they \
surface with `dir /R`, `Get-Item -Stream *`, `fsutil file streams`, or an $MFT parser that enumerates \
every $DATA attribute. Legitimate ADS exist across the OS — Zone.Identifier (Mark-of-the-Web), the \
$UsnJrnl:$J and :$Max change-journal streams, SmartScreen/Wof metadata, and Finder/SMB resource forks. \
Abuse is the mirror image: an adversary hides a payload, script, or exfil data in a named stream so it \
occupies no visible file, is skipped by tools scanning only unnamed streams, and can be executed \
directly. ADS do not survive a copy to a non-NTFS volume (FAT/exFAT), most SMB shares, or many \
archive/email round-trips, so absence never proves a stream was never present. The presence, name, \
size and bytes of a named stream are the facts; benign vs malicious is inferred from the name and \
content, not from ADS presence alone.",
mitre_techniques: &["T1564.004"],
fields: NTFS_ADS_FIELDS,
retention: Some("Persists with the host file on NTFS until the file, the named stream, or the $DATA attribute is removed; lost on copy to FAT/exFAT, most SMB shares, and many archive/email round-trips"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["mft", "mft_file", "zone_identifier", "usnjrnl"],
sources: &[
"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"ADS presence is a filesystem fact; benign vs malicious is inferred from the stream name and its bytes, not from the mere existence of a named stream (Zone.Identifier, $UsnJrnl:$J and resource-fork streams are all legitimate)",
"Requires an $MFT parser or raw enumeration (dir /R, Get-Item -Stream, fsutil file streams); default `dir` and Explorer hide named streams and report only the unnamed stream's size",
"Streams are not carried to non-NTFS volumes (FAT/exFAT), most SMB/network shares, or many archive/email round-trips, so absence does not prove a stream was never present",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "On-disk NTFS metadata; a named $DATA stream persists with the host file until the file or the named stream is deleted",
};
pub(crate) static NTFS_REPARSE_POINT_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "reparse_tag",
value_type: ValueType::UnsignedInt,
description: "32-bit reparse tag from the $REPARSE_POINT (0xC0) attribute; identifies the owning filter driver. Decode per [MS-FSCC] bit-field (M/R/N/D flags + 16-bit Value). Show the raw hex tag when not one of the predefined values",
is_uid_component: true,
},
FieldSchema {
name: "tag_name",
value_type: ValueType::Text,
description: "Symbolic name when recognised (IO_REPARSE_TAG_MOUNT_POINT 0xA0000003, IO_REPARSE_TAG_SYMLINK 0xA000000C, IO_REPARSE_TAG_WOF 0x80000017, IO_REPARSE_TAG_DEDUP 0x80000013, IO_REPARSE_TAG_CLOUD 0x9000001A, IO_REPARSE_TAG_APPEXECLINK 0x8000001B, IO_REPARSE_TAG_LX_SYMLINK 0xA000001D); for an unrecognised tag report the raw 0x-hex value verbatim",
is_uid_component: false,
},
FieldSchema {
name: "name_surrogate",
value_type: ValueType::Bool,
description: "The N bit (29) of the tag: true = a path redirection (junction/symlink/mount point) whose SubstituteName names another object; false = a data-overlay tag (WOF/Dedup/Cloud) that virtualises the file's own data in place",
is_uid_component: false,
},
FieldSchema {
name: "substitute_name",
value_type: ValueType::Text,
description: "For MOUNT_POINT/SYMLINK, the kernel target path (often \\??\\-prefixed) the point redirects to — reveals where a path actually resolves",
is_uid_component: false,
},
FieldSchema {
name: "print_name",
value_type: ValueType::Text,
description: "The display path shown to the user for a junction/symlink (may differ from the substitute/kernel path)",
is_uid_component: false,
},
FieldSchema {
name: "reparse_data_length",
value_type: ValueType::UnsignedInt,
description: "Length in bytes of the filter-specific reparse data following the tag header (0xC0 attribute ReparseDataLength)",
is_uid_component: false,
},
];
/// NTFS Reparse Points — $REPARSE_POINT (0xC0) attribute + volume-wide $Extend\$Reparse:$R index.
///
/// Source: https://learn.microsoft.com/openspecs/windows_protocols/ms-fscc/c8e77b37-3909-4fe6-a4ea-2b9d423b1ee4 ([MS-FSCC] Reparse Tags — tag bit-field + predefined tag/value table)
/// Source: https://github.com/libyal/libfsntfs (RE: $Extend\$Reparse $R index + 0xC0 layout)
/// Source: https://flatcap.github.io/linux-ntfs/ntfs/attributes/reparse_point.html (linux-ntfs RE: 0xC0 structure)
pub static NTFS_REPARSE_POINT: ArtifactDescriptor = ArtifactDescriptor {
id: "ntfs_reparse_point",
name: "NTFS Reparse Points ($REPARSE_POINT / $Extend\\$Reparse)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"<NTFS file/dir>:$REPARSE_POINT (attr 0xC0); enumerated volume-wide via $Extend\$Reparse:$R"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "A reparse point is an NTFS extensibility mechanism: any file or directory can carry a \
$REPARSE_POINT attribute (MFT type 0xC0), and its $STANDARD_INFORMATION flags carry \
FILE_ATTRIBUTE_REPARSE_POINT (0x400). The attribute begins with a 32-bit reparse tag naming the \
filter driver that owns the point. Per [MS-FSCC] the tag is a bit-field: bit 31 = M (Microsoft-owned), \
bit 30 = R (reserved), bit 29 = N (Name Surrogate — the entry is an alias/redirection), bit 28 = D \
(Directory), bits 0-15 = the tag Value. The N bit is the key discriminator: N=1 tags are true path \
redirections (junctions 0xA0000003, symlinks 0xA000000C, mount points, WSL symlinks 0xA000001D); N=0 \
tags overlay or virtualise the file's own data in place (WOF/compression 0x80000017, Dedup 0x80000013, \
OneDrive/Cloud placeholders 0x9000001A). For MOUNT_POINT/SYMLINK the data holds a SubstituteName (the \
kernel target, often \\??\\-prefixed) and a PrintName (display path). NTFS also maintains a volume-wide \
index in the metadata file $Extend\\$Reparse: an index named $R enumerates every reparse point on the \
volume keyed by MFT file_id (keys only, no data — the reparse data lives in each file's 0xC0 attribute). \
Forensic relevance: junctions/symlinks are abused for path redirection, TOCTOU races and sandbox escapes \
(inspect the SubstituteName to see where a path really resolves); WOF/Dedup tags mean the file's bytes \
are NOT in a plain $DATA run, so a naive carve returns a stub while the content sits in the WIM/overlay \
or Dedup chunk store; CLOUD/OneDrive tags mark placeholder (dehydrated) files whose data is not resident \
locally. Enumerate with fsutil reparsepoint query, MFTECmd, or libfsntfs.",
mitre_techniques: &[],
fields: NTFS_REPARSE_POINT_FIELDS,
retention: Some("Persists in the file's on-disk 0xC0 attribute and the $Extend\\$Reparse index until the reparse point is removed or the file is deleted"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["mft", "mft_file", "ntfs_i30_index", "usn_journal", "logfile_ntfs"],
sources: &[
"https://learn.microsoft.com/openspecs/windows_protocols/ms-fscc/c8e77b37-3909-4fe6-a4ea-2b9d423b1ee4",
"https://learn.microsoft.com/openspecs/windows_protocols/ms-fscc/ca069dad-ed16-42aa-b057-b6b207f447cc",
"https://learn.microsoft.com/openspecs/windows_protocols/ms-fscc/b41f1cbf-10df-4a47-98d4-1c52a833d913",
"https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc",
"https://flatcap.github.io/linux-ntfs/ntfs/attributes/reparse_point.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"The $Extend\\$Reparse $R index enumerates points by MFT file_id but stores no reparse data; the authoritative data is each file's 0xC0 attribute — reconcile the two",
"A WOF/Dedup/Cloud tag means the file's real bytes are NOT in a plain $DATA run; a naive $DATA carve returns a stub — resolve the overlay/chunk-store/cloud source before concluding the content was present",
"A CLOUD/OneDrive placeholder is an online-only/dehydrated file whose data is not resident locally; corroborate with cloud-sync artifacts before concluding the content was ever on the machine",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Reparse data is stored in the file's on-disk $REPARSE_POINT (0xC0) MFT attribute and indexed in $Extend\\$Reparse; it persists until the reparse point is removed or the file is deleted",
};
pub(crate) static PHOTOREC_RECUP_DIR_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "recovered_file",
value_type: ValueType::Text,
description: "Recovered file, named f<sector><ext> (e.g. f0017088.txt); 'f' = file, number = logical sector of file start",
is_uid_component: true,
},
FieldSchema {
name: "start_sector",
value_type: ValueType::UnsignedInt,
description: "Sector where the file begins, embedded in the filename = (file location - partition offset) / sector size; equals the original cluster/block number when block size == sector size",
is_uid_component: false,
},
FieldSchema {
name: "embedded_title",
value_type: ValueType::Text,
description: "Optional title extracted from file metadata and appended to the name (Office/PDF etc.)",
is_uid_component: false,
},
FieldSchema {
name: "thumbnail_file",
value_type: ValueType::Text,
description: "t*.jpg — thumbnail carved from inside a picture",
is_uid_component: false,
},
FieldSchema {
name: "broken_file",
value_type: ValueType::Text,
description: "b<sector><ext> — corrupted file or fragment retained when 'keep corrupted files' was enabled",
is_uid_component: false,
},
FieldSchema {
name: "report_xml",
value_type: ValueType::Text,
description: "report.xml in the first recup_dir; records sectorsize and img_offset (partition offset) for the run, letting an examiner map each f<sector> file back to a byte offset in the source image",
is_uid_component: false,
},
];
/// PhotoRec / QPhotoRec carving output — the recup_dir.N tree signature that a file
/// carver was run.
///
/// Source: https://www.cgsecurity.org/testdisk_doc/photorec.html (f<sector> naming, 500-files/dir, report.xml sectorsize/img_offset, t*/b prefixes)
/// Source: https://www.cgsecurity.org/wiki/PhotoRec_FAQ (logical-sector filename convention)
/// Source: https://www.cgsecurity.org/testdisk_doc/running.html (Windows binaries photorec_win.exe / qphotorec_win.exe)
pub static PHOTOREC_RECUP_DIR: ArtifactDescriptor = ArtifactDescriptor {
id: "photorec_recup_dir",
name: "PhotoRec Carving Output (recup_dir.N)",
artifact_type: ArtifactLocation::Directory,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"recup_dir.N"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Output directory tree produced by PhotoRec / QPhotoRec file carving. PhotoRec writes \
recovered files into sequentially-numbered sub-directories recup_dir.1, recup_dir.2, ... under a \
user-chosen destination, creating a new sub-directory every 500 recovered files. Each recovered file \
is named by a single letter + a >=7-digit number + the detected extension: 'f' = a normally recovered \
file whose number is the logical sector where the file begins ((file location - partition offset) / \
sector size), e.g. f0017088.txt begins at sector 17088; when PhotoRec can extract an embedded title it \
appends it. Thumbnails carved from inside pictures are saved as t*.jpg; corrupted files/fragments (if \
kept) begin with 'b' (broken). The first recup_dir also contains report.xml recording the run's \
sectorsize and img_offset (partition offset). The mere presence of this directory tree is a strong \
signature that PhotoRec/QPhotoRec was executed and used to carve/recover files on that system or against \
that image. Carving loses filesystem context: original filenames and directory structure are not \
preserved (except an optional embedded title).",
mitre_techniques: &[],
fields: PHOTOREC_RECUP_DIR_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["prefetch_dir", "amcache_app_file", "userassist_exe"],
sources: &[
"https://www.cgsecurity.org/testdisk_doc/photorec.html",
"https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step",
"https://www.cgsecurity.org/wiki/PhotoRec_FAQ",
"https://www.cgsecurity.org/testdisk_doc/running.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"Destination directory is chosen by whoever runs PhotoRec; there is no fixed path — match on the 'recup_dir.<N>' name pattern plus f/t/b-prefixed sector-named files and a sibling report.xml",
"Cross-platform: identical output convention on Linux, macOS and Windows; only the executable names (photorec_win.exe / qphotorec_win.exe) are Windows-specific",
"Carving loses filesystem context: original filenames and directory structure are not preserved (except an optional embedded title); the sector number in the name locates the file start within the source, not the original path",
"Presence evidences that a carving/recovery run occurred (legitimate examiner, a user recovering their own data, or an adversary staging data) — it does not by itself establish intent",
"report.xml records the run's sectorsize and img_offset, letting an examiner map each f<sector> file back to a byte offset in the source image",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Carved output files persist on disk until explicitly deleted",
};
pub(crate) static WZCSVC_WIRELESS_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "interface_guid",
value_type: ValueType::Text,
description: "Subkey name = GUID of the wireless network adapter",
is_uid_component: true,
},
FieldSchema {
name: "ssid",
value_type: ValueType::Text,
description: "Connected network SSID; length = DWORD (LE) at binary offset 0x10, name bytes begin at offset 0x14 (per RegRipper ssid.pl)",
is_uid_component: true,
},
FieldSchema {
name: "ap_mac",
value_type: ValueType::Text,
description: "Access-point BSSID/MAC address, 6 bytes at binary offset 0x08",
is_uid_component: false,
},
FieldSchema {
name: "last_write",
value_type: ValueType::Timestamp,
description: "LastWrite time of the interface-GUID subkey; consistent with last wireless-config update / last association on that adapter",
is_uid_component: false,
},
];
/// WZCSVC Wireless Interface Connection History — Windows XP / Server 2003 Wireless
/// Zero Configuration wireless SSID history (predecessor of Vista+ NetworkList).
///
/// Source: https://github.com/keydet89/RegRipper3.0/blob/master/plugins/ssid.pl (tool oracle: key path, SSID/MAC binary offsets)
/// Source: http://windowsir.blogspot.com/2005/07/where-oh-where-did-my-little-ssid-go.html (Carvey RE — corroboration)
pub static WZCSVC_WIRELESS_INTERFACES: ArtifactDescriptor = ArtifactDescriptor {
id: "wzcsvc_wireless_interfaces",
name: "WZCSVC Wireless Interface Connection History (Windows XP)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSoftware),
key_path: "Microsoft\\WZCSVC\\Parameters\\Interfaces",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Windows XP / Server 2003 Wireless Zero Configuration Service (WZCSVC) wireless \
connection history. Each subkey under Parameters\\Interfaces is named by the wireless adapter's \
interface GUID; its LastWrite time is consistent with the last time that adapter's wireless \
configuration was updated (approximate last-connect). Under each GUID subkey, ActiveSettings \
(REG_BINARY) holds the current/last-active profile and Static#0000, Static#0001, … each hold a \
previously-connected wireless network (SSID at binary offset 0x14 with its length DWORD at 0x10, and \
the AP BSSID/MAC at offset 0x08). It is the XP-era predecessor of the Vista+ NetworkList profile \
history. Wireless-only — it does not record wired or broadband networks, and the wired/wireless/\
broadband NameType classification is a NetworkList (Vista+) feature, not WZCSVC.",
mitre_techniques: &[],
fields: WZCSVC_WIRELESS_FIELDS,
retention: Some("Registry subkeys persist in the SOFTWARE hive until explicit deletion or profile removal"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["networklist_profiles", "wifi_profiles", "dhcp_ipv4_interface", "network_interfaces"],
sources: &[
"https://github.com/keydet89/RegRipper3.0/blob/master/plugins/ssid.pl",
"http://windowsir.blogspot.com/2005/07/where-oh-where-did-my-little-ssid-go.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"WZCSVC is Windows XP / Server 2003 ONLY — replaced by WLAN AutoConfig (WlanSvc) + NetworkList on Vista and later; the key is absent on modern systems",
"SSID history is populated only when wireless is managed by WZCSVC; vendor clients (Broadcom, Cisco, Intel) may store SSIDs in their own keys instead",
"Interface-GUID LastWrite reflects the most recent config write — consistent with, but not proof of, the exact last connection time",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Registry key in the SOFTWARE hive; persists until explicit deletion or profile removal",
};
pub(crate) static NTFS_MACB_RULES_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "op_create",
value_type: ValueType::Text,
description: "File create: SI + FN M,A,C,B all set to the creation time",
is_uid_component: false,
},
FieldSchema {
name: "op_access",
value_type: ValueType::Text,
description: "File access: SI A only (gated by the Last-Access policy — often disabled); FN unchanged",
is_uid_component: false,
},
FieldSchema {
name: "op_modify",
value_type: ValueType::Text,
description: "Data modify: SI M,C update (A too if Last-Access enabled); B unchanged; FN unchanged",
is_uid_component: false,
},
FieldSchema {
name: "op_rename_local",
value_type: ValueType::Text,
description: "Local rename: SI C only; FN rewritten from the current SI values (indirect propagation — defeats naive $FN-vs-$SI comparison after a rename)",
is_uid_component: false,
},
FieldSchema {
name: "op_move_local",
value_type: ValueType::Text,
description: "Same-volume move: SI C updates; FN C updates; M,A,B preserved",
is_uid_component: false,
},
FieldSchema {
name: "op_move_xvolume",
value_type: ValueType::Text,
description: "Cross-volume move: SI A,C update to move time; M,B preserved; FN reset to move time",
is_uid_component: false,
},
FieldSchema {
name: "op_copy_xvolume",
value_type: ValueType::Text,
description: "Cross-volume copy: SI M,C inherited from the SOURCE; A,B = copy time; FN MACB all = copy time. Yields the classic COPY tell — SI Modified EARLIER than SI Born (M < B) — which no create/write path produces",
is_uid_component: true,
},
FieldSchema {
name: "op_delete",
value_type: ValueType::Text,
description: "Delete: no SI/FN timestamp change; the MFT record is marked inactive",
is_uid_component: false,
},
];
/// NTFS MACB Timestamp Update Rules — per-operation interpretive baseline.
///
/// An interpretive descriptor anchored to $MFT (where the $STANDARD_INFORMATION 0x10 and
/// $FILE_NAME 0x30 timestamp sets live). It encodes which of the four MACB values move on
/// each file operation, so an observed set that no single operation can produce (or an
/// internally impossible SI ordering like M < B) is the reference frame for detecting
/// forgery. Judge observed timestamps against this frame; it does not by itself prove
/// tampering — account for OS-version drift, last-access policy and File System Tunneling.
///
/// Source: https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table ($MFT, $SI vs $FN)
/// Source: https://dfir.ru/2021/01/10/standard_information-vs-file_name/ (SI vs FN update RE)
/// Source: https://www.senturean.com/posts/19_04_22_win10_ntfs_time_rules/ (empirical Win10 per-operation matrix)
pub static NTFS_MACB_RULES: ArtifactDescriptor = ArtifactDescriptor {
id: "ntfs_macb_rules",
name: "NTFS MACB Timestamp Update Rules (Per-Operation Baseline)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"\\.\<volume>\$MFT"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Interpretive baseline for reading NTFS timestamps: which of the four MACB values move on \
each file operation. Each MFT record holds two timestamp sets — $STANDARD_INFORMATION (SI, attr 0x10, \
user-writable via SetFileTime) and $FILE_NAME (FN, attr 0x30, kernel-maintained). M=Modified (data), \
A=Accessed, C=MFT/metadata changed (entry-modified), B=Born/created; all are 64-bit FILETIME (100ns \
since 1601-01-01 UTC). Legitimate operations move a KNOWN subset; a set that cannot be produced by any \
single operation, or SI values that are internally impossible (e.g. M earlier than B), is the reference \
frame for detecting forgery (T1070.006). The strongest single-record tell encoded here is the COPY tell \
— on a cross-volume copy, SI M and C are inherited from the source while SI A and B are the copy time, \
so SI Modified is EARLIER than SI Born (M < B), which no create/write path produces. Local rename \
rewrites FN from the current SI values, so a naive $FN-vs-$SI comparison is defeated after a rename — \
cross-check operation sequencing against the USN journal (reason codes) and $LogFile (LSN ordering), and \
note that the directory index ($I30) retains a $SI snapshot that can predate a later $SI timestomp. Use \
as the frame against which observed $SI/$FN sets and MACB orderings are judged; it does not by itself \
prove tampering (account for OS-version drift, last-access policy and File System Tunneling first).",
mitre_techniques: &["T1070.006"],
fields: NTFS_MACB_RULES_FIELDS,
retention: Some("Interpretive baseline; the underlying $MFT timestamps persist until overwritten"),
triage_priority: TriagePriority::High,
related_artifacts: &[
"mft",
"mft_file",
"ntfs_i30_index",
"ntfs_last_access_status",
"logfile_ntfs",
"usnjrnl",
"usn_journal",
"recycle_bin",
],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table",
"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior",
"https://dfir.ru/2021/01/10/standard_information-vs-file_name/",
"https://dfir.ru/2018/12/08/the-last-access-updates-are-almost-back/",
"https://www.senturean.com/posts/19_04_22_win10_ntfs_time_rules/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"A deviation from the baseline is CONSISTENT WITH forgery, not proof of it — account for OS-version drift, the last-access policy, and File System Tunneling before concluding tampering",
"Local rename rewrites $FN from the current $SI values, so $FN-vs-$SI comparison is unreliable after a rename; corroborate operation ordering with the USN journal and $LogFile",
"The COPY tell (SI M < B) flags a cross-volume copy or crude timestomping from a single record without needing $FN; a matched, self-consistent set does not exclude a careful full-set timestomp",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Interpretive baseline; the underlying $MFT timestamps persist until overwritten",
};
pub(crate) static MEM_FINDEVIL_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "pid",
value_type: ValueType::UnsignedInt,
description: "Owning process identifier of the flagged artifact",
is_uid_component: true,
},
FieldSchema {
name: "process_name",
value_type: ValueType::Text,
description: "Short process image name (max 15 chars as shown by MemProcFS)",
is_uid_component: false,
},
FieldSchema {
name: "detection_type",
value_type: ValueType::Text,
description: "FindEvil anomaly flag identifying the type of memory anomaly detected (e.g. PEB_MASQ, PROC_NOLINK, PE_NOLINK, PE_PATCHED, NOIMAGE_RWX); higher-severity flags sort to the top of findevil.txt",
is_uid_component: false,
},
FieldSchema {
name: "virtual_address",
value_type: ValueType::UnsignedInt,
description: "Virtual address of the flagged region/module/PEB within the process address space",
is_uid_component: true,
},
FieldSchema {
name: "description",
value_type: ValueType::Text,
description: "Detection-specific detail — e.g. the module name and backing VAD for a hidden/unlinked module finding, or page/protection detail for a patched-image or floating-executable-memory finding",
is_uid_component: false,
},
];
/// MemProcFS FindEvil anomaly detections — defensive memory-triage output.
///
/// FindEvil is MemProcFS's built-in memory anomaly scanner; it writes flagged
/// process/module/page anomalies to the virtual file `/forensic/findevil/findevil.txt`
/// for an examiner to investigate. This descriptor lets a tool recognise and triage
/// that output; it is a detection aid, not proof of compromise (FindEvil documents
/// false positives and coverage gaps).
///
/// Source: https://github.com/ufrisk/MemProcFS/blob/master/vmm/modules/modules.h (VMMEVIL_TYPE flag table)
/// Source: https://github.com/ufrisk/MemProcFS/wiki/FS_FindEvil (per-flag descriptions, output format, 64-bit Win10/11 scope, false-positive caveat)
pub static MEM_FINDEVIL: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_findevil",
name: "FindEvil Anomaly Detections (Memory)",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "MemProcFS FindEvil scans process and kernel memory for indicators of user-mode malware \
and reports anomalies in the virtual file /forensic/findevil/findevil.txt (columns: PID, ProcessName, \
Type, VirtualAddress, Module/Description), ranked by severity. It is a defensive triage aid: each row \
flags a memory anomaly for an examiner to investigate, not a confirmed detection. The flag categories \
group into process-level deception (a process whose kernel image path differs from its user-land path, \
a process object unlinked from the kernel's active-process list, or a masqueraded page-table base), \
hidden or injected modules (an executable image present in the VAD map but not linked from the \
in-process module lists), in-memory image patches (an image page whose physical page differs from the \
kernel's on-disk-backed prototype page), and floating executable memory (executable pages in private or \
non-image regions — the classic signature of injected shellcode). Triage by the built-in severity \
ranking, then pivot: process-deception flags to a kernel-vs-user process comparison, hidden/injected \
modules to the loaded-module list and VAD map, patched images to an on-disk image diff, and floating \
executable memory to the owning process and its network connections. Note a suppression side-effect: a \
process-level masquerade or unlink finding suppresses per-module hidden-module rows for the same \
process, so the absence of a module-level flag is not exculpatory.",
mitre_techniques: &["T1055", "T1055.012", "T1036", "T1620", "T1134.004"],
fields: MEM_FINDEVIL_FIELDS,
retention: Some("Derived from live RAM; present only in a memory image / live acquisition"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["mem_running_processes", "mem_loaded_modules", "mem_network_connections"],
sources: &[
"https://github.com/ufrisk/MemProcFS/blob/master/vmm/modules/modules.h",
"https://github.com/ufrisk/MemProcFS/wiki/FS_FindEvil",
"https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"MemProcFS documents that FindEvil has false positives and will miss certain malware — a flag is an anomaly indicator CONSISTENT WITH malicious code, warranting manual triage, not proof",
"Enabled only for 64-bit Windows 10/11 targets (to keep the false-positive ratio low); not produced on 32-bit or older systems",
"Detects user-mode anomalies; kernel/rootkit techniques and not-yet-modelled techniques are missed",
"A process-level masquerade or unlink finding suppresses per-module hidden-module rows for the same process, so the absence of a module-level flag does not exclude a hidden module",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "Derived from live RAM; lost on power-off and re-computed per acquisition",
};
/// File Carving — content/signature-based recovery of files from raw storage.
///
/// A recovery *technique* over unallocated/slack/raw regions, not a fixed on-disk path
/// (modelled as File with file_path: None, like the pagefile_sys/hiberfil_sys concept
/// entries). os_scope is recorded as All (the catalog's broadest value) purely as a
/// schema placeholder — carving is filesystem- and OS-independent; see the caveat.
///
/// Source: https://www.cgsecurity.org/wiki/PhotoRec (ignores the filesystem, matches signatures)
/// Source: Garfinkel, "Carving contiguous and fragmented files with fast object validation", DFRWS 2007
/// https://calhoun.nps.edu/server/api/core/bitstreams/22c52db8-a881-475e-9a66-7709b50176fb/content
pub static FILE_CARVING: ArtifactDescriptor = ArtifactDescriptor {
id: "file_carving",
name: "File Carving (Signature-Based Recovery)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Content/signature-based recovery of files from unallocated space, slack, or a raw disk \
image, reconstructing files from their byte content rather than from filesystem metadata that points \
to the content (Garfinkel, DFRWS 2007). Works after the filesystem is damaged, reformatted, or the \
directory/inode/MFT entry deleted. Recovers file DATA ONLY — the original filename, full path, and MAC \
timestamps are lost with the metadata and are NOT reconstructible by carving. Because it operates on \
raw bytes, carving is filesystem- and OS-independent (see the os_scope caveat).",
mitre_techniques: &[],
fields: FILE_PATH_FIELDS,
retention: None,
triage_priority: TriagePriority::Medium,
related_artifacts: &["mft", "usnjrnl", "recycle_bin", "pagefile_sys", "hiberfil_sys"],
sources: &[
"https://www.cgsecurity.org/wiki/PhotoRec",
"https://www.sciencedirect.com/science/article/pii/S1742287607000369",
"https://calhoun.nps.edu/server/api/core/bitstreams/22c52db8-a881-475e-9a66-7709b50176fb/content",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Carved content proves the byte sequence existed on the medium, but without recoverable filename/path/timestamps it cannot alone establish when it was written or by whom — needs corroboration for attribution/timeline",
"Basic header/footer (contiguous) carving cannot reassemble FRAGMENTED files — Garfinkel (DFRWS 2007): 'no file carvers can automatically reassemble fragmented files'; fragmented recoveries emerge truncated or corrupt",
"Carving is filesystem- and OS-independent; os_scope is recorded as All (the catalog's broadest value) as a schema limitation, NOT a claim that carving is Windows-specific",
],
volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
volatility_rationale: "Carving targets unallocated and slack space, which is reused (overwritten) by ordinary new file allocations; recoverability degrades with continued system use",
};
pub(crate) static NTFS_OBJID_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "object_id",
value_type: ValueType::Guid,
description: "16-byte GUID (key of the $O index / offset 0 of the $OBJECT_ID attribute) uniquely identifying the file within this volume; can repeat on a different volume but never on the same one (MS-FSCC 2.1.3.1). Version-1 GUIDs embed the origin machine's MAC address + a 60-bit creation timestamp",
is_uid_component: true,
},
FieldSchema {
name: "file_reference",
value_type: ValueType::Integer,
description: "8-byte MFT file reference (48-bit record number + 16-bit sequence) stored in the $O index value data, linking the object ID back to its MFT entry",
is_uid_component: true,
},
FieldSchema {
name: "birth_volume_id",
value_type: ValueType::Guid,
description: "16-byte GUID of the volume the file was created on. Its first byte's low-order bit is the CrossVolumeMoveFlag (MS-DLTW), set when the file has moved across volumes",
is_uid_component: false,
},
FieldSchema {
name: "birth_object_id",
value_type: ValueType::Guid,
description: "16-byte GUID = the object ID assigned at creation; copy/move/other operations MAY change ObjectId but not BirthObjectId, so it persists as a stable cross-volume/rename tracking key (MS-FSCC 2.1.3.1)",
is_uid_component: false,
},
FieldSchema {
name: "birth_domain_id",
value_type: ValueType::Guid,
description: "16-byte DomainId — unused; SHOULD be zero and MUST be ignored on all volumes (MS-FSCC 2.1.3.1)",
is_uid_component: false,
},
];
/// NTFS Object ID Index ($Extend\$ObjId:$O) — distributed-link-tracking GUIDs.
///
/// $Extend\$ObjId is an NTFS metadata file dynamically allocated under the $Extend
/// directory (MFT record 11); it is commonly placed around MFT entry 24-27 on a default
/// format but that is not a fixed/spec-guaranteed record number. Its $O index maps each
/// file's object-ID GUID to the file's MFT reference; the per-file record also lives in
/// the resident $OBJECT_ID attribute (type 0x40).
///
/// Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/34a727a2-960a-4825-9cd2-6100c84e3a81 ([MS-FSCC] 2.1.3.1 — 64-byte FILE_OBJECTID_BUFFER)
/// Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/63cdde16-85ac-480c-95bf-0bb8f5f09de8 ([MS-FSCC] 2.4.36.1 — 8-byte FileReferenceNumber prefix)
/// Source: https://github.com/libyal/libfsntfs (RE: $Extend\$ObjId, $OBJECT_ID 0x40, $O index layout)
pub static NTFS_OBJID: ArtifactDescriptor = ArtifactDescriptor {
id: "ntfs_objid",
name: "NTFS Object ID Index ($Extend\\$ObjId:$O)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"\\.\<volume>\$Extend\$ObjId"),
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Maps NTFS object-identifier GUIDs to MFT file references for distributed link tracking; \
each 64-byte record carries an object ID plus the birth volume/object/domain IDs recorded when the ID \
was first assigned, so a file can be correlated across renames and cross-volume copy/move operations \
even after its current object ID changes. The BirthObjectId is the stable key: operations may rewrite \
ObjectId but not BirthObjectId. Version-1 object-ID GUIDs embed the origin machine's MAC address and a \
creation timestamp, and the same droid/birth-droid GUIDs are copied into LNK shortcuts and jump lists \
— so a shortcut or its target can be tied back to the $ObjId record and to the machine that created it. \
Object-ID tampering surfaces as USN_REASON_OBJECT_ID_CHANGE (0x00080000) in the USN journal.",
mitre_techniques: &[],
fields: NTFS_OBJID_FIELDS,
retention: Some("Object-ID record persists for the life of the file's MFT entry; the $O index entry survives until the object ID is deleted (FSCTL_DELETE_OBJECT_ID) or the file is removed"),
triage_priority: TriagePriority::Medium,
related_artifacts: &["mft", "usnjrnl", "logfile_ntfs", "lnk_files", "jump_list_auto", "jump_list_custom"],
sources: &[
"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/34a727a2-960a-4825-9cd2-6100c84e3a81",
"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/63cdde16-85ac-480c-95bf-0bb8f5f09de8",
"https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"ObjectId is unique per volume, not globally — the same GUID can legitimately appear on a different volume; use BirthVolumeId/BirthObjectId for cross-volume correlation",
"A version-1 object-ID GUID embeds a MAC address + creation time, but those are set at assignment and can be stale or (with effort) forged — consistent with, not proof of, the origin machine/time",
"The object-ID record does not itself carry the file's MAC timestamps; correlate with the $MFT entry it references for timeline",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "On-disk NTFS metadata ($Extend\\$ObjId index + per-file $OBJECT_ID attribute); persists until the object ID or file is deleted",
};
pub(crate) static MEM_EXTRACTED_PE_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "artifact_kind",
value_type: ValueType::Text,
description: "What was recovered: process_image | full_process_dump | dll | kernel_driver — determines whether the output is a reconstructed PE or a raw resident-memory blob",
is_uid_component: false,
},
FieldSchema {
name: "pid",
value_type: ValueType::UnsignedInt,
description: "Owning process id for process-image / full-process / DLL dumps (absent for kernel drivers)",
is_uid_component: true,
},
FieldSchema {
name: "base_addr",
value_type: ValueType::UnsignedInt,
description: "Virtual base address the PE was mapped at (ImageBaseAddress for a process, LDR entry DllBase for a DLL, driver base for a kernel module)",
is_uid_component: true,
},
FieldSchema {
name: "name",
value_type: ValueType::Text,
description: "Image / module file name recovered from the PE or loader entry — attacker-controllable; may be forged or blank for injected code",
is_uid_component: false,
},
FieldSchema {
name: "fully_resident",
value_type: ValueType::Bool,
description: "True only if every page of the image was resident in RAM at capture. False means one or more pages were paged out and were zero-filled during reconstruction — the recovered file is incomplete and will NOT hash-match the on-disk original",
is_uid_component: false,
},
];
/// Executables / DLLs / Drivers extracted from a memory image — defensive recovery of
/// in-memory-only code.
///
/// Distinct from on-disk minidump .dmp files (lsass_dump_file / fa_file_minidump_dmp):
/// this is a PE reconstructed OUT of RAM by a memory-forensics engine.
///
/// Source: https://github.com/volatilityfoundation/volatility/wiki/command-reference (procdump/memdump/dlldump/moddump; --unsafe; resident-only; DumpFileOffset)
/// Source: https://volatility3.readthedocs.io/en/latest/volatility3.plugins.windows.pedump.html (Vol3 pedump dump_pe_at_base/dump_ldr_entry/dump_kernel_pe_at_base)
pub static MEM_EXTRACTED_PE_IMAGES: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_extracted_pe_images",
name: "Executables/DLLs/Drivers Extracted from Memory",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "PE images (process executables, mapped DLLs, and kernel drivers) reconstructed OUT of a \
RAM capture by a memory-forensics engine. Two extraction modes: (1) code-focused PE reconstruction — \
Volatility procdump/procexedump (Vol2) or windows.pedump / windows.pslist --dump (Vol3) for a process \
image, dlldump / windows.dlllist --dump for a mapped DLL, moddump / windows.modules --dump for a kernel \
driver — walks the PE header and writes each section, rebuilding a file that resembles the on-disk \
binary; (2) full process dump — memdump (Vol2) / windows.memmap --dump (Vol3) writes ALL memory-resident \
pages of a process (code + heap + stack) into one raw, virtual-address-ordered blob (not a PE, ideal for \
strings/YARA). The highest-value use is recovering in-memory-only payloads: reflectively loaded / \
injected code that never touched disk, and unsigned modules absent from the loader lists.",
mitre_techniques: &["T1055", "T1620"],
fields: MEM_EXTRACTED_PE_FIELDS,
retention: Some("RAM only; lost on power-off — the output exists only once an examiner extracts it from a memory image"),
triage_priority: TriagePriority::High,
related_artifacts: &["mem_running_processes", "mem_loaded_modules", "lsass_dump_file", "fa_file_minidump_dmp"],
sources: &[
"https://github.com/volatilityfoundation/volatility/wiki/command-reference",
"https://volatility3.readthedocs.io/en/latest/volatility3.plugins.windows.pedump.html",
"https://volatility3.readthedocs.io/en/latest/volatility3.plugins.windows.memmap.html",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"A code-focused PE dump (procdump/pedump) rebuilds the file from PE-header section metadata; malware can forge PE size fields to break the dump, requiring --unsafe/-u to bypass sanity checks — a --unsafe reconstruction is lower-fidelity",
"dlldump/moddump can fail outright when critical PE-header pages are non-resident; a full-memory (memmap/memdump) dump captures only resident pages and is virtual-address-ordered raw memory, not a runnable PE",
"When fully_resident is false, paged-out pages were zero-filled — the extracted image is incomplete and will not hash-match the on-disk original, so a hash mismatch is not by itself evidence of tampering",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "Reconstructed from live RAM; the source pages are lost on power-off",
};
pub(crate) static SRUM_APP_TIMELINE_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "app_id",
value_type: ValueType::Text,
description: "AppId — application path / executable identity (resolved via SruDbIdMapTable)",
is_uid_component: true,
},
FieldSchema {
name: "user_id",
value_type: ValueType::Text,
description: "UserId — SID of the user account (resolved via SruDbIdMapTable)",
is_uid_component: true,
},
FieldSchema {
name: "end_time",
value_type: ValueType::Timestamp,
description: "Approximate execution EndTime of the activity interval",
is_uid_component: false,
},
FieldSchema {
name: "duration_ms",
value_type: ValueType::UnsignedInt,
description: "DurationMS — total length of the activity interval in milliseconds",
is_uid_component: false,
},
FieldSchema {
name: "in_focus_s",
value_type: ValueType::UnsignedInt,
description: "InFocus seconds — how long the application held the foreground window during the interval",
is_uid_component: false,
},
FieldSchema {
name: "keyboard_input_s",
value_type: ValueType::UnsignedInt,
description: "Seconds of actual keyboard input while the app was focused — non-zero is strong evidence of interactive HUMAN presence, distinguishing real use from unattended/automated execution",
is_uid_component: false,
},
FieldSchema {
name: "mouse_input_s",
value_type: ValueType::UnsignedInt,
description: "Seconds of actual mouse input while the app was focused (interactive-presence signal)",
is_uid_component: false,
},
FieldSchema {
name: "exe_timestamp",
value_type: ValueType::Timestamp,
description: "ExeTimestamp — a per-executable timestamp reported by community analysis to correspond to the binary's PE compile/link time, NOT the run time",
is_uid_component: false,
},
FieldSchema {
name: "flags",
value_type: ValueType::UnsignedInt,
description: "Flags — bitfield whose semantics are undocumented",
is_uid_component: false,
},
];
/// SRUM Application Timeline Table (AppTimelineProvider) — per-app interactive-use
/// telemetry.
///
/// GUID is {5C8CF1C7-...} (registry provider `AppTimelineProvider`); {7ACBBAA3-...} is
/// vfuprov, NOT this table (an earlier revision had them swapped — see src/srum.rs).
///
/// Source: https://github.com/EricZimmerman/Srum/issues/8 (registry Extensions default values — GUID ground truth)
/// Source: https://github.com/WithSecureLabs/chainsaw/wiki/SRUM-Analysis
/// Source: https://aboutdfir.com/app-timeline-provider-srum-database/
pub static SRUM_APP_TIMELINE: ArtifactDescriptor = ArtifactDescriptor {
id: "srum_app_timeline",
name: "SRUM Application Timeline Table (AppTimelineProvider)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{5C8CF1C7-7257-4F13-B223-970EF5939312}"),
scope: DataScope::System,
os_scope: OsScope::Win10Plus,
decoder: Decoder::Identity,
meaning: "ESE table {5C8CF1C7-7257-4F13-B223-970EF5939312} (registry provider name 'AppTimelineProvider') \
records per-app, per-user activity intervals with rich human-interaction telemetry: how long each \
application held the foreground window (InFocus), and how long there was actual keyboard, mouse, audio-in \
and audio-out activity while focused. Because it captures real user-input duration, it distinguishes \
interactive human use from unattended/automated execution far better than the CPU-cycle App Resource \
Usage table. Each row also carries an approximate execution EndTime, total DurationMS, and a distinct \
ExeTimestamp (a per-executable timestamp reported by community analysis to correspond to the binary's PE \
compile/link time, NOT the run time). This table retains only ~7 days of data — a much shorter window \
than the ~30-60 day SRUDB.dat whole-database retention.",
mitre_techniques: &[],
fields: SRUM_APP_TIMELINE_FIELDS,
retention: Some("~7 days per this table (shorter than the ~30-60 day whole-SRUDB.dat window)"),
triage_priority: TriagePriority::High,
related_artifacts: &["srum_app_resource", "srum_db", "prefetch_file", "shimcache"],
sources: &[
"https://github.com/EricZimmerman/Srum/issues/8",
"https://github.com/EricZimmerman/Srum/pull/10/files",
"https://github.com/WithSecureLabs/chainsaw/wiki/SRUM-Analysis",
"https://aboutdfir.com/app-timeline-provider-srum-database/",
"https://github.com/MarkBaggett/srum-dump",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"Field/column semantics are reverse-engineered (no Microsoft [MS-*] spec); the Flags meaning is unknown",
"ExeTimestamp is community-reported as the executable's PE compile/link time, NOT execution time — do not read it as a run timestamp",
"Strong specifically for interactive presence: non-zero keyboard/mouse/user-input seconds is strong evidence a human was at the keyboard during the interval; corroborative for execution overall",
"Retains only ~7 days — activity older than that is not here even though SRUDB.dat overall keeps ~30-60 days",
],
volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
volatility_rationale: "ESE table pruned to ~7 days; older intervals are aged out",
};
pub(crate) static MEM_ACCESS_TOKENS_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "pid",
value_type: ValueType::UnsignedInt,
description: "Owning process identifier",
is_uid_component: true,
},
FieldSchema {
name: "token_type",
value_type: ValueType::Text,
description: "TOKEN_TYPE: 'Primary' (TokenPrimary=1) or 'Impersonation' (TokenImpersonation=2)",
is_uid_component: false,
},
FieldSchema {
name: "impersonation_level",
value_type: ValueType::Text,
description: "SECURITY_IMPERSONATION_LEVEL for impersonation tokens: Anonymous(0)/Identification(1)/Impersonation(2)/Delegation(3); empty for primary tokens",
is_uid_component: false,
},
FieldSchema {
name: "user_sid",
value_type: ValueType::Text,
description: "Token owner/user SID (e.g. S-1-5-18 = LocalSystem)",
is_uid_component: true,
},
FieldSchema {
name: "integrity_level",
value_type: ValueType::Text,
description: "Mandatory integrity-level SID: Untrusted S-1-16-0 / Low S-1-16-4096 / Medium S-1-16-8192 / High S-1-16-12288 / System S-1-16-16384 (the SID field is Windows Vista and later)",
is_uid_component: false,
},
FieldSchema {
name: "privileges",
value_type: ValueType::List,
description: "Privileges present and their enabled/disabled state (e.g. SeDebugPrivilege, SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege)",
is_uid_component: false,
},
FieldSchema {
name: "group_sids",
value_type: ValueType::List,
description: "Group SIDs carried in the token, including any injected SID-History entries",
is_uid_component: false,
},
];
/// Access Tokens (Memory) — Primary vs Impersonation, for token-manipulation detection.
///
/// Source: https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_type (TokenPrimary=1, TokenImpersonation=2)
/// Source: https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids (integrity RIDs/SIDs, S-1-5-18)
/// MITRE: T1134 (Access Token Manipulation), .001 (Token Impersonation/Theft), .005 (SID-History Injection)
pub static MEM_ACCESS_TOKENS: ArtifactDescriptor = ArtifactDescriptor {
id: "mem_access_tokens",
name: "Access Tokens (Memory) — Primary vs Impersonation",
artifact_type: ArtifactLocation::MemoryRegion,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::All,
decoder: Decoder::Identity,
meaning: "Windows access tokens (_TOKEN kernel objects) recovered from RAM. Each token carries the \
security context a thread/process runs under: the user SID, group SIDs (incl. any injected SID-History \
entries), the enabled/disabled privilege set, the mandatory integrity-level SID, the token TYPE (Primary \
vs Impersonation), and — for impersonation tokens — the impersonation level. A process holding an \
impersonation token whose user SID differs from its own primary token is consistent with token theft/\
impersonation; a Medium-integrity process with SeDebugPrivilege or SeImpersonatePrivilege enabled, or a \
non-SYSTEM process wielding a SYSTEM (S-1-5-18) impersonation token, is consistent with privilege \
escalation via token manipulation. The observed token facts are definitive; the theft/escalation \
conclusion is an inference the token contents are consistent with, not proof of.",
mitre_techniques: &["T1134", "T1134.001", "T1134.005"],
fields: MEM_ACCESS_TOKENS_FIELDS,
retention: Some("RAM only; lost on power-off — present in a memory image / live capture"),
triage_priority: TriagePriority::Critical,
related_artifacts: &["mem_running_processes", "mem_user_credentials", "mem_loaded_modules", "evtx_security"],
sources: &[
"https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_type",
"https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-security_impersonation_level",
"https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control",
"https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"The token fields (type, user SID, integrity, privileges, groups) are definitive; token theft / privilege escalation is an inference the contents are CONSISTENT WITH, not proof of",
"The integrity-level SID field is Windows Vista and later; on XP it is absent (token type and impersonation level exist since XP)",
"A snapshot from RAM shows the token as held at capture; it does not by itself reveal HOW the token was obtained (that is a separate technique surface)",
],
volatility: Some(crate::volatility::VolatilityClass::Volatile),
volatility_rationale: "Kernel _TOKEN objects live in RAM and are lost on power-off",
};
pub(crate) static IE_RECOVERY_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "url",
value_type: ValueType::Text,
description: "Base URL of a navigated entry recovered from a TravelLog stream",
is_uid_component: true,
},
FieldSchema {
name: "title",
value_type: ValueType::Text,
description: "Page title of the navigated entry",
is_uid_component: false,
},
FieldSchema {
name: "referrer_url",
value_type: ValueType::Text,
description: "Referrer URL stored alongside the entry in the TravelLog stream",
is_uid_component: false,
},
];
/// Internet Explorer Automatic Crash Recovery Store (RecoveryStore / TravelLog).
///
/// Source: http://www.swiftforensics.com/2011/09/internet-explorer-recoverystore-aka.html (Khatri RE — the community reference; covers IE8/9)
/// Source: https://forensics.wiki/ole_compound_file/ (CFBF/OLE container format)
/// Source: https://forensics.wiki/internet_explorer/ (IE artifact overview incl. the Recovery folder)
pub static IE_RECOVERY_SESSION: ArtifactDescriptor = ArtifactDescriptor {
id: "ie_recovery_session",
name: "Internet Explorer Automatic Crash Recovery Store (RecoveryStore / TravelLog)",
artifact_type: ArtifactLocation::File,
hive: None,
key_path: "",
value_name: None,
file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Internet Explorer\Recovery\*\*.dat"),
scope: DataScope::User,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Internet Explorer's Automatic Crash Recovery store, written continuously as tabs are \
opened/navigated so IE can restore the session after a crash. Each Recovery subfolder (Active, \
LastActive, occasionally High/Low/AdminActive) holds a RecoveryStore.{GUID}.dat — an OLE/CFBF compound \
file whose streams (FrameList, TravelLog, and a |Kjjaqfaj...-named stream) record tab order and the tab \
GUIDs — plus one {GUID}.dat per open tab, an OLE/CFBF file whose TravelLog streams hold each navigated \
entry's base URL, referrer URL and page title. The {GUID} is an RFC 4122 v1 UUID whose low 6 bytes are \
a NIC MAC address and whose first 60 bits are a FILETIME-style 100 ns timestamp (epoch 1582-10-15), \
giving the tab/store creation time. It provides evidence of open tabs and navigation — including full \
URLs and titles — that persists on disk even after browsing history and the WebCache are cleared, \
because the recovery store is a separate mechanism from history. (Format established for IE8/9 by the \
Khatri reverse-engineering writeup; persistence into IE10/11 is presumed, not source-verified here.)",
mitre_techniques: &["T1217"],
fields: IE_RECOVERY_FIELDS,
retention: Some("Persists on disk in the Recovery subfolders until IE clears/rotates them; survives history and WebCache clearing"),
triage_priority: TriagePriority::High,
related_artifacts: &["browsers_ie_webcache_db", "browsers_ie_typed_urls", "fa_file_cookies_index_dat", "firefox_session_restore"],
sources: &[
"http://www.swiftforensics.com/2011/09/internet-explorer-recoverystore-aka.html",
"https://forensics.wiki/ole_compound_file/",
"https://forensics.wiki/internet_explorer/",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
evidence_caveats: &[
"The OLE/CFBF container is standard, but the inner TravelLog stream layout is reverse-engineered (no Microsoft spec); parse the CFBF with any compound-file reader and treat the stream decoding as RE-derived",
"Format is source-established for IE8/9; later-IE persistence is presumed and should be verified on the exact IE version when case-critical",
"The {GUID}'s embedded MAC + creation timestamp are set at tab/store creation and can be stale; consistent with, not proof of, the originating NIC/time",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "On-disk .dat files in the user's IE Recovery folder; persist until cleared/rotated",
};
pub(crate) static KANSA_COLLECTION_OUTPUT_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "hostname",
value_type: ValueType::Text,
description: "Target host the row was collected from (left of the '-' in Hostname-ModuleName.ext)",
is_uid_component: true,
},
FieldSchema {
name: "module",
value_type: ValueType::Text,
description: "Collector module, i.e. the Get-*.ps1 name with the Get- prefix stripped (also the subdirectory name)",
is_uid_component: true,
},
FieldSchema {
name: "output_format",
value_type: ValueType::Text,
description: "Serialization chosen with -OutputFormat: CSV (default), JSON, TSV, XML, GL, or SPLUNK",
is_uid_component: false,
},
];
/// Kansa Live-Response Collection (PowerShell Remoting) — a fleet-wide IR snapshot.
///
/// Source: https://github.com/davehull/Kansa/blob/master/kansa.ps1 (tool source — OutputFormat/Port/Modules.conf/naming)
/// Source: https://github.com/davehull/Kansa/blob/master/README.md
pub static KANSA_COLLECTION_OUTPUT: ArtifactDescriptor = ArtifactDescriptor {
id: "kansa_collection_output",
name: "Kansa Live-Response Collection (PowerShell Remoting)",
artifact_type: ArtifactLocation::LiveResponse,
hive: None,
key_path: "",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "Output tree produced by Kansa, an open-source PowerShell incident-response framework \
(davehull/Kansa). Kansa fans a set of collector modules out across an enterprise over PowerShell \
Remoting (WinRM, default TCP 5985; -UseSSL enables WinRM-over-HTTPS but keeps the -Port value, so the \
operator sets -Port 5986 for the standard HTTPS port) and gathers the results centrally. Only scripts \
named Get-*.ps1 under .\\Modules\\ run; if .\\Modules\\Modules.conf exists it controls WHICH modules run \
and in what ORDER (blank/# lines ignored), otherwise every Get-*.ps1 is discovered recursively. Targets \
come from -Target (single host), -TargetList (a file, one hostname per line), or an Active Directory \
query. Results land in a new Output_<timestamp>\\ directory with one subdirectory per module (module name \
minus the Get- prefix) holding one file per host named Hostname-ModuleName.ext (e.g. \
Get-PrefetchListing.ps1 -> Output_<ts>\\PrefetchListing\\Hostname-PrefetchListing.txt). -OutputFormat \
selects the serialization (CSV default; also JSON/TSV/XML/GL/SPLUNK). Non-terminating errors, per-host \
module failures, binary-push failures and MAX_PATH (260-char) truncations are logged to Error.Log. \
-Pushbin copies module-declared third-party binaries to each target's ADMIN$ share before execution; \
-Rmbin removes them afterward. For an examiner, a Kansa Output_<timestamp> tree is a point-in-time, \
fleet-wide snapshot of execution, persistence, network and account state.",
mitre_techniques: &[],
fields: KANSA_COLLECTION_OUTPUT_FIELDS,
retention: Some("Written to Output_<timestamp>\\ under the Kansa working directory; persists until the operator deletes it (a saved case artifact, not auto-rotated)"),
triage_priority: TriagePriority::High,
related_artifacts: &["evtx_winrm", "amcache_program", "fa_file_prefetch_pf", "cmd_autorun_hklm", "shimcache"],
sources: &[
"https://github.com/davehull/Kansa",
"https://github.com/davehull/Kansa/blob/master/kansa.ps1",
"https://github.com/davehull/Kansa/blob/master/README.md",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
evidence_caveats: &[
"The framework is a collection wrapper — evidentiary weight lives in the specific module output (e.g. Get-PrefetchListing, Get-Autorunsc), not in Kansa itself",
"Modules collect through PowerShell cmdlets / WMI, which read the live OS via APIs a kernel-mode rootkit can subvert; corroborate with raw on-disk artifacts or memory forensics",
"A Kansa tree is a point-in-time snapshot at collection; it does not capture activity before the run or after it completed",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "Collected output written to disk; persists as a saved case artifact until the operator deletes it",
};
pub(crate) static REGEDIT_SYSTEM_SELECT_FIELDS: &[FieldSchema] = &[
FieldSchema {
name: "Current",
value_type: ValueType::UnsignedInt,
description: "REG_DWORD; number N of the control set the system is booted from -> ControlSet00N. This is the set 'CurrentControlSet' aliases at run time; the one to analyse on a live box",
is_uid_component: false,
},
FieldSchema {
name: "Default",
value_type: ValueType::UnsignedInt,
description: "REG_DWORD; the Default Control Set number (winreg-kb)",
is_uid_component: false,
},
FieldSchema {
name: "Failed",
value_type: ValueType::UnsignedInt,
description: "REG_DWORD; the Control Set number that was marked as failing to boot Windows (winreg-kb)",
is_uid_component: false,
},
FieldSchema {
name: "LastKnownGood",
value_type: ValueType::UnsignedInt,
description: "REG_DWORD; the Last Known Good Control Set — the control set that last successfully booted Windows (winreg-kb)",
is_uid_component: false,
},
];
/// HKLM\SYSTEM\Select — the Current Control Set selector (dead-box resolution).
///
/// Hand-written manual descriptor (the codegen cannot carry rich fields/caveats); the
/// generated stub was removed from regedit_generated.rs to avoid a duplicate id.
///
/// Source: https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Current-control-set.html
/// Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-control-registry-tree
pub static REGEDIT_SYSTEM_SELECT: ArtifactDescriptor = ArtifactDescriptor {
id: "regedit_system_select",
name: "Current Control Set Selector (HKLM\\SYSTEM\\Select)",
artifact_type: ArtifactLocation::RegistryKey,
hive: Some(HiveTarget::HklmSystem),
key_path: "Select",
value_name: None,
file_path: None,
scope: DataScope::System,
os_scope: OsScope::Win7Plus,
decoder: Decoder::Identity,
meaning: "HKLM\\SYSTEM\\Select holds four REG_DWORD values (Current, Default, Failed, \
LastKnownGood), each a number N that resolves the control set ControlSet00N (e.g. Current=1 -> \
ControlSet001). Current identifies the control set the running system booted from — i.e. what the \
live-only 'CurrentControlSet' symlink points to. On a dead-box/offline SYSTEM hive there is NO \
CurrentControlSet key (it is a volatile, boot-time-created registry link, not stored on disk); the \
examiner must read Select\\Current and follow it to the correct numbered ControlSet00N. Values other \
than 1/2 (e.g. 3, 47) occur after Last Known Good recovery or repeated boot failures.",
mitre_techniques: &[],
fields: REGEDIT_SYSTEM_SELECT_FIELDS,
retention: None,
triage_priority: TriagePriority::Low,
related_artifacts: &["regedit_controlset00_control_windows"],
sources: &[
"https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Current-control-set.html",
"https://learn.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-control-registry-tree",
"https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb",
],
evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
evidence_caveats: &[
"'CurrentControlSet' is a live-only volatile symlink created at boot and is NOT present in an offline/dead-box SYSTEM hive; resolve the active set via Select\\Current -> ControlSet00N instead of expecting a CurrentControlSet key",
"Configuration data is often duplicated across ControlSet001/002 (and any 003+); analysing the wrong set, or assuming both agree, can produce stale or divergent findings — pin analysis to the set named by Select\\Current, and diff sets when they differ",
"Control-set numbers above 2 (e.g. 3, 47) indicate prior Last Known Good recovery or repeated boot failures; Failed pointing at a set is consistent with a boot that was rolled back",
],
volatility: Some(crate::volatility::VolatilityClass::Persistent),
volatility_rationale: "The Select key and the numbered ControlSet00N keys are stored in the on-disk SYSTEM hive and survive reboots; only the CurrentControlSet alias itself is volatile (rebuilt at each boot)",
};
/// All descriptor instances that make up the global catalog.
///
/// Maintainer note:
/// New descriptors should be researched against the curated DFIR source corpus
/// documented in this module header, then anchored with artifact-specific URLs in
/// the descriptor's `sources` field. Archived source corpora are discovery input;
/// they do not replace per-artifact attribution.
pub(crate) static CATALOG_ENTRIES: &[ArtifactDescriptor] = &[
ZONE_IDENTIFIER,
THUMBS_DB,
CDP_GDID,
APPLE_HARDWARE_UUID,
APPLE_DSID,
APPLE_IDFA,
LINUX_MACHINE_ID,
NTFS_I30_INDEX,
NTFS_ADS,
NTFS_REPARSE_POINT,
PHOTOREC_RECUP_DIR,
WZCSVC_WIRELESS_INTERFACES,
NTFS_MACB_RULES,
MEM_FINDEVIL,
FILE_CARVING,
NTFS_OBJID,
MEM_EXTRACTED_PE_IMAGES,
SRUM_APP_TIMELINE,
MEM_ACCESS_TOKENS,
IE_RECOVERY_SESSION,
KANSA_COLLECTION_OUTPUT,
USERASSIST_EXE,
USERASSIST_FOLDER,
USERASSIST_XP_EXE,
USERASSIST_XP_IE_FAVORITES,
USERASSIST_XP_IE7,
RUN_KEY_HKLM_RUN,
RUN_KEY_HKCU_RUN,
RUN_KEY_HKCU_RUNONCE,
RUN_KEY_HKLM_RUNONCE,
TYPED_URLS,
TYPED_URLS_TIME,
PCA_APPLAUNCH_DIC,
PCA_GENERAL_DB,
PCA_GENERAL_DB1,
WINDOWS_HOSTS_FILE,
DNS_POLICY_CONFIG_NRPT,
IFEO_DEBUGGER,
SHELLBAGS_USER,
AMCACHE_APP_FILE,
AMCACHE_PROGRAM,
SHIMCACHE,
SHIMCACHE_MEMORY,
BAM_USER,
DAM_USER,
SAM_USERS,
LSA_SECRETS,
DCC2_CACHE,
MRU_RECENT_DOCS,
USB_ENUM,
MUICACHE,
APPINIT_DLLS,
WINLOGON_USERINIT,
SCREENSAVER_EXE,
// Batch C — Windows persistence
WINLOGON_SHELL,
SERVICES_IMAGEPATH,
ACTIVE_SETUP_HKLM,
ACTIVE_SETUP_HKCU,
COM_HIJACK_CLSID_HKCU,
APPCERT_DLLS,
BOOT_EXECUTE,
LSA_SECURITY_PKGS,
LSA_AUTH_PKGS,
PRINT_MONITORS,
TIME_PROVIDERS,
NETSH_HELPER_DLLS,
BROWSER_HELPER_OBJECTS,
STARTUP_FOLDER_USER,
STARTUP_FOLDER_SYSTEM,
SCHEDULED_TASKS_DIR,
WDIGEST_CACHING,
// Batch C — Windows execution evidence
MFT,
USNJRNL,
LOGFILE_NTFS,
WORDWHEEL_QUERY,
OPENSAVE_MRU,
LASTVISITED_MRU,
PREFETCH_DIR,
SRUM_DB,
WINDOWS_TIMELINE,
WINDOWS_TIMELINE_DEVICECACHE,
WINDOWS_SEARCH_DB_WIN11,
POWERSHELL_HISTORY,
RECYCLE_BIN,
THUMBCACHE,
SEARCH_DB_USER,
// Batch C — Windows credentials
DPAPI_MASTERKEY_USER,
DPAPI_CRED_USER,
DPAPI_CRED_ROAMING,
WINDOWS_VAULT_USER,
WINDOWS_VAULT_SYSTEM,
RDP_CLIENT_SERVERS,
RDP_CLIENT_DEFAULT,
NTDS_DIT,
CHROME_LOGIN_DATA,
FIREFOX_LOGINS,
WIFI_PROFILES,
// Batch I — regipy-aligned registry coverage
TYPED_PATHS,
RUN_MRU,
NETWORK_DRIVES,
APP_PATHS,
MOUNTED_DEVICES,
NETWORKLIST_PROFILES,
PUTTY_SESSIONS,
WINSCP_SAVED_SESSIONS,
WINSCP_INI,
WINRAR_HISTORY,
// Batch J — Blue Team field-note and artifact-map coverage
NETWORK_INTERFACES,
PAGEFILE_SYS,
HIBERFIL_SYS,
MOUNTPOINTS2,
PORTABLE_DEVICES,
RDP_BITMAP_CACHE,
// Batch D — Linux cron / init persistence
LINUX_CRONTAB_SYSTEM,
LINUX_CRON_D,
LINUX_CRON_PERIODIC,
LINUX_USER_CRONTAB,
LINUX_ANACRONTAB,
// Batch D — Linux systemd persistence
LINUX_SYSTEMD_SYSTEM_UNIT,
LINUX_SYSTEMD_USER_UNIT,
LINUX_SYSTEMD_TIMER,
// Batch D — Linux SysV init
LINUX_RC_LOCAL,
LINUX_INIT_D,
// Batch D — Linux shell startup persistence
LINUX_BASHRC_USER,
LINUX_BASH_PROFILE_USER,
LINUX_PROFILE_USER,
LINUX_ZSHRC_USER,
LINUX_PROFILE_SYSTEM,
LINUX_PROFILE_D,
// Batch D — Linux dynamic linker hijack
LINUX_LD_SO_PRELOAD,
LINUX_LD_SO_CONF_D,
// Batch D — Linux SSH persistence
LINUX_SSH_AUTHORIZED_KEYS,
// Batch D — Linux auth / privilege escalation
LINUX_PAM_MODULE_DIR,
LINUX_PAM_D,
LINUX_SUDOERS_D,
LINUX_MODULES_LOAD_D,
LINUX_MOTD_D,
LINUX_UDEV_RULES_D,
// Batch D — Linux execution evidence
LINUX_BASH_HISTORY,
LINUX_ZSH_HISTORY,
LINUX_WTMP,
LINUX_BTMP,
LINUX_LASTLOG,
LINUX_AUTH_LOG,
LINUX_JOURNAL_DIR,
// Batch D — Linux credentials
LINUX_PASSWD,
LINUX_SHADOW,
LINUX_SSH_PRIVATE_KEY,
LINUX_SSH_KNOWN_HOSTS,
LINUX_GNUPG_PRIVATE,
LINUX_AWS_CREDENTIALS,
LINUX_DOCKER_CONFIG,
// Batch E — Windows execution evidence
LNK_FILES,
JUMP_LIST_AUTO,
JUMP_LIST_CUSTOM,
JUMP_LIST_APPID_REGISTRY,
TASKBAND_FAVORITES,
EVTX_DIR,
MFT_FILE,
USN_JOURNAL,
// Batch E — Windows persistence
WMI_MOF_DIR,
BITS_DB,
WMI_SUBSCRIPTIONS,
LOGON_SCRIPTS,
WINSOCK_LSP,
APPSHIM_DB,
PASSWORD_FILTER_DLL,
OFFICE_NORMAL_DOTM,
POWERSHELL_PROFILE_ALL,
// Batch E — Windows credentials
DPAPI_SYSTEM_MASTERKEY,
DPAPI_CREDHIST,
CHROME_COOKIES,
EDGE_WEBCACHE,
VPN_RAS_PHONEBOOK,
WINDOWS_HELLO_NGC,
USER_CERT_PRIVATE_KEY,
MACHINE_CERT_STORE,
// Batch F — Linux extended
LINUX_AT_QUEUE,
LINUX_SSHD_CONFIG,
LINUX_ETC_GROUP,
LINUX_GNOME_KEYRING,
LINUX_KDE_KWALLET,
LINUX_CHROME_LOGIN_LINUX,
LINUX_FIREFOX_LOGINS_LINUX,
LINUX_UTMP,
LINUX_GCP_CREDENTIALS,
LINUX_AZURE_CREDENTIALS,
LINUX_KUBE_CONFIG,
LINUX_GIT_CREDENTIALS,
LINUX_NETRC,
// Batch G — LinuxPersist-sourced
LINUX_ETC_ENVIRONMENT,
LINUX_XDG_AUTOSTART_USER,
LINUX_XDG_AUTOSTART_SYSTEM,
LINUX_NETWORKMANAGER_DISPATCHER,
LINUX_APT_HOOKS,
// Batch H — JL / LNK / Prefetch / SRUM / EVTX
JUMP_LIST_SYSTEM,
LNK_FILES_OFFICE,
PREFETCH_FILE,
SRUM_NETWORK_USAGE,
SRUM_NETWORK_CONNECTIONS,
SRUM_APP_RESOURCE,
SRUM_ENERGY_USAGE,
SRUM_PUSH_NOTIFICATION,
EVTX_SECURITY,
EVTX_SYSTEM,
EVTX_POWERSHELL,
EVTX_APPLICATION_MSIINSTALLER,
EVTX_SYSMON,
EVTX_DEFENDER_OPERATIONAL,
// Batch macOS — persistence, execution, credentials, privacy
MACOS_UNIFIED_LOG,
MACOS_LAUNCH_AGENTS_USER,
MACOS_LAUNCH_AGENTS_SYSTEM,
MACOS_LAUNCH_DAEMONS,
MACOS_TCC_DB,
MACOS_QUARANTINE_EVENTS,
MACOS_SAFARI_HISTORY,
MACOS_SAFARI_DOWNLOADS,
MACOS_KNOWLEDGEC,
MACOS_BASH_SESSIONS,
MACOS_INSTALL_HISTORY,
MACOS_GATEKEEPER_LOGS,
MACOS_KEYCHAIN_USER,
MACOS_EMOND,
MACOS_COREANALYTICS,
// Memory forensics artifacts
MEM_RUNNING_PROCESSES,
MEM_NETWORK_CONNECTIONS,
MEM_LOADED_MODULES,
MEM_REGISTRY_HIVES,
MEM_USER_CREDENTIALS,
// Extended Windows registry artifacts (windows_registry_ext)
windows_registry_ext::SAFEBOOT_MINIMAL,
windows_registry_ext::SAFEBOOT_NETWORK,
windows_registry_ext::KNOWN_DLLS,
windows_registry_ext::CMD_AUTORUN_HKLM,
windows_registry_ext::CMD_AUTORUN_HKCU,
windows_registry_ext::CREDENTIAL_PROVIDERS,
windows_registry_ext::NETWORK_PROVIDER_ORDER,
windows_registry_ext::SHELL_EXECUTE_HOOKS,
windows_registry_ext::WER_RUNTIME_EXCEPTION_HELPER,
windows_registry_ext::IFEO_GLOBAL_FLAG,
windows_registry_ext::SCHEDULED_TASK_REGISTRY_CACHE,
windows_registry_ext::GROUP_POLICY_STARTUP_SCRIPTS,
windows_registry_ext::GROUP_POLICY_LOGON_SCRIPTS,
windows_registry_ext::WINLOGON_NOTIFY,
windows_registry_ext::COM_SERVER_HKLM,
windows_registry_ext::OFFICE_ADDINS,
windows_registry_ext::TERMINAL_SERVER_INITIAL_PROGRAM,
windows_registry_ext::RECENTAPPS,
windows_registry_ext::NETWORK_SHARES_HKCU,
windows_registry_ext::DEFAULT_BROWSER,
windows_registry_ext::PROXY_SETTINGS,
windows_registry_ext::SYSTEM_TIMEZONE,
windows_registry_ext::COMPUTER_NAME,
windows_registry_ext::SHUTDOWN_TIME,
windows_registry_ext::USB_STOR_ENUM,
windows_registry_ext::SETUPAPI_DEV_LOG,
windows_registry_ext::UNINSTALL_KEYS,
windows_registry_ext::USER_ACCOUNT_SID,
windows_registry_ext::TERMINAL_SERVER_CLIENT_SERVERS,
windows_registry_ext::INTERNET_EXPLORER_TYPED_URLS,
windows_registry_ext::EMDMGMT_READYBOOST,
// Extended Windows EVTX artifacts (windows_evtx_ext)
windows_evtx_ext::EVTX_TASK_SCHEDULER,
windows_evtx_ext::EVTX_RDP_CLIENT,
windows_evtx_ext::EVTX_RDP_INBOUND,
windows_evtx_ext::EVTX_RDP_SESSION,
windows_evtx_ext::EVTX_WINRM,
windows_evtx_ext::EVTX_WMI_ACTIVITY,
windows_evtx_ext::EVTX_BITS_CLIENT,
windows_evtx_ext::EVTX_APPLOCKER,
windows_evtx_ext::EVTX_APPLOCKER_SCRIPT,
windows_evtx_ext::EVTX_DEFENDER,
windows_evtx_ext::EVTX_FIREWALL,
windows_evtx_ext::EVTX_CODE_INTEGRITY,
windows_evtx_ext::EVTX_NTLM,
windows_evtx_ext::EVTX_PRINT_SERVICE,
windows_evtx_ext::EVTX_NETLOGON,
windows_evtx_ext::EVTX_SMB_CLIENT,
windows_evtx_ext::EVTX_NETWORK_PROFILE,
windows_evtx_ext::EVTX_KERNEL_PNP,
windows_evtx_ext::EVTX_DRIVER_FRAMEWORKS,
windows_evtx_ext::EVTX_LSA_PROTECTION,
windows_evtx_ext::EVTX_CAPI2,
windows_evtx_ext::EVTX_POWERSHELL_CLASSIC,
// Group C: Additional EVTX channels (batch I)
windows_evtx_ext::EVTX_DNS_CLIENT,
windows_evtx_ext::EVTX_TERMINAL_SERVICES,
windows_evtx_ext::EVTX_APPLICATION_EXPERIENCE_TELEMETRY,
// Extended macOS artifacts (macos_ext)
macos_ext::MACOS_FSEVENTS,
macos_ext::MACOS_BIOME_APP_MENUITEM,
macos_ext::MACOS_SPOTLIGHT_STORE,
macos_ext::MACOS_DOCK_PLIST,
macos_ext::MACOS_LOGIN_ITEMS_PLIST,
macos_ext::MACOS_SFL2_RECENT_ITEMS,
macos_ext::MACOS_SFL2_RECENT_SERVERS,
macos_ext::MACOS_WIFI_PLIST,
macos_ext::MACOS_SCREEN_TIME_DB,
macos_ext::MACOS_TCC_SYSTEM_DB,
macos_ext::MACOS_SMS_DB,
macos_ext::MACOS_NOTES_DB,
macos_ext::MACOS_PHOTOS_DB,
macos_ext::MACOS_ICLOUD_DRIVE_DB,
macos_ext::MACOS_LOCATIOND_CLIENTS,
macos_ext::MACOS_LOCKDOWND_LOG,
macos_ext::MACOS_INSTALLER_RECEIPTS,
macos_ext::MACOS_SAFARI_LOCALSTORAGE,
macos_ext::MACOS_NOTIFICATION_CENTER_DB,
macos_ext::MACOS_MDM_ENROLLMENT,
macos_ext::MACOS_ASL_LOGS,
macos_ext::MACOS_DIAGNOSTIC_REPORTS,
macos_ext::MACOS_QUICKLOOK_THUMBNAILS,
macos_ext::MACOS_WIFI_INTELLIGENCE,
macos_ext::APFS_CONTAINER,
// Extended Linux artifacts (linux_ext)
linux_ext::LINUX_AUDITD_LOG,
linux_ext::LINUX_AUDIT_RULES,
linux_ext::LINUX_SYSLOG,
linux_ext::LINUX_MESSAGES_LOG,
linux_ext::LINUX_SECURE_LOG,
linux_ext::LINUX_APACHE_ACCESS_LOG,
linux_ext::LINUX_APACHE_ERROR_LOG,
linux_ext::LINUX_NGINX_ACCESS_LOG,
linux_ext::LINUX_FAIL2BAN_LOG,
linux_ext::LINUX_DPKG_LOG,
linux_ext::LINUX_RPM_DB,
linux_ext::LINUX_SELINUX_CONFIG,
linux_ext::LINUX_APPARMOR_PROFILES,
linux_ext::LINUX_IPTABLES_RULES,
linux_ext::LINUX_NFTABLES_CONF,
linux_ext::LINUX_HOSTS_FILE,
linux_ext::LINUX_RESOLV_CONF,
linux_ext::LINUX_PROC_MODULES,
linux_ext::LINUX_MODPROBE_D,
linux_ext::LINUX_DOCKER_CONTAINER_LOGS,
linux_ext::LINUX_DOCKER_DAEMON_JSON,
linux_ext::LINUX_COREDUMP_DIR,
linux_ext::LINUX_LOGROTATE_D,
linux_ext::LINUX_SNAP_PACKAGES,
// Batch I: Linux kernel / live-system artifacts
linux_ext::LINUX_DMESG_RING_BUFFER,
linux_ext::LINUX_KERN_LOG,
linux_ext::LINUX_PROC_KALLSYMS,
linux_ext::LINUX_PROC_NET_TCP,
linux_ext::LINUX_PROC_NET_TCP6,
linux_ext::LINUX_PROC_NET_UDP,
linux_ext::LINUX_PROC_NET_UNIX,
linux_ext::LINUX_LSOF_OUTPUT,
linux_ext::LINUX_SS_OUTPUT,
linux_ext::LINUX_CHKROOTKIT_OUTPUT,
linux_ext::LINUX_RKHUNTER_LOG,
linux_ext::LINUX_SYSCTL_CONF,
// Group D/E: Linux kernel/proc/auth (batch I)
linux_ext::LINUX_DMESG,
linux_ext::LINUX_BOOT_LOG,
linux_ext::LINUX_FAILLOG,
linux_ext::LAN_TURTLE_LOOT,
// Batch I: Windows crash dump, WER, and miscellaneous artifacts
windows_logs_ext::WINDOWS_CRASH_DUMP,
windows_logs_ext::WINDOWS_MINIDUMP,
windows_logs_ext::AMCACHE_DRIVER,
windows_logs_ext::WER_REPORT_QUEUE,
windows_logs_ext::WINDOWS_NOTIFICATION_DB,
windows_logs_ext::AMCACHE_SHORTCUT,
// Phase-2 Windows registry threat-hunting artifacts (windows_registry_ext2)
windows_registry_ext2::WINLOGON_AUTOADMIN_LOGON,
windows_registry_ext2::WINLOGON_DEFAULT_PASSWORD,
windows_registry_ext2::WINLOGON_DEFAULT_USERNAME,
windows_registry_ext2::LOGONUI_LAST_LOGGEDON_USER,
windows_registry_ext2::PORTPROXY_CONFIG,
windows_registry_ext2::WINDOWS_DEFENDER_EXCLUSIONS_LOCAL,
windows_registry_ext2::WINDOWS_DEFENDER_DISABLED_AV,
windows_registry_ext2::WINDOWS_DEFENDER_REALTIME,
windows_registry_ext2::MS_OFFICE_TRUSTED_DOCS,
windows_registry_ext2::VSS_FILES_NOT_TO_SNAPSHOT,
windows_registry_ext2::VSS_FILES_NOT_TO_BACKUP,
windows_registry_ext2::IFEO_SILENT_EXIT,
windows_registry_ext2::EXEFILE_SHELL_OPEN_SOFTWARE,
windows_registry_ext2::EXEFILE_SHELL_OPEN_USRCLASS,
windows_registry_ext2::RDP_SHADOW_SESSIONS,
windows_registry_ext2::RESTRICTED_ADMIN_RDP,
windows_registry_ext2::NETWORK_SHARES_SERVER,
windows_registry_ext2::SYSINTERNALS_EULA,
windows_registry_ext2::MS_OFFICE_SERVER_CACHE,
windows_registry_ext2::POWERSHELL_COBALT_INFO,
windows_registry_ext2::STARTUP_APPROVED_RUN_SYSTEM,
windows_registry_ext2::STARTUP_APPROVED_RUN_USER,
windows_registry_ext2::TASKCACHE_TASKS_PATH,
windows_registry_ext2::PROFILE_LIST_USERS,
windows_registry_ext2::REGISTRAR_FAVORITES,
windows_registry_ext2::DHCP_IPV4_INTERFACE,
windows_registry_ext2::NTFS_LAST_ACCESS_STATUS,
windows_registry_ext2::PREFETCH_STATUS,
windows_registry_ext2::FIREWALL_RULES,
windows_registry_ext2::EVENT_LOG_CHANNEL_STATUS,
// Phase-2b Extended Windows file and directory artifacts (windows_files_ext)
windows_files_ext::CHROME_HISTORY,
windows_files_ext::CHROME_WEB_DATA,
windows_files_ext::EDGE_CHROMIUM_HISTORY,
windows_files_ext::EDGE_CHROMIUM_LOGIN_DATA,
windows_files_ext::FIREFOX_PLACES,
windows_files_ext::FIREFOX_FORM_HISTORY,
windows_files_ext::FIREFOX_SESSION_RESTORE,
windows_files_ext::PSREADLINE_HISTORY,
windows_files_ext::PSREADLINE_HISTORY_SYSTEM,
windows_files_ext::POWERSHELL_TRANSCRIPTS,
windows_files_ext::TEAMVIEWER_CONNECTION_LOG,
windows_files_ext::TEAMVIEWER_APP_LOG,
windows_files_ext::ANYDESK_TRACE_USER,
windows_files_ext::ANYDESK_TRACE_SYSTEM,
windows_files_ext::ANYDESK_CONNECTION_TRACE,
windows_files_ext::ANYDESK_FILE_TRANSFER_LOG,
windows_files_ext::SCREENCONNECT_SESSION_DB,
windows_files_ext::RUSTDESK_LOGS,
windows_files_ext::DROPBOX_INSTANCE_DB,
windows_files_ext::ONEDRIVE_METADATA,
windows_files_ext::GOOGLE_DRIVE_FS_METADATA,
windows_files_ext::MEGASYNC_DATA,
windows_files_ext::TEAMS_INDEXED_DB,
windows_files_ext::SLACK_INDEXED_DB,
windows_files_ext::DISCORD_LOCAL_STORAGE,
windows_files_ext::SIGNAL_DATABASE,
windows_files_ext::SIGNAL_CONFIG_JSON,
windows_files_ext::WINDOWS_SEARCH_EDB,
windows_files_ext::EVENT_TRANSCRIPT_DB,
windows_files_ext::CERTUTIL_CACHE,
windows_files_ext::SDB_CUSTOM_FILES,
windows_files_ext::WER_REPORTS,
windows_files_ext::IIS_W3SVC_LOGS,
windows_files_ext::IIS_CONFIG_APPLICATIONHOST,
windows_files_ext::DNS_DEBUG_LOG,
windows_files_ext::DHCP_SERVER_LOG,
windows_files_ext::SUM_DB,
windows_files_ext::COPILOT_RECALL_UKG,
windows_files_ext::NTUSER_DAT_FILE,
windows_files_ext::USRCLASS_DAT_FILE,
// Groups A, B, F, G: Windows logs/WER/AppX/diagnostics (batch I)
windows_files_ext::CBS_LOG,
windows_files_ext::PFRO_LOG,
windows_files_ext::SETUPERR_LOG,
windows_files_ext::SETUPAPI_UPGRADE_LOG,
windows_files_ext::WER_REPORTS_USER,
windows_files_ext::WER_REPORTS_SYSTEM,
windows_files_ext::APPX_PACKAGES_USER,
windows_files_ext::APPX_INSTALL_LOG,
windows_files_ext::DIAGNOSTIC_DATA_DIR,
windows_files_ext::WINDOWS_UPDATE_SESSION,
// Phase-3 net-new persistence artifacts not yet in catalog (windows_registry_ext3)
// Note: winlogon_shell, winlogon_userinit, appinit_dlls, boot_execute,
// ifeo_debugger, netsh_helper_dlls, mountpoints2 already exist above.
windows_registry_ext3::ACTIVE_SETUP,
windows_registry_ext3::LSA_AUTH_PACKAGES,
windows_registry_ext3::LSA_SECURITY_PACKAGES,
windows_registry_ext3::LSA_NOTIFICATION_PACKAGES,
windows_registry_ext3::SCREENSAVER_PERSISTENCE,
windows_registry_ext3::PRINT_MONITOR_DLLS,
windows_registry_ext3::SERVICES_HKLM,
windows_registry_ext3::WINDOWS_INSTALL_DATE,
windows_registry_ext3::WINDOWS_CLIPBOARD_HISTORY,
windows_registry_ext3::VALLEY_RAT_REGISTRY,
windows_registry_ext3::HYPERV_GUEST_PARAMS,
windows_registry_ext3::REGISTRY_FEATUREUSAGE,
windows_registry_ext3::ENABLE_PERIODIC_BACKUP,
windows_registry_ext3::RDP_ENABLE_REGISTRY,
windows_registry_ext3::SPECIAL_ACCOUNTS_USERLIST,
windows_registry_ext3::LOGONTYPE_WINLOGON,
windows_files_ext::NTUSER_MAN_PERSISTENCE,
windows_files_ext::WINDOWS_CLIPBOARD_DATA_FILES,
windows_files_ext::WINDOWS_DEFENDER_MPWPPTRACING,
windows_files_ext::PSEXESVC_DROPPED_BINARY,
windows_files_ext::LSASS_DUMP_FILE,
// ── Generated artifact descriptors (mass-import pipeline) ────────────────
// Total: 6187 generated entries
// ── browsers_generated (37 entries) ────────────────────────────────────
generated::browsers_generated::BROWSERS_CHROME_HISTORY,
generated::browsers_generated::BROWSERS_CHROME_PROFILE_DIR,
generated::browsers_generated::BROWSERS_CHROME_COOKIES,
generated::browsers_generated::BROWSERS_CHROME_CACHE_DIR,
generated::browsers_generated::BROWSERS_CHROME_EXTENSIONS_DIR,
generated::browsers_generated::BROWSERS_EDGE_HISTORY,
generated::browsers_generated::BROWSERS_EDGE_COOKIES,
generated::browsers_generated::BROWSERS_EDGE_PROFILE_DIR,
generated::browsers_generated::BROWSERS_FIREFOX_PROFILE_DIR,
generated::browsers_generated::BROWSERS_FIREFOX_PLACES_DB,
generated::browsers_generated::BROWSERS_FIREFOX_COOKIES,
generated::browsers_generated::BROWSERS_FIREFOX_LOGINS,
generated::browsers_generated::BROWSERS_BRAVE_HISTORY,
generated::browsers_generated::BROWSERS_BRAVE_COOKIES,
generated::browsers_generated::BROWSERS_OPERA_HISTORY,
generated::browsers_generated::BROWSERS_OPERA_PROFILE_DIR,
generated::browsers_generated::BROWSERS_VIVALDI_HISTORY,
generated::browsers_generated::BROWSERS_VIVALDI_PROFILE_DIR,
generated::browsers_generated::BROWSERS_SAFARI_HISTORY,
generated::browsers_generated::BROWSERS_SAFARI_COOKIES,
generated::browsers_generated::BROWSERS_SAFARI_DOWNLOADS,
generated::browsers_generated::BROWSERS_IE_HISTORY_DIR,
generated::browsers_generated::BROWSERS_IE_WEBCACHE_DB,
generated::browsers_generated::BROWSERS_IE_TYPED_URLS,
generated::browsers_generated::BROWSERS_TOR_PROFILE_DIR,
generated::browsers_generated::BROWSERS_TOR_PLACES_DB,
generated::browsers_generated::BROWSERS_WATERFOX_PROFILE_DIR,
generated::browsers_generated::BROWSERS_LIBREWOLF_PROFILE_DIR,
generated::browsers_generated::BROWSERS_CHROMIUM_HISTORY,
generated::browsers_generated::BROWSERS_PALEMOON_PROFILE_DIR,
generated::browsers_generated::BROWSERS_SEAMONKEY_PROFILE_DIR,
generated::browsers_generated::BROWSERS_BASILISK_PROFILE_DIR,
generated::browsers_generated::BROWSERS_FALKON_PROFILE_DIR,
generated::browsers_generated::BROWSERS_MIDORI_CONFIG_DIR,
generated::browsers_generated::BROWSERS_MIN_HISTORY_DB,
generated::browsers_generated::BROWSERS_MAXTHON_USER_DATA_DIR,
generated::browsers_generated::BROWSERS_SLIMJET_HISTORY,
// ── evtx_generated (995 entries) ────────────────────────────────────
generated::evtx_generated::EVTX_APPLICATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DFSN_SERVERFILTER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DFSN_SERVERSERVICE_ANALYTIC,
generated::evtx_generated::EVTX_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_IALPSS_GPIO2_DEBUG_CHANNEL,
generated::evtx_generated::EVTX_IALPSS_GPIO2_PERFORMANCE_CHANNEL,
generated::evtx_generated::EVTX_IALPSS2_I2C_DEBUG_CHANNEL,
generated::evtx_generated::EVTX_IALPSS2_I2C_PERFORMANCE_CHANNEL,
generated::evtx_generated::EVTX_OPERATIONAL,
generated::evtx_generated::EVTX_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LSA_PERFORMANCE,
generated::evtx_generated::EVTX_AMSI_DEBUG,
generated::evtx_generated::EVTX_AMSI_OPERATIONAL,
generated::evtx_generated::EVTX_UAC_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_APPV_CLIENT_STREAMINGUX_DEBUG,
generated::evtx_generated::EVTX_ADMIN,
generated::evtx_generated::EVTX_VIRTUAL_APPLICATIONS,
generated::evtx_generated::EVTX_MICROSOFT_APPV_CLIENT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_APPV_SHAREDPERFORMANCE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_CLIENT_LICENSE_FLEXIBLE_PLATFORM_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_CLIENT_LICENSING_PLATFORM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_CLIENT_LICENSING_PLATFORM_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_WEBPLATSTORAGE_SERVER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INDEXEDDB_SERVER,
generated::evtx_generated::EVTX_MICROSOFT_IEDVTOOL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_IEFRAME_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_ONECORE_SETUP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_PEF_WFP_MESSAGEPROVIDER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_PERFTRACK_IEFRAME_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_PERFTRACK_MSHTML_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_SERVERCORE_SHELLLAUNCHER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_SYSTEM_DIAGNOSTICS_DIAGNOSTICINVOKER_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_USER_EXPERIENCE_VIRTUALIZATION_ADMIN_DEBUG,
generated::evtx_generated::EVTX_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_USER_EXPERIENCE_VIRTUALIZATION_APP_AGENT_DEBU,
generated::evtx_generated::EVTX_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WS_LICENSING_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WS_LICENSING_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WS_LICENSING_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_VPN_PLUGIN_PLATFORM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_VPN_PLUGIN_PLATFORM_OPERATIONALVERBOS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AAD_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AAD_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ADSI_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_API_TRACING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASN1_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ATAPORT_SATA_LPM,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ATAPORT_GENERAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_ATAPORT_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_ATAPORT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ACCELLIB_ACCELCX_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ACTIONQUEUE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ALTTAB_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ANYTIME_UPGRADE_EVENTS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ANYTIME_UPGRADE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPHOST_INTERNAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPHOST_DIAGNOSTIC,
generated::evtx_generated::EVTX_APPTRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPID_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_EXE_AND_DLL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_MSI_AND_SCRIPT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_PACKAGED_APP_EXECUTION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_PACKAGED_APP_DEPLOYMENT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_VERBOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIVACY_AUDITING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_DIAGNOSTICS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_STATE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_STATE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPSRUPROV,
generated::evtx_generated::EVTX_APPXDEPLOYMENTUNDOCKEDDEH_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_RESTRICTED,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICABILITYENGINE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICABILITYENGINE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROGRAM_COMPAT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROGRAM_TELEME,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_STEPS_RECORDER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROBLEM_STEPS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROGRAM_INVENT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_COMPATIBILITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPHELPCACHE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPHELPCACHE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPHELPCACHE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATIONRESOURCEMANAGEMENTSYSTEM_D,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATIONRESOURCEMANAGEMENTSYSTEM_O,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXPACKAGING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXPACKAGING_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASSIGNEDACCESS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASSIGNEDACCESS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASSIGNEDACCESSBROKER_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASYNCHRONOUSCAUSALITY_CAUSALITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_CAPTUREMONITOR,
generated::evtx_generated::EVTX_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_PLAYBACKMANAGER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_GLITCHDETECTION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_INFORMATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_PROTECTEDUSER_CLIENT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_PROTECTED_USER_CLIENT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AXINSTALLSERVICE_LOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHPORT_HCI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHPORT_L2CAP,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHUSB_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHUSB_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHUSB_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKGROUNDTRANSFER_CONTENTPREFETCHER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKUP_OPERATIONAL,
generated::evtx_generated::EVTX_BFE_IPSEC_CONNECTIONS_OPERATIONAL_LOG,
generated::evtx_generated::EVTX_BFE_IPSEC_CONNECTIONS_RESOURCE_FLOWS_OPERATIONAL_LOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BASE_FILTERING_ENGINE_RESOURCE_FLOWS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BATTERY_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BIOMETRICS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BIOMETRICS_ANALYTIC,
generated::evtx_generated::EVTX_MANAGEMENT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_DRIVEPREPARATIONTOOL_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_DRIVEPREPARATIONTOOL_OPERAT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_DRIVER_PERFORMANCE_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_CLIENT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_CLIENT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_COMPACTSERVER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_COMPACTSERVER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_BTHLEPREPAIRING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_BTHMINI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_HIDBTHLE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_POLICY_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHECLIENTEVENTPROVIDER_DIAGNO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHEEVENTPROVIDER_DIAGNOSTICCH,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHEMONITORING_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHESMB_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHESMB_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKGROUNDTASKINFRASTRUCTURE_DIAGNOST,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKGROUNDTASKINFRASTRUCTURE_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REGSVR32_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CAPI2_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CAPI2_CATALOG_DATABASE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CDROM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_CREATEINSTANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_CREATEINSTANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_EXTENSIONCATALOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_CALL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_FREEUNUSEDLIBRARY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLE_CLIPBOARD,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_APARTMENTUNINITIALIZE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_APARTMENTINITIALIZE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_RUNDOWNINSTRUMENTATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMRUNTIME_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMRUNTIME_MESSAGEPROCESSING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMRUNTIME_ACTIVATIONS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CALCULATOR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CALCULATOR_DEBUG,
generated::evtx_generated::EVTX_OPERATION_LOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICES_DEPLOYMENT_OPERAT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICESCLIENT_CREDENTIALR,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICESCLIENT_LIFECYCLE_S,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICESCLIENT_LIFECYCLE_U,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLEANMGR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLEARTYPETEXTTUNER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDFILES_FILTER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDRESTORELAUNCHER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORAGEWIZARD_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORAGEWIZARD_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORE_INITIALIZATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CMISETUP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CODEINTEGRITY_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CODEINTEGRITY_VERBOSE,
generated::evtx_generated::EVTX_ANALYTICAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMPAT_APPRAISER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMPAT_APPRAISER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONNECTED_SEARCH_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONNECTED_SEARCH_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONNECTED_SEARCH_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONTAINERS_BINDFLT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONTAINERS_WCIFS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONTAINERS_WCNFS_OPERATIONAL,
generated::evtx_generated::EVTX_SMSROUTER_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_SMSROUTER_DEBUG_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREWINDOW_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CORRUPTEDFILERECOVERY_CLIENT_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CORRUPTEDFILERECOVERY_SERVER_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRASHDUMP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRASHDUMP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CREDPROVHOST_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CREDUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CREDENTIALPROVIDERS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_BCRYPT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_CNG_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DPAPI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DPAPI_BACKUPKEYSVC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DPAPI_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DSSENH_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_NCRYPT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_NCRYPT_CERTINUSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_NCRYPT_KEYMGMT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_RNG_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_RSAENH_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_D3D10LEVEL9_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_D3D10LEVEL9_PERFTIMING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D9_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DAL_PROVIDER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DAL_PROVIDER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DCLOCATOR_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DDISPLAY_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_SERVER_EVENTS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_SERVER_EVENTS_FILTERNOTIFICATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCPV6_CLIENT_EVENTS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_CLIENT_EVENTS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DLNA_NAMESPACE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DNS_CLIENT_EVENTS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DSC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DSC_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DSC_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DUSER_DIAGNOSTIC,
generated::evtx_generated::EVTX_DVD_NAVIGATOR,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGI_LOGGING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DATA_PDF_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DATAINTEGRITYSCAN_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DATAINTEGRITYSCAN_CRASHRECOVERY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_SCRUBBING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEFRAG_CORE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEPLORCH_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEPLOYMENT_SERVICES_DIAGNOSTICS_OPERA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEPLOYMENT_SERVICES_DIAGNOSTICS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DESKTOPACTIVITYMODERATOR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DESKTOPWINDOWMANAGER_DIAG_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEASSOCIATIONSERVICE_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICECONFIDENCE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEGUARD_OPERATIONAL,
generated::evtx_generated::EVTX_AUTOPILOT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEMANAGEMENT_ENTERPRISE_DIAGNOSTI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESYNC_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESYNC_OPERATIONAL,
generated::evtx_generated::EVTX_DEVICE_UPDATE_AGENT_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEUX_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEUX_INFORMATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICES_BACKGROUND_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICES_LOCATION_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICES_QUERY_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_CLIENT_EVENTS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCPNAP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCPNAP_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGCPL_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_ADVANCEDTASKMANAGER_ANALYTI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_DPS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_DPS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_DPS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_MSDE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_MSDT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_MSDT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PCW_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PCW_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PCW_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PLA_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PLA_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PERFHOST_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCHEDULED_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTEDDIAGNOSTICSPROVIDER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_TASKMANAGER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_WDC_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_WDI_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_NETWORKING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_NETWORKING_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_PERFTRACK_COUNTERS_DIAGNO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_PERFTRACK_DIAGNOSTIC,
generated::evtx_generated::EVTX_DIAGNOSTIC_LOOPBACK,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D10_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D10_1_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D11_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D11_PERFTIMING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D11_LOGGING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D12_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D12_LOGGING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D12_PERFTIMING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3DSHADERCACHE_DEFAULT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DAMM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTCOMPOSITION_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTMANIPULATION_DIAGNOSTIC,
generated::evtx_generated::EVTX_DIRECTSHOWPLUGINCONTROL,
generated::evtx_generated::EVTX_DIRECTSHOW_FILTERGRAPH,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTSHOW_KERNELSUPPORT_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTSOUND_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTWRITE_FONTCACHE_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTWRITE_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTORYSERVICES_DEPLOYMENT_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISK_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_DISK_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_DISK_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISKDIAGNOSTIC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISKDIAGNOSTICDATACOLLECTOR_OPERATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISKDIAGNOSTICRESOLVER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISM_API_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISM_API_INTERNALANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISM_CLI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISPLAYCOLORCALIBRATION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISPLAYCOLORCALIBRATION_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISPLAYSWITCH_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DOT3MM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DRIVERFRAMEWORKS_USERMODE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_POWER_DIAGNOSTIC,
generated::evtx_generated::EVTX_DIRVER_PROXY_PERFORMANCE,
generated::evtx_generated::EVTX_DRIVER_PROXY_OPERATIONAL,
generated::evtx_generated::EVTX_DUC_UPDATE_AGENT_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_API_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_COMPOSITOR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_CORE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_DWM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_REDIR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_UDWM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_POWER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_CONTENTION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXPTASKRINGTONE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXPTASKSYNCPROVIDER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INFORMATION_PROTECTION_APPLICATION_LE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INFORMATION_PROTECTION_AUDIT_REGULAR,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EDP_AUDIT_REGULAR_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INFORMATION_PROTECTION_AUDIT_TCB_CHAN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EDP_AUDIT_TCB_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EFS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EFS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ELS_HYPHENATION_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POLICY_BASED_QOS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POLICY_BASED_QOS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ESE_IODIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ESE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EAPHOST_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EAPHOST_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EAPHOST_DEBUG,
generated::evtx_generated::EVTX_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EASEOFACCESS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EMBEDDEDAPPLAUNCHER_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENERGY_ESTIMATION_ENGINE_EVENTLOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENERGY_ESTIMATION_ENGINE_TRACE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWEREFFICIENCYDIAGNOSTICS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENHANCEDSTORAGE_EHSTORCLASS_OPERATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENHANCEDSTORAGE_EHSTORTCGDRV_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENROLLMENTPOLICYWEBSERVICE_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENROLLMENTWEBSERVICE_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FMS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_CLIENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_CLIENT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_MANAGER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_MANAGER_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAULT_TOLERANT_HEAP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FEDERATIONSERVICES_DEPLOYMENT_OPERATI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FEEDBACK_SERVICE_TRIGGERPROVIDER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_CATALOG_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_CONFIGMANAGER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_CORE_WHC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_ENGINE_BACKUPLOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_ENGINE_DEBUG,
generated::evtx_generated::EVTX_FILE_HISTORY_BACKUP_LOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_SERVICE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_UI_EVENTS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_UI_EVENTS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEINFOMINIFILTER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEMANAGERAPP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEMANAGERDATAMODEL_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FIREWALL_CPL_DIAGNOSTIC,
generated::evtx_generated::EVTX_SETUP_SPLASH_WINDOW_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FOLDER_REDIRECTION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FUNCTIONDISCOVERYHOST_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GENERICROAMING_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GETTINGSTARTED_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FONTGROUPS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLOBALIZATION_API_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GROUPPOLICY_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HAL_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HEALTHCENTER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HEALTHCENTER_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HEALTHCENTERCPL_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HELLOFORBUSINESS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HELLOFORBUSINESS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HELP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_CONTROL_PANEL_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_CONTROL_PANEL_PERFORMANCE_D,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_LISTENERSERVICE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_LISTENER_SERVICE_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_PROVIDER_SERVICE_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_PROVIDER_SERVICE_PERFORMANC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOTSTART_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOTSPOTAUTH_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOTSPOTAUTH_OPERATIONAL,
generated::evtx_generated::EVTX_HTTP_LOG_CHANNEL,
generated::evtx_generated::EVTX_HTTP_SERVICE_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_COMPUTE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_COMPUTE_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_HYPER_V_GUEST_DRIVERS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_HYPER_V_GUEST_DRIVERS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_GUEST_DRIVERS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_GUEST_DRIVERS_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_GUEST_DRIVERS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_HYPERVISOR_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_HYPERVISOR_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_KMCL_CHILD_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_NETVSC_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_VID_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_VID_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IE_SMARTSCREEN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_ADMINISTRATIVE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_OPERATIONAL,
generated::evtx_generated::EVTX_IIS_DIAGNOSTICS_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_BROKER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_CANDIDATEUI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_CUSTOMERFEEDBACKMANAGER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_CUSTOMERFEEDBACKMANAGERUI_ANALYTI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPAPI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPLMP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPPRED_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPSETTING_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPTIP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_KRAPI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_KRTIP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_OEDCOMPILER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_ROAMING_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_SCCORE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_SCDICCOMPILER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_SCTIP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_TCCORE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_TCTIP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_TIP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IPBUSENUM_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IPNAT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IPSEC_SRV_DIAGNOSTIC,
generated::evtx_generated::EVTX_DEBUG_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IDCTRLS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IDCTRLS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TWINAPI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREAPPLICATION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREAPPLICATION_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREAPPLICATION_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TWINUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TWINUI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INDIRECTDISPLAYS_CLASSEXTENSION_EVENT,
generated::evtx_generated::EVTX_THIS_IS_THE_ANALYTIC_CHANNEL_TO_WHICH_INTERNAL_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INPUTSWITCH_DIAGNOSTIC,
generated::evtx_generated::EVTX_THIS_IS_THE_ANALYTIC_CHANNEL_FOR_WINDOWS_INSTALL_UX_PER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INTERNATIONAL_OPERATIONAL,
generated::evtx_generated::EVTX_IPHLPSVC_ETW_CHANNEL,
generated::evtx_generated::EVTX_IPHLPSVC_ETW_DEBUG_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KDSSVC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_ACPI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPCOMPAT_GENERAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPCOMPAT_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_BOOT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_BOOT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_BOOTDIAGNOSTICS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_CPU_PARTITION_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_CPU_STARVATION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_DISK_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_DUMP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_EVENTTRACING_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_EVENTTRACING_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_FILE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_IO_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_IOTRACE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_LIVEDUMP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_LIVEDUMP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_MEMORY_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_NETWORK_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PEP_DIAGNOSTIC,
generated::evtx_generated::EVTX_BOOT_DIAGNOSTIC_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PNP_DIAGNOSTIC,
generated::evtx_generated::EVTX_DRIVER_DIAGNOSTIC_CHANNEL,
generated::evtx_generated::EVTX_DEVICE_ENUMERATION_DIAGNOSTIC_CHANNEL,
generated::evtx_generated::EVTX_CONFIGURATION_DIAGNOSTIC_CHANNEL,
generated::evtx_generated::EVTX_DEVICE_CONFIGURATION,
generated::evtx_generated::EVTX_PNP_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_DEVICE_MANAGEMENT,
generated::evtx_generated::EVTX_DRIVER_WATCHDOG_CHANNEL,
generated::evtx_generated::EVTX_CONFIGURATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_POWER_THERMAL_DIAGNOSTIC,
generated::evtx_generated::EVTX_THERMAL_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PREFETCH_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PRM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PROCESS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PROCESSOR_POWER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_REGISTRY_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_REGISTRY_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_SHIMENGINE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_SHIMENGINE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_SHIMENGINE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_STOREMGR_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_STOREMGR_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WDI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WDI_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WDI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WHEA_ERRORS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WHEA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WHEA_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_XDV_ANALYTIC,
generated::evtx_generated::EVTX_WINDOWS_KS_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KEYBOARDFILTER_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KEYBOARDFILTER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KEYBOARDFILTER_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KNOWN_FOLDERS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_WLAN_AUTOCONFIG_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_WIRED_AUTOCONFIG_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_L2NACP_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LAPS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LDAP_CLIENT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LUA_CONSENTUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LANGUAGEPACKSETUP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LANGUAGEPACKSETUP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LANGUAGEPACKSETUP_DEBUG,
generated::evtx_generated::EVTX_MAJOR_STATE_CONFIGURATION_CHANGE_THAT_CAN_HELP_DEBUG_AD,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LIMITSMANAGEMENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LINKLAYERDISCOVERYPROTOCOL_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LINKLAYERDISCOVERYPROTOCOL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LIVEID_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LIVEID_OPERATIONAL,
generated::evtx_generated::EVTX_AUTOMATION,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_FRAMESERVER,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_DEVICEPROXY,
generated::evtx_generated::EVTX_MF_MEDIAFOUNDATIONDEVICEPROXY,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PIPELINE,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_CONTENTPROTECTION,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_ASYNCWRAPPER,
generated::evtx_generated::EVTX_MEDIAFOUNDATIONASYNCWRAPPER,
generated::evtx_generated::EVTX_MFDS,
generated::evtx_generated::EVTX_SRCPREFETCH,
generated::evtx_generated::EVTX_MP4,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_DEVICEMFT,
generated::evtx_generated::EVTX_WINDOWS_MFH264ENC_CHANNEL,
generated::evtx_generated::EVTX_WINDOWS_MP4SDECD_CHANNEL,
generated::evtx_generated::EVTX_MUXENCODE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MPS_CLNT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MPS_DRV_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MPS_SRV_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSFTEDIT_DIAGNOSTIC,
generated::evtx_generated::EVTX_WINDOWS_MSMPEG2ADEC_CHANNEL,
generated::evtx_generated::EVTX_WINDOWS_MSMPEG2VDEC_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSMQ_END2END,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSPAINT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSPAINT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSSHAV_SHV_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSSHAV_SHV_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSSHAV_SHVCNFG_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_ANALYTIC,
generated::evtx_generated::EVTX_MEDIA_CENTER,
generated::evtx_generated::EVTX_PLAYREADY_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIA_STREAMING_DMR,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIA_STREAMING_DMC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIA_STREAMING_MDE,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_MEDIAENGINE,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_CAPTURE_ENGINE_ETW_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_MFREADWRITE_SOURCEREA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_MFREADWRITE_SINKWRITE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_MFREADWRITE_TRANSFORM,
generated::evtx_generated::EVTX_MS_VIDEO_PROCESSOR_MFT_D3D11,
generated::evtx_generated::EVTX_MS_VIDEO_PROCESSOR_MFT,
generated::evtx_generated::EVTX_MS_VIDEO_DSP,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PERFORMANCE_CORE,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_PERFORMANCE_SARSTREAM,
generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PLATFORM,
generated::evtx_generated::EVTX_MEDIAFOUNDATIONDEVICEPROXY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_PLAYAPI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEMORYDIAGNOSTICS_RESULTS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MIGRATION_ENGINE_ANALYTIC,
generated::evtx_generated::EVTX_MINSTORE_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_MINSTORE_DEBUG_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_API_INTER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_API_ANALY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_PARSER_TA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_SMSAPI_AN,
generated::evtx_generated::EVTX_SMSAPI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_SMSROUTER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILITYCENTER_PERFORMANCE,
generated::evtx_generated::EVTX_DIAGNOSTICS,
generated::evtx_generated::EVTX_MANAGEMENTSERVICE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOSHOST_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOSHOST_PERFORMANCE,
generated::evtx_generated::EVTX_NOTIFICATION_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSLBFOPROVIDER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCSI_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCSI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDIS_PACKETCAPTURE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDIS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDIS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_PROTECTEDUSERFAILURES,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_AUTHENTICATIONPOLICYFA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTLM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NWIFI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NARRATOR_INPROC_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NARRATOR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCASVC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCDAUTOSETUP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCDAUTOSETUP_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDISIMPLATFORM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDU_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETSHELL_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_CONNECTION_BROKER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_DATAUSAGE_ANALYTIC,
generated::evtx_generated::EVTX_EXECUTION_CONTEXT_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_SETUP_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_AND_SHARING_CENTER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKACCESSPROTECTION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKACCESSPROTECTION_WHC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKBRIDGE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROFILE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROFILE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROVIDER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROVISIONING_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROVISIONING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKSECURITY_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKSTATUS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKING_CORRELATION_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKING_REALTIMECOMMUNICATION_TRAC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NLASVC_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NLASVC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTFS_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTFS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTFS_WHC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NVDIMMN_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NVDIMMN_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_NVMEDISK_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_NVMEDISK_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_NVMEDISK_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLE_CLIPBOARD_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLE_CLIPBOARD_DIAGNOSTICS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLEACC_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLEACC_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_FIRSTLOGONANIM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_CORE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_DUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_DUI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_PLUGINS_WIRELESS_DIAGNOS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_PLUGINS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_DIAGNOSTIC,
generated::evtx_generated::EVTX_SETUP,
generated::evtx_generated::EVTX_OCP_UPDATE_AGENT_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OFFLINEFILES_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OFFLINEFILES_SYNCLOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ONEBACKUP_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ONEX_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ONEX_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBELDR_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OTPCREDENTIALPROVIDER_OPERATIONAL,
generated::evtx_generated::EVTX_PCI_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PCI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PDC_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLCND_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLCND_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLCND_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PACKAGESTATEROAMING_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PACKAGESTATEROAMING_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PACKAGESTATEROAMING_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARENTALCONTROLS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARENTALCONTROLS_TELEMETRY_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARENTALCONTROLS_TELEMETRY_AUDITING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARTITION_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARTITION_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARTITION_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PEERTOPEERDRTEVENTPROVIDER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_INVDIMM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_INVDIMM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMMN_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMMN_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_PMEMDISK_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_PMEMDISK_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_PMEMDISK_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_CERTIFICATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_VIRTUALNVDIMM_OPERAT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_VIRTUALNVDIMM_DIAGNO,
generated::evtx_generated::EVTX_WINDOWS_WMPHOTO_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PHOTOACQ_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PLAYTOMANAGER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PMEMDISK_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PMEMDISK_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PMEMDISK_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PORTABLEDEVICESTATUSPROVIDER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PORTABLEDEVICESYNCPROVIDER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWER_METER_POLLING_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERCFG_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERCPL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_DESIREDSTATECONFIGURATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIRESOURCES_DEPLOYMENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIRESOURCES_DEPLOYMENT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIMARYNETWORKICON_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKLOCATIONWIZARD_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTDIALOGS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTDIALOGS3D_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTSPOOLER_CORE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTSPOOLER_CORE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIVACY_AUDITING_PERMISSIVELEARNINGMO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROCESSSTATEMANAGER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROGRAM_COMPATIBILITY_ASSISTANT_OPERA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROXIMITY_COMMON_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROXIMITY_COMMON_INFORMATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROXIMITY_COMMON_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_DEVELOPER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_INPROC_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_PLATFORM_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_PLATFORM_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_PLATFORM_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_QOS_PACER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_QOS_PACER_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_QOS_QWAVE_DEBUG,
generated::evtx_generated::EVTX_EEINFO,
generated::evtx_generated::EVTX_ADMIN_CHANNEL,
generated::evtx_generated::EVTX_RTWORKQUEUE_EXTENDED,
generated::evtx_generated::EVTX_RTWORKQUEUE_THREADING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RADIOMANAGER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RAS_NDISWANPACKETCAPTURE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REFS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REFSDEDUPSVC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_READYBOOST_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_READYBOOSTDRIVER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_READYBOOSTDRIVER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RECOVERY_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RELIABILITYANALYSISCOMPONENT_OPERATIO,
generated::evtx_generated::EVTX_METRICS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEAPP_AND_DESKTOP_CONNECTIONS_ADM,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEAPP_AND_DESKTOP_CONNECTIONS_OPE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEASSISTANCE_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEASSISTANCE_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEASSISTANCE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCORETS_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCORETS_OPERA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCORETS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_REMOTEFX_VM_KER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_REMOTEFX_VM_USE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_SESSIONSERVICES,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEFS_RDBSS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEFS_RDBSS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEFS_UTPROVIDER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESETENG_TRACE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCE_EXHAUSTION_DETECTOR_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCE_EXHAUSTION_RESOLVER_OPERATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCE_LEAK_DIAGNOSTIC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCEPUBLICATION_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESTARTMANAGER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_GRAPHICS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTCAPTUREENG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTTRANSCODE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTMEDIASTREA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTADAPTIVEME,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_NETWORKING_BACKGROUNDTRANSFER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_NETWORKING_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WEB_HTTP_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WEBAPI_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SENSE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_HELPERCLASSDIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_XPERFANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_OBJECTSTATEDIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_CONNECTIVITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_SECURITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_AUDIT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_CONNECTIVITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_NETMON,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_SECURITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_CONNECTIVITY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_AUDIT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBWITNESSCLIENT_ADMIN,
generated::evtx_generated::EVTX_WITNESSCLIENTADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBWITNESSCLIENT_INFORMATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCHANNEL_EVENTS_PERF,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMBUS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMBUS_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMBUS_CERTIFICATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMDISK0101_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMDISK0101_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMDISK0101_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SDBUS_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SDBUS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SDSTOR_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SEARCH_CORE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SEARCH_PROTOCOLHANDLERS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_ADMINLESS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_AUDIT_CONFIGURATION_CLIENT_D,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_AUDIT_CONFIGURATION_CLIENT_O,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_CONFIGURATION_WIZARD_DIAGNOS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_CONFIGURATION_WIZARD_OPERATI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_ENTERPRISEDATA_FILEREVOCATIO,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_EXCHANGEACTIVESYNCPROVISIONI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_IDENTITYSTORE_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_LESSPRIVILEGEDAPPCONTAINER_O,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_LICENSING_SLC_PERF,
generated::evtx_generated::EVTX_KERNEL_MODE,
generated::evtx_generated::EVTX_USER_MODE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_NETLOGON_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_GC_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_GENUINECENTER_LOGGING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_NOTIFICATIONS_ACTIONC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_PERF,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_USERCONSENTVERIFIER_AUDIT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_VAULT_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITYMITIGATIONSBROKER_PERF,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITYMITIGATIONSBROKER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITYMITIGATIONSBROKER_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SENDTO_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SENSEIR_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVER_FOR_NFS_OPERATIONAL,
generated::evtx_generated::EVTX_DEPLOY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVERMANAGER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICE_REPORTING_API_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICES_SVCHOST_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICES_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICING_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_AZURE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_AZURE_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_ONEDRIVE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_VERBOSEDEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPCL_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPPLATFORM_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPQUEUE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPUGC_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHAREMEDIA_CONTROLPANEL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_APPWIZCPL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_USER_INTERFACE_OPERATI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_COMMON_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_LOGONUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_LOGON_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_CREDUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_SHUTDOWN_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_CREDENTIALPROVIDERUSER_D,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_PASSWORDPROVIDER_DIAGNOS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_BOOTANIM_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_PASSWORDPROVIDER_BOOTANI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CONNECTEDACCOUNTSTATE_ACTIONCEN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_LOGONTASKSCHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_APPDEFAULTS,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_ACTIONCENTER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_DEFAULTPROGRAMS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_LOCKSCREENCONTENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_OPENWITH_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_SEARCH_URIHANDLER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_SHWEBSVC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_ZIPFOLDER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELLCOMMON_STARTLAYOUTPOPULATION_OPE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELLCOMMON_STARTLAYOUTPOPULATION_DIA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHSVCS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SIDEBAR_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SLEEPSTUDY_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_AUDIT_AUTHENTICATION,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_DEVICEENUM_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_TPM_VCARD_MODULE_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_TPM_VCARD_MODULE_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTSCREEN_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBHASHGENERATION_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBHASHGENERATION_ANALYTIC,
generated::evtx_generated::EVTX_SMBWMIANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TTS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPEECH_USEREXPERIENCE_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPELL_CHECKING_FACILITY_ANALYTIC_CHAN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPELLCHECKER_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPELL_CHECKING_HOST_ANALYTIC_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SRUMON_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SRUMTELEMETRY,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STATEREPOSITORY_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STATEREPOSITORY_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STATEREPOSITORY_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STICKYNOTES_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STICKYNOTES_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STICKYNOTES_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORDIAG_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_CLASSPNP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_CLASSPNP_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_CLASSPNP_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORPORT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_DIAGNOSE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_HEALTH,
generated::evtx_generated::EVTX_TIERING_HEAT_MEASUREMENT_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_TIERING_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEMANAGEMENT_PARTUTIL_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEMANAGEMENT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEMANAGEMENT_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESETTINGS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_API_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_DRIVER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_DRIVER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_DRIVER_PERFORMANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_MANAGEMENTAGENT_WHC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_PARSER_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_PARSER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_SPACEMANAGER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_SPACEMANAGER_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEVOLUME_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORSVC_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUBSYS_CSR_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUBSYS_SMSS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUDO_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUPERFETCH_AGMCLOG,
generated::evtx_generated::EVTX_MEMORY_COOLING_OPERATIONAL_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUPERFETCH_PFAPLOG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSPREP_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEM_PROFILE_HARDWAREID_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMDATAARCHIVER_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMHEALTHAGENT_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGS_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSHANDLERS_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSTHRESHOLD_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSTHRESHOLD_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSTHRESHOLD_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSV2_INFORMATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TCPIP_DIAGNOSTIC,
generated::evtx_generated::EVTX_UIMANAGER_CHANNEL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TSF_MSCTF_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TSF_MSUTB_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TZSYNC_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TZSYNC_ANALYTIC,
generated::evtx_generated::EVTX_TABLETPC_INPUTPANEL_CHANNEL,
generated::evtx_generated::EVTX_OSK_SOFTKEYBOARD_CHANNEL,
generated::evtx_generated::EVTX_TABLETPC_INPUTPANEL_CHANNEL_IHM,
generated::evtx_generated::EVTX_IHM_DEBUGCHANNEL,
generated::evtx_generated::EVTX_PHYSICAL_KEYBOARD_MANAGER_CHANNEL,
generated::evtx_generated::EVTX_MAINTENANCE,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TASKBARCPL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TENANTRESTRICTIONS_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_DEBUG,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_OPERATIONA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_OPERATIONAL,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_TRACING,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_LICENSING_ADMIN,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSIONMANAGER,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_MEDIAREDIRECTION_ANA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPSOUNDDRIVER_PLAYB,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPSOUNDDRIVER_CAPTU,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONNECTIONMANA,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_SESSIONBROKER_CLIENT,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TETHERING_MANAGER_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TETHERING_STATION_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_THEMECPL_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_THEMEUI_DIAGNOSTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_THREAT_INTELLIGENCE_ANALYTIC,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TIME_SERVICE_PTP_PROVIDER_PTP_OPERATI,
generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TIME_SERVICE_OPERATIONAL,
generated::evtx_generated::EVTX_TUNNEL_DRIVER_ETW_CHANNEL,
// ── fa_generated (2545 entries) ────────────────────────────────────
generated::fa_generated::FA_FILE_PARITY_AGENT_CACHE,
generated::fa_generated::FA_FILE_QUARANTINE,
generated::fa_generated::FA_FILE_QUARANTINE_2,
generated::fa_generated::FA_FILE_QUARANTINE_3,
generated::fa_generated::FA_FILE_CS_REGISTRY_BASE,
generated::fa_generated::FA_FILE_QUARANTINE_4,
generated::fa_generated::FA_FILE_LOGS,
generated::fa_generated::FA_FILE_QUARANTINE_5,
generated::fa_generated::FA_FILE_QUARANTINE_6,
generated::fa_generated::FA_FILE_SUPPORT_MPDETECTION_LOG,
generated::fa_generated::FA_FILE_SUPPORT_MPLOG_LOG,
generated::fa_generated::FA_FILE_DETECTIONHISTORY,
generated::fa_generated::FA_FILE_SUPPORT_MPDETECTION_LOG_2,
generated::fa_generated::FA_FILE_SUPPORT_MPLOG_LOG_2,
generated::fa_generated::FA_FILE_TEMP_MPCMDRUN_LOG,
generated::fa_generated::FA_FILE_TEMP_MPCMDRUN_LOG_2,
generated::fa_generated::FA_FILE_USERS_TEMP_MPCMDRUN_LOG,
generated::fa_generated::FA_FILE_,
generated::fa_generated::FA_EXCLUSIONS_PATHS,
generated::fa_generated::FA_EXCLUSIONS_PROCESSES,
generated::fa_generated::FA_EXCLUSIONS_EXTENSIONS,
generated::fa_generated::FA_EXCLUSIONS_TEMPORARYPATHS,
generated::fa_generated::FA_EXCLUSIONS_PATHS_2,
generated::fa_generated::FA_EXCLUSIONS_PROCESSES_2,
generated::fa_generated::FA_EXCLUSIONS_EXTENSIONS_2,
generated::fa_generated::FA_EXCLUSIONS_TEMPORARYPATHS_2,
generated::fa_generated::FA_FILE_SANTA,
generated::fa_generated::FA_FILE_SANTA_2,
generated::fa_generated::FA_FILE_LOGS_SOPHOS_LOG,
generated::fa_generated::FA_FILE_LOGS_2,
generated::fa_generated::FA_FILE_INFECTED,
generated::fa_generated::FA_FILE_INFECTED_2,
generated::fa_generated::FA_FILE_LOGS_LOG,
generated::fa_generated::FA_FILE_AV_LOG,
generated::fa_generated::FA_FILE_AV_LOG_2,
generated::fa_generated::FA_FILE_LOGS_LOG_2,
generated::fa_generated::FA_FILE_5_VBN,
generated::fa_generated::FA_FILE_QUARANTINE_7,
generated::fa_generated::FA_FILE_QUARANTINE_8,
generated::fa_generated::FA_FILE_CCSUBSDK,
generated::fa_generated::FA_FILE_EVOLUTION,
generated::fa_generated::FA_FILE_EVOLUTION_2,
generated::fa_generated::FA_FILE_EVOLUTION_3,
generated::fa_generated::FA_FILE_WORD,
generated::fa_generated::FA_FILE_EXCEL,
generated::fa_generated::FA_FILE_POWERPOINT,
generated::fa_generated::FA_FILE_PUBLISHER,
generated::fa_generated::FA_FILE_PREFERENCES_COM_MICROSOFT_OFFICE_PLIST,
generated::fa_generated::FA_FILE_PREFERENCES_COM_MICROSOFT_SECUREBOOKMARKS_PLIST,
generated::fa_generated::FA_FILE_OUTLOOK_PAB,
generated::fa_generated::FA_FILE_OUTLOOK_FILES_PAB,
generated::fa_generated::FA_FILE_OUTLOOK_PST,
generated::fa_generated::FA_FILE_OUTLOOK_FILES_PST,
generated::fa_generated::FA_FILE_OUTLOOK_OST,
generated::fa_generated::FA_FILE_OUTLOOK_FILES_OST,
generated::fa_generated::FA_FILE_NPM,
generated::fa_generated::FA_FILE_NPM_CACHE,
generated::fa_generated::FA_FILE_LOG_ERRORLOG,
generated::fa_generated::FA_FILE_LOG_ERRORLOG_2,
generated::fa_generated::FA_FILE_THUNDERBIRD,
generated::fa_generated::FA_FILE_DROPBOX_DB,
generated::fa_generated::FA_FILE_DROPBOX_DB_2,
generated::fa_generated::FA_FILE_INSTANCE_SYNC_HISTORY_DB,
generated::fa_generated::FA_FILE_DROPBOX_DB_3,
generated::fa_generated::FA_FILE_INSTANCE_SYNC_HISTORY_DB_2,
generated::fa_generated::FA_FILE_DRIVE_SNAPSHOT_DB,
generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_DB,
generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_LOG,
generated::fa_generated::FA_FILE_USER_DEFAULT_SNAPSHOT_DB,
generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB,
generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG,
generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_LOG_LOG,
generated::fa_generated::FA_FILE_DRIVE_SNAPSHOT_DB_2,
generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_DB_2,
generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_LOG_2,
generated::fa_generated::FA_FILE_USER_DEFAULT_SNAPSHOT_DB_2,
generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB_2,
generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG_2,
generated::fa_generated::FA_FILE_SETTINGS_APPLICATIONSETTINGS_XML,
generated::fa_generated::FA_FILE_SETTINGS_DAT,
generated::fa_generated::FA_FILE_SETTINGS_INI,
generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY,
generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_2,
generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_3,
generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_4,
generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_5,
generated::fa_generated::FA_FILE_ETC_EXPORTS,
generated::fa_generated::FA_FILE_ETC_EXPORTS_2,
generated::fa_generated::FA_FILE_ETC_EXPORTS_3,
generated::fa_generated::FA_FILE_CONF_REDIS_WINDOWS_CONF,
generated::fa_generated::FA_FILE_CONF_REDIS_CONF,
generated::fa_generated::FA_FILE_REDIS_REDIS_CONF,
generated::fa_generated::FA_FILE_REDIS_REDIS_CONF_2,
generated::fa_generated::FA_FILE_REDIS_REDIS_CONF_3,
generated::fa_generated::FA_FILE_SAMBA_SMB_CONF,
generated::fa_generated::FA_FILE_SSH_SSHD_CONFIG,
generated::fa_generated::FA_FILE_SSH_SSHD_CONFIG_2,
generated::fa_generated::FA_FILE_SSH_SSHD_CONFIG_3,
generated::fa_generated::FA_FILE_SSH_CONFIG,
generated::fa_generated::FA_FILE_CONTAINERD_CONFIG_TOML,
generated::fa_generated::FA_FILE_IO_CONTAINERD_METADATA_V1_BOLT_META_DB,
generated::fa_generated::FA_FILE_IO_CONTAINERD_SNAPSHOTTER_V1_OVERLAYFS_METADATA_DB,
generated::fa_generated::FA_FILE_CONFIG_JSON,
generated::fa_generated::FA_FILE_OPTIONS_JSON,
generated::fa_generated::FA_FILE_LOG_JSON,
generated::fa_generated::FA_FILE_LOG_DAEMON_LOG,
generated::fa_generated::FA_FILE_LOG_DAEMON_LOG_GZ,
generated::fa_generated::FA_FILE_LOG_SYSLOG,
generated::fa_generated::FA_FILE_LOG_MESSAGE,
generated::fa_generated::FA_FILE_ELASTICSEARCH_ACCESS_LOG,
generated::fa_generated::FA_FILE_ELASTICSEARCH_AUDIT_JSON,
generated::fa_generated::FA_FILE_ELASTICSEARCH_AUDIT_LOG,
generated::fa_generated::FA_FILE_ELASTICSEARCH_GC_LOG,
generated::fa_generated::FA_FILE_ELASTICSEARCH_GC_LOG_0_9,
generated::fa_generated::FA_FILE_ELASTICSEARCH_LOG,
generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON,
generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON_GZ,
generated::fa_generated::FA_FILE_ELASTICSEARCH_SERVER_JSON,
generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON_2,
generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON_GZ_2,
generated::fa_generated::FA_FILE_ETC_MONGOD_CONF,
generated::fa_generated::FA_FILE_ETC_MONGOD_CONF_2,
generated::fa_generated::FA_FILE_ETC_MONGOD_CONF_3,
generated::fa_generated::FA_FILE_MONGODB,
generated::fa_generated::FA_FILE_DB,
generated::fa_generated::FA_FILE_MONGODB_MONGOD_LOG,
generated::fa_generated::FA_FILE_ETC_MY_CNF,
generated::fa_generated::FA_FILE_MYSQL_CONF_D_MYSQLD_CNF,
generated::fa_generated::FA_FILE_MYSQL_MYSQL_IBD,
generated::fa_generated::FA_FILE_MYSQL,
generated::fa_generated::FA_FILE_MYSQL_ERROR_LOG,
generated::fa_generated::FA_FILE_LOG_MYSQL_LOG,
generated::fa_generated::FA_FILE_LOG_LOG,
generated::fa_generated::FA_FILE_OPENSEARCH_LOG,
generated::fa_generated::FA_FILE_OPENSEARCH_JSON,
generated::fa_generated::FA_FILE_POSTGRESQL_CONF,
generated::fa_generated::FA_FILE_PG_HBA_CONF,
generated::fa_generated::FA_FILE_PG_IDENT_CONF,
generated::fa_generated::FA_FILE_PGSQL_POSTGRESQL_CONF,
generated::fa_generated::FA_FILE_PGSQL_PG_HBA_CONF,
generated::fa_generated::FA_FILE_PGSQL_PG_IDENT_CONF,
generated::fa_generated::FA_FILE_DATA_POSTGRESQL_CONF,
generated::fa_generated::FA_FILE_DATA_PG_HBA_CONF,
generated::fa_generated::FA_FILE_DATA_PG_IDENT_CONF,
generated::fa_generated::FA_FILE_DATA,
generated::fa_generated::FA_FILE_DATA_OLD,
generated::fa_generated::FA_FILE__2,
generated::fa_generated::FA_FILE__3,
generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_LOG,
generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_CSV,
generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_LOG_2,
generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_CSV_2,
generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_LOG_3,
generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_CSV_3,
generated::fa_generated::FA_FILE_LOG_POSTGRESQL_LOG,
generated::fa_generated::FA_FILE_LOG_POSTGRESQL_CSV,
generated::fa_generated::FA_FILE_LOG_POSTGRESQL_LOG_2,
generated::fa_generated::FA_FILE_LOG_POSTGRESQL_CSV_2,
generated::fa_generated::FA_FILE_LOG_POSTGRESQL_LOG_3,
generated::fa_generated::FA_FILE_LOG_POSTGRESQL_CSV_3,
generated::fa_generated::FA_FILE_REDIS,
generated::fa_generated::FA_FILE_INIT_D_REDIS,
generated::fa_generated::FA_FILE_REDIS_2,
generated::fa_generated::FA_FILE__4,
generated::fa_generated::FA_FILE_REDIS_REDIS_LOG,
generated::fa_generated::FA_FILE_LOG_REDIS_LOG,
generated::fa_generated::FA_FILE_CONFIG_V2_JSON,
generated::fa_generated::FA_FILE_JSON_LOG,
generated::fa_generated::FA_FILE_LOG_ESXAPIADAPTER_LOG,
generated::fa_generated::FA_FILE_LOG_ATTESTD_LOG,
generated::fa_generated::FA_FILE_LOG_AUTH_LOG,
generated::fa_generated::FA_FILE_LOG_HOSTD_LOG,
generated::fa_generated::FA_FILE_LOG_KMXD_LOG,
generated::fa_generated::FA_FILE_LOG_LOADESX_LOG,
generated::fa_generated::FA_FILE_LOG_SHELL_LOG,
generated::fa_generated::FA_FILE_LOG,
generated::fa_generated::FA_FILE_LOG_SYSLOG_LOG,
generated::fa_generated::FA_FILE_LOG_ESXTOKEND_LOG,
generated::fa_generated::FA_FILE_LOG_KMXA_LOG,
generated::fa_generated::FA_FILE_LOG_VMKERNEL_LOG,
generated::fa_generated::FA_FILE_LOG_VMKSUMMARYLOG_LOG,
generated::fa_generated::FA_FILE_LOG_VMKWARNING_LOG,
generated::fa_generated::FA_FILE_LOG_VXPA_LOG,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_LOGFILE,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_MFT,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_MFTMIRR,
generated::fa_generated::FA_FILE_EXTEND_USNJRNL,
generated::fa_generated::FA_FILE_CONTAINER,
generated::fa_generated::FA_FILE_CONTAINER_2,
generated::fa_generated::FA_FILE_APPLICATION_APPLICATION,
generated::fa_generated::FA_FILE_APPLICATION_APPLICATION_2,
generated::fa_generated::FA_FILE_APPLICATION_APPLICATION_3,
generated::fa_generated::FA_FILE_APPLICATION_APPLICATION_4,
generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB,
generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB_2,
generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB_3,
generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB_4,
generated::fa_generated::FA_FILE_DIAGNOSE,
generated::fa_generated::FA_FILE_DIAGNOSIS,
generated::fa_generated::FA_FILE_DIAGNOSE_2,
generated::fa_generated::FA_FILE_DIAGNOSIS_2,
generated::fa_generated::FA_FILE_SECURITYCONTROLLER,
generated::fa_generated::FA_FILE_LOGFILES,
generated::fa_generated::FA_FILE_SETUP,
generated::fa_generated::FA_FILE_DIST_INFO,
generated::fa_generated::FA_FILE_DIST_INFO_2,
generated::fa_generated::FA_FILE_DIST_INFO_3,
generated::fa_generated::FA_FILE_DIST_INFO_4,
generated::fa_generated::FA_FILE_DIST_INFO_5,
generated::fa_generated::FA_FILE_DIST_INFO_6,
generated::fa_generated::FA_FILE_DIST_INFO_7,
generated::fa_generated::FA_FILE_DIST_INFO_8,
generated::fa_generated::FA_FILE_DIST_INFO_9,
generated::fa_generated::FA_FILE_DIST_INFO_10,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO,
generated::fa_generated::FA_FILE_PIP_EGG,
generated::fa_generated::FA_FILE_PIP_EGG_INFO,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_2,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_2,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_2,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO_2,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_3,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_3,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_3,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO_3,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_4,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_4,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_4,
generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO_4,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_5,
generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_5,
generated::fa_generated::FA_FILE_PYSHARED_EGG,
generated::fa_generated::FA_FILE_PYSHARED_EGG_INFO,
generated::fa_generated::FA_FILE_EGG,
generated::fa_generated::FA_FILE_EGG_INFO,
generated::fa_generated::FA_FILE_EGG_2,
generated::fa_generated::FA_FILE_EGG_INFO_2,
generated::fa_generated::FA_FILE_EGG_3,
generated::fa_generated::FA_FILE_EGG_INFO_3,
generated::fa_generated::FA_FILE_EGG_4,
generated::fa_generated::FA_FILE_EGG_INFO_4,
generated::fa_generated::FA_FILE_EGG_5,
generated::fa_generated::FA_FILE_EGG_INFO_5,
generated::fa_generated::FA_FILE_EGG_6,
generated::fa_generated::FA_FILE_EGG_INFO_6,
generated::fa_generated::FA_FILE_EGG_7,
generated::fa_generated::FA_FILE_EGG_INFO_7,
generated::fa_generated::FA_FILE_EGG_8,
generated::fa_generated::FA_FILE_EGG_INFO_8,
generated::fa_generated::FA_FILE_EGG_9,
generated::fa_generated::FA_FILE_EGG_INFO_9,
generated::fa_generated::FA_FILE_EGG_10,
generated::fa_generated::FA_FILE_EGG_INFO_10,
generated::fa_generated::FA_FILE_EGG_11,
generated::fa_generated::FA_FILE_EGG_INFO_11,
generated::fa_generated::FA_FILE_PYTHON_WHEELS_WHL,
generated::fa_generated::FA_FILE_WHEELS_WHL,
generated::fa_generated::FA_FILE_2_GEMSPEC,
generated::fa_generated::FA_FILE_2_GEMSPEC_2,
generated::fa_generated::FA_FILE_2_GEMSPEC_3,
generated::fa_generated::FA_FILE_ATTACHMENTS_NOINDEX,
generated::fa_generated::FA_FILE_CACHE,
generated::fa_generated::FA_FILE_ORG_SIGNAL_SIGNAL_CONFIG_JSON,
generated::fa_generated::FA_FILE_ORG_SIGNAL_SIGNAL_DB_SQLITE,
generated::fa_generated::FA_FILE_CHATSYNC,
generated::fa_generated::FA_FILE_MAIN_DB,
generated::fa_generated::FA_FILE_PREFERENCES_COM_SKYPE_SKYPE_PLIST,
generated::fa_generated::FA_FILE_XCHATLOGS_LOG,
generated::fa_generated::FA_FILE_CACHE_2,
generated::fa_generated::FA_FILE_CACHE_3,
generated::fa_generated::FA_FILE_CACHE_4,
generated::fa_generated::FA_FILE_DS_STORE_APP_10,
generated::fa_generated::FA_FILE_LAUNCHAGENTS_COM_APPLE_LAUNCHPORT_PLIST,
generated::fa_generated::FA_FILE_SYSTEM32_AWCODC32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_AWVIEW32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_C_50225_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_50227_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_50229_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_51932_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_51936_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_51949_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_51950_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_57002_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_57006_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_57008_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_C_57010_NLS,
generated::fa_generated::FA_FILE_SYSTEM32_CDGEXT32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CDLLAIT32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CDLLAIT64_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLSGH32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLSGH64_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLWS32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLWS64_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CFGBKMGRS_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_CFGMGR64_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_COMSVRPCS_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_D3DX8_20_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_DLLCOMM_DLL,
generated::fa_generated::FA_FILE_DRIVERS_WMIMGR_SYS,
generated::fa_generated::FA_FILE_SYSTEM32_DRVINFO_BIN,
generated::fa_generated::FA_FILE_SYSTEM32_FCACHE_BIN,
generated::fa_generated::FA_FILE_SYSTEM32_FFEXTENDEDCOMMAND_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_GPKTCSP32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_HPQUEUE_BIN,
generated::fa_generated::FA_FILE_SYSTEM32_LPQUEUE_BIN,
generated::fa_generated::FA_FILE_SYSTEM32_MDWMNSP_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_MFCN30_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_NMWCDLOG_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_OBJFRAME_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_RPCDIST_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SCSVRFT_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SDPTBW_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SHLINK32_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SHLINK64_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SIIW9X_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SKYPEIE6PLUGIN_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_SLBKBW_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_WIFISCAN_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_WMSPDMGR_DLL,
generated::fa_generated::FA_FILE_MICROSOFT_C_27803_NLS,
generated::fa_generated::FA_FILE_MICROSOFT_OBJFRAME_DLL,
generated::fa_generated::FA_FILE_MICROSOFT_SHMGR_DLL,
generated::fa_generated::FA_FILE_USERS_TEMP_DF01AC74D8BE15EE01_TMP,
generated::fa_generated::FA_FILE_USERS_TEMP_DF23BF45A473C42B56_TMP,
generated::fa_generated::FA_FILE_USERS_TEMP_DF8471938479DA49221_TMP,
generated::fa_generated::FA_FILE_USERS_TEMP_DFA0528CD81300F372_TMP,
generated::fa_generated::FA_FILE_KUBERNETES_ADMIN_CONF,
generated::fa_generated::FA_FILE_KUBERNETES_CONTROLLER_MANAGER_CONF,
generated::fa_generated::FA_FILE_KUBERNETES_KUBELET_CONF,
generated::fa_generated::FA_FILE_KUBERNETES_SCHEDULER_CONF,
generated::fa_generated::FA_FILE_SNAP_DB,
generated::fa_generated::FA_FILE_KUBELET_CONFIG_YAML,
generated::fa_generated::FA_FILE_KUBERNETES_KUBELET_CONF_2,
generated::fa_generated::FA_FILE_MANIFESTS_YAML,
generated::fa_generated::FA_CURRENTVERSION_PROFILELIST_PROFILESDIRECTORY,
generated::fa_generated::FA_CURRENTVERSION_PROFILELIST_ALLUSERSPROFILE,
generated::fa_generated::FA_FILE_ETC_ENTERPRISE_RELEASE,
generated::fa_generated::FA_FILE_ETC_LSB_RELEASE,
generated::fa_generated::FA_FILE_ETC_ORACLE_RELEASE,
generated::fa_generated::FA_FILE_ETC_REDHAT_RELEASE,
generated::fa_generated::FA_FILE_ETC_SYSTEM_RELEASE,
generated::fa_generated::FA_FILE_ETC_ANACRONTAB,
generated::fa_generated::FA_FILE_CRON_DAILY,
generated::fa_generated::FA_FILE_CRON_HOURLY,
generated::fa_generated::FA_FILE_CRON_MONTHLY,
generated::fa_generated::FA_FILE_CRON_WEEKLY,
generated::fa_generated::FA_FILE_ANACRON_CRON_DAILY,
generated::fa_generated::FA_FILE_ANACRON_CRON_HOURLY,
generated::fa_generated::FA_FILE_ANACRON_CRON_MONTHLY,
generated::fa_generated::FA_FILE_ANACRON_CRON_WEEKLY,
generated::fa_generated::FA_FILE_LOG_APTITUDE,
generated::fa_generated::FA_FILE_APT_SOURCES_LIST,
generated::fa_generated::FA_FILE_SOURCES_LIST_D_LIST,
generated::fa_generated::FA_FILE_APT_TRUSTED_GPG,
generated::fa_generated::FA_FILE_TRUSTED_GPG_D_GPG,
generated::fa_generated::FA_FILE_APT_TRUSTDB_GPG,
generated::fa_generated::FA_FILE_KEYRINGS_GPG,
generated::fa_generated::FA_FILE_ETC_CRON_ALLOW,
generated::fa_generated::FA_FILE_ETC_CRON_DENY,
generated::fa_generated::FA_FILE_ETC_AT_ALLOW,
generated::fa_generated::FA_FILE_ETC_AT_DENY,
generated::fa_generated::FA_FILE_LOG_DPKG_LOG,
generated::fa_generated::FA_FILE_APT_HISTORY_LOG,
generated::fa_generated::FA_FILE_APT_TERM_LOG,
generated::fa_generated::FA_FILE_DPKG_STATUS,
generated::fa_generated::FA_FILE_ETC_DEBIAN_VERSION,
generated::fa_generated::FA_FILE_ETC_RESOLV_CONF,
generated::fa_generated::FA_FILE_GNOME_SHELL_APPLICATION_STATE,
generated::fa_generated::FA_FILE_INFO_TRASHINFO,
generated::fa_generated::FA_FILE_FILES,
generated::fa_generated::FA_FILE_TRACKER,
generated::fa_generated::FA_FILE_SHARE_RECENTLY_USED_XBEL,
generated::fa_generated::FA_FILE_ETC_HOSTS_ALLOW,
generated::fa_generated::FA_FILE_ETC_HOSTS_DENY,
generated::fa_generated::FA_FILE_ETC_MODULES_CONF,
generated::fa_generated::FA_FILE_MODPROBE_D,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_LESSHST,
generated::fa_generated::FA_FILE_AT,
generated::fa_generated::FA_FILE_SPOOL,
generated::fa_generated::FA_FILE_ATSPOOL,
generated::fa_generated::FA_FILE_AUDIT,
generated::fa_generated::FA_FILE_LOG_AUTH,
generated::fa_generated::FA_FILE_LOG_SECURE,
generated::fa_generated::FA_FILE_ETC_CA_CERTIFICATES_CONF,
generated::fa_generated::FA_FILE_CERTS_CA_CERTIFICATES_CRT,
generated::fa_generated::FA_FILE_CA_CERTIFICATES,
generated::fa_generated::FA_FILE_CA_CERTIFICATES_2,
generated::fa_generated::FA_FILE_LOG_CRON_LOG,
generated::fa_generated::FA_FILE_ETC_CRONTAB,
generated::fa_generated::FA_FILE_CRON_D,
generated::fa_generated::FA_FILE_CRON,
generated::fa_generated::FA_FILE_LOG_DAEMON,
generated::fa_generated::FA_FILE_DHCP_DHCP_CONF,
generated::fa_generated::FA_FILE_ETC_CENTOS_RELEASE,
generated::fa_generated::FA_FILE_ETC_ROCKY_RELEASE,
generated::fa_generated::FA_FILE_ETC_SUSE_RELEASE,
generated::fa_generated::FA_FILE_TABLES_DSDT,
generated::fa_generated::FA_FILE_ETC_FSTAB,
generated::fa_generated::FA_FILE_GRUB_GRUB_CFG,
generated::fa_generated::FA_FILE_GRUB2_GRUB_CFG,
generated::fa_generated::FA_FILE_ETC_HOSTNAME,
generated::fa_generated::FA_FILE_IF_UP_D,
generated::fa_generated::FA_FILE_IF_DOWN_D,
generated::fa_generated::FA_FILE_BOOT_INITRAMFS,
generated::fa_generated::FA_FILE_BOOT_INITRD,
generated::fa_generated::FA_FILE_ETC_ISSUE,
generated::fa_generated::FA_FILE_ETC_ISSUE_NET,
generated::fa_generated::FA_FILE_ETC_KRB5_CONF,
generated::fa_generated::FA_FILE_LOG_KERN,
generated::fa_generated::FA_FILE_LOG_LASTLOG,
generated::fa_generated::FA_FILE_ETC_LD_SO_PRELOAD,
generated::fa_generated::FA_FILE_INIT_D,
generated::fa_generated::FA_FILE_ETC_INSSERV_CONF,
generated::fa_generated::FA_FILE_INSSERV_CONF_D,
generated::fa_generated::FA_FILE_ETC_LOCALTIME,
generated::fa_generated::FA_FILE_LOG_MESSAGES,
generated::fa_generated::FA_FILE_CONF_D_NAME_CONF,
generated::fa_generated::FA_FILE_NETWORKMANAGER_NETWORKMANAGER_CONF,
generated::fa_generated::FA_FILE_NETWORKMANAGER_SYSTEM_CONNECTIONS,
generated::fa_generated::FA_FILE_CONF_D_NAME_CONF_2,
generated::fa_generated::FA_FILE_CONF_D_NAME_CONF_3,
generated::fa_generated::FA_FILE_NETWORKMANAGER_NETWORKMANAGER_INTERN_CONF,
generated::fa_generated::FA_FILE_NETWORKMANAGER,
generated::fa_generated::FA_FILE_ETC_PASSWD_CACHE,
generated::fa_generated::FA_FILE_ETC_PAM_CONF,
generated::fa_generated::FA_FILE_ETC_PAM_D,
generated::fa_generated::FA_FILE_PAM_D_COMMON_PASSWORD,
generated::fa_generated::FA_FILE_PAM_D,
generated::fa_generated::FA_FILE_ETC_PASSWD,
generated::fa_generated::FA_FILE_ETC_RSYSLOG_CONF,
generated::fa_generated::FA_FILE_ETC_RSYSLOG_D,
generated::fa_generated::FA_FILE_RSYSLOG_D,
generated::fa_generated::FA_FILE_TABLES_SSDT,
generated::fa_generated::FA_FILE_SUDO_IO,
generated::fa_generated::FA_FILE_SYSCTL_D_CONF,
generated::fa_generated::FA_FILE_SYSCTL_D_CONF_2,
generated::fa_generated::FA_FILE_SYSCTL_D_CONF_3,
generated::fa_generated::FA_FILE_SYSCTL_D_CONF_4,
generated::fa_generated::FA_FILE_SYSCTL_D_CONF_5,
generated::fa_generated::FA_FILE_ETC_SYSCTL_CON,
generated::fa_generated::FA_FILE_SYSLOG_NG_SYSLOG_NG_CONF,
generated::fa_generated::FA_FILE_CONF_D_CONF,
generated::fa_generated::FA_FILE_SYSTEMD_JOURNALD_CONF,
generated::fa_generated::FA_FILE_JOURNAL,
generated::fa_generated::FA_FILE_JOURNAL_2,
generated::fa_generated::FA_FILE_ETC_OS_RELEASE,
generated::fa_generated::FA_FILE_LIB_OS_RELEASE,
generated::fa_generated::FA_FILE_SYSTEM_CONTROL_SERVICE,
generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_SERVICE,
generated::fa_generated::FA_FILE_SYSTEM_SERVICE,
generated::fa_generated::FA_FILE_USER_SERVICE,
generated::fa_generated::FA_FILE_SYSTEM_SERVICE_2,
generated::fa_generated::FA_FILE_USER_SERVICE_2,
generated::fa_generated::FA_FILE_GENERATOR_EARLY_SERVICE,
generated::fa_generated::FA_FILE_GENERATOR_LATE_SERVICE,
generated::fa_generated::FA_FILE_GENERATOR_SERVICE,
generated::fa_generated::FA_FILE_SYSTEM_CONTROL_SERVICE_2,
generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_SERVICE_2,
generated::fa_generated::FA_FILE_SYSTEM_SERVICE_3,
generated::fa_generated::FA_FILE_TRANSIENT_SERVICE,
generated::fa_generated::FA_FILE_USER_SERVICE_3,
generated::fa_generated::FA_FILE_GENERATOR_EARLY_SERVICE_2,
generated::fa_generated::FA_FILE_GENERATOR_LATE_SERVICE_2,
generated::fa_generated::FA_FILE_GENERATOR_SERVICE_2,
generated::fa_generated::FA_FILE_TRANSIENT_SERVICE_2,
generated::fa_generated::FA_FILE_USER_CONTROL_SERVICE,
generated::fa_generated::FA_FILE_USER_SERVICE_4,
generated::fa_generated::FA_FILE_SYSTEM_SERVICE_4,
generated::fa_generated::FA_FILE_USER_SERVICE_5,
generated::fa_generated::FA_FILE_USER_CONTROL_SERVICE_2,
generated::fa_generated::FA_FILE_USER_SERVICE_6,
generated::fa_generated::FA_FILE_USER_SERVICE_7,
generated::fa_generated::FA_FILE_SYSTEM_CONTROL_TIMER,
generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_TIMER,
generated::fa_generated::FA_FILE_SYSTEM_TIMER,
generated::fa_generated::FA_FILE_USER_TIMER,
generated::fa_generated::FA_FILE_SYSTEM_TIMER_2,
generated::fa_generated::FA_FILE_USER_TIMER_2,
generated::fa_generated::FA_FILE_GENERATOR_EARLY_TIMER,
generated::fa_generated::FA_FILE_GENERATOR_LATE_TIMER,
generated::fa_generated::FA_FILE_GENERATOR_TIMER,
generated::fa_generated::FA_FILE_SYSTEM_CONTROL_TIMER_2,
generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_TIMER_2,
generated::fa_generated::FA_FILE_SYSTEM_TIMER_3,
generated::fa_generated::FA_FILE_TRANSIENT_TIMER,
generated::fa_generated::FA_FILE_USER_TIMER_3,
generated::fa_generated::FA_FILE_GENERATOR_EARLY_TIMER_2,
generated::fa_generated::FA_FILE_GENERATOR_LATE_TIMER_2,
generated::fa_generated::FA_FILE_GENERATOR_TIMER_2,
generated::fa_generated::FA_FILE_TRANSIENT_TIMER_2,
generated::fa_generated::FA_FILE_USER_CONTROL_TIMER,
generated::fa_generated::FA_FILE_USER_TIMER_4,
generated::fa_generated::FA_FILE_SYSTEM_TIMER_4,
generated::fa_generated::FA_FILE_USER_TIMER_5,
generated::fa_generated::FA_FILE_USER_CONTROL_TIMER_2,
generated::fa_generated::FA_FILE_USER_TIMER_6,
generated::fa_generated::FA_FILE_USER_TIMER_7,
generated::fa_generated::FA_FILE_ETC_RC_LOCAL,
generated::fa_generated::FA_FILE_ETC_RC_D,
generated::fa_generated::FA_FILE_RC_D,
generated::fa_generated::FA_FILE_RC_D_2,
generated::fa_generated::FA_FILE_INIT_D_2,
generated::fa_generated::FA_FILE_ETC_TIMEZONE,
generated::fa_generated::FA_FILE_RULES_D,
generated::fa_generated::FA_FILE_RULES_D_2,
generated::fa_generated::FA_FILE_LOG_BTMP,
generated::fa_generated::FA_FILE_LOG_WTMP,
generated::fa_generated::FA_FILE_RUN_UTMP,
generated::fa_generated::FA_FILE_LOG_WTMP_2,
generated::fa_generated::FA_FILE_ETC_XINETD_CONF,
generated::fa_generated::FA_FILE_XINETD_D,
generated::fa_generated::FA_FILE_MLOCATE_MLOCATE_DB,
generated::fa_generated::FA_FILE_ETC_UPDATEDB_CONF,
generated::fa_generated::FA_FILE_ETC_NETGROUP,
generated::fa_generated::FA_FILE_ETC_NSSWITCH_CONF,
generated::fa_generated::FA_FILE_ETC_PASSWD_2,
generated::fa_generated::FA_FILE_ETC_SHADOW,
generated::fa_generated::FA_FILE_SECURITY_ACCESS_CONF,
generated::fa_generated::FA_FILE_ROOT_K5LOGIN,
generated::fa_generated::FA_FILE_MYSQL_HISTORY,
generated::fa_generated::FA_FILE_ROOT_MYSQL_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_MYSQL_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_NANO_HISTORY,
generated::fa_generated::FA_FILE_ETC_NETGROUP_2,
generated::fa_generated::FA_FILE_ETC_NTP_CONF,
generated::fa_generated::FA_FILE_VENDOR,
generated::fa_generated::FA_FILE_DEVICE,
generated::fa_generated::FA_FILE_CLASS,
generated::fa_generated::FA_FILE_CONFIG,
generated::fa_generated::FA_FILE_PSQL_HISTORY,
generated::fa_generated::FA_FILE_ROOT_PSQL_HISTORY,
generated::fa_generated::FA_FILE_POSTGRESQL_PSQL_HISTORY,
generated::fa_generated::FA_FILE_PGSQL_PSQL_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_PSQL_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_PYTHON_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_RHOSTS,
generated::fa_generated::FA_FILE_SAMBA_LOG,
generated::fa_generated::FA_FILE_SECRETS_SECRETS_LDB,
generated::fa_generated::FA_FILE_SECRETS_SECRETS_MKEY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_SQLITE_HISTORY,
generated::fa_generated::FA_FILE_SSH_AUTHORIZED_KEYS,
generated::fa_generated::FA_FILE_SSH_AUTHORIZED_KEYS2,
generated::fa_generated::FA_FILE_SSH_SSH_HOST_KEY_PUB,
generated::fa_generated::FA_FILE_SSH_KNOWN_HOSTS,
generated::fa_generated::FA_FILE_SSH_KNOWN_HOSTS_2,
generated::fa_generated::FA_FILE_THUMBNAILS_3,
generated::fa_generated::FA_FILE_DEFAULT_UFW,
generated::fa_generated::FA_FILE_UFW_SYSCTL_CONF,
generated::fa_generated::FA_FILE_UFW_RULES,
generated::fa_generated::FA_FILE_APPLICATIONS_D,
generated::fa_generated::FA_FILE_LOG_UFW_LOG,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_VIMINFO,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_WGET_HSTS,
generated::fa_generated::FA_FILE_AUTOSTART_DESKTOP,
generated::fa_generated::FA_FILE_AUTOSTART_DESKTOP_2,
generated::fa_generated::FA_FILE_ETC_YUM_CONF,
generated::fa_generated::FA_FILE_YUM_REPOS_D_REPO,
generated::fa_generated::FA_FILE_ZEITGEIST_ACTIVITY_SQLITE,
generated::fa_generated::FA_FILE_ZEITGEIST_ACTIVITY_SQLITE_WAL,
generated::fa_generated::FA_FILE_KERNEL_RANDOMIZE_VA_SPACE,
generated::fa_generated::FA_FILE_IPV4_ICMP_ECHO_IGNORE_BROADCASTS,
generated::fa_generated::FA_FILE_KERNEL_BOOTLOADER_TYPE,
generated::fa_generated::FA_FILE_KERNEL_BOOTLOADER_VERSION,
generated::fa_generated::FA_FILE_KERNEL_KEXEC_LOAD_DISABLED,
generated::fa_generated::FA_FILE_KERNEL_MODULES_DISABLED,
generated::fa_generated::FA_FILE_KERNEL_TAINTED,
generated::fa_generated::FA_FILE_FORWARDING,
generated::fa_generated::FA_FILE_MC_FORWARDING,
generated::fa_generated::FA_FILE_IPV4_IP_FORWARD,
generated::fa_generated::FA_FILE_ACCEPT_SOURCE_ROUTE,
generated::fa_generated::FA_FILE_RP_FILTER,
generated::fa_generated::FA_FILE_LOG_MARTIANS,
generated::fa_generated::FA_FILE_ACCEPT_REDIRECTS,
generated::fa_generated::FA_FILE_SECURE_REDIRECTS,
generated::fa_generated::FA_FILE_SEND_REDIRECTS,
generated::fa_generated::FA_FILE_NET_ARP,
generated::fa_generated::FA_FILE_PROC_MOUNTS,
generated::fa_generated::FA_FILE_KERNEL_DMESG_RESTRICT,
generated::fa_generated::FA_FILE_KERNEL_KPTR_RESTRICT,
generated::fa_generated::FA_FILE_FS_PROTECTED_HARDLINKS,
generated::fa_generated::FA_FILE_FS_PROTECTED_SYMLINKS,
generated::fa_generated::FA_FILE_FS_SUID_DUMPABLE,
generated::fa_generated::FA_FILE_IPV4_TCP_SYNCOOKIES,
generated::fa_generated::FA_FILE_LOGS_CONTROLLER_LOG,
generated::fa_generated::FA_FILE_LOGS_KAFKA_LOG,
generated::fa_generated::FA_FILE_LOGS_SERVER_LOG,
generated::fa_generated::FA_FILE_LOGS_STATE_CHANGE_LOG,
generated::fa_generated::FA_FILE_HAPROXY,
generated::fa_generated::FA_FILE_LOG_HAPROXY_LOG,
generated::fa_generated::FA_FILE_LOG_HAPROXY_TRAFFIC_LOG,
generated::fa_generated::FA_FILE_LOG_HAPROXY_ADMIN_LOG,
generated::fa_generated::FA_FILE_JENKINS_JENKINS_LOG,
generated::fa_generated::FA_FILE_OSQUERY_OSQUERYD_RESULTS_LOG,
generated::fa_generated::FA_FILE_OSQUERY_OSQUERYD_SNAPSHOTS_LOG,
generated::fa_generated::FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB,
generated::fa_generated::FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB_2,
generated::fa_generated::FA_FILE_SYSTEMCONFIGURATION_COM_APPLE_AIRPORT_PREFERENCES_PL,
generated::fa_generated::FA_FILE_APPLEPUSHSERVICE_APS_DB,
generated::fa_generated::FA_FILE_DB_APPLESETUPDONE,
generated::fa_generated::FA_FILE_DB_APPLESETUPDONE_2,
generated::fa_generated::FA_FILE_ASL_ASL,
generated::fa_generated::FA_FILE_DIAGNOSTICMESSAGES_ASL,
generated::fa_generated::FA_FILE_ASL_ASL_2,
generated::fa_generated::FA_FILE_DIAGNOSTICMESSAGES_ASL_2,
generated::fa_generated::FA_FILE_CACHE_DB,
generated::fa_generated::FA_FILE_LPROJ_STRINGS,
generated::fa_generated::FA_FILE_LPROJ_STRINGS_2,
generated::fa_generated::FA_FILE_COM_APPLE_ASSETCACHE_ASSETINFO_DB,
generated::fa_generated::FA_FILE_DB_AUTH_DB,
generated::fa_generated::FA_FILE_DB_AUTH_DB_2,
generated::fa_generated::FA_FILE_CALENDARS_CALENDAR_CACHE,
generated::fa_generated::FA_FILE_CALLHISTORYDB_CALLHISTORY_STOREDATA,
generated::fa_generated::FA_FILE_PREFERENCES_LSSHAREDFILELIST_PLIST,
generated::fa_generated::FA_FILE_JOBS,
generated::fa_generated::FA_FILE_AUDIT_0_9_0_9,
generated::fa_generated::FA_FILE_AUDIT_0_9_0_9_2,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_BLUETOOTH_PLIST,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_2,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_3,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_4,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_5,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_6,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_7,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_8,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_9,
generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_10,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_2,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_3,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_4,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_5,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_6,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_7,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_8,
generated::fa_generated::FA_FILE_KEXT_INFO_PLIST,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_9,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_10,
generated::fa_generated::FA_FILE_RESOURCES_INFO_PLIST,
generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_11,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_2,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_3,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_4,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_5,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_6,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_7,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_8,
generated::fa_generated::FA_FILE_KEXT_VERSION_PLIST,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_9,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_10,
generated::fa_generated::FA_FILE_RESOURCES_VERSION_PLIST,
generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_11,
generated::fa_generated::FA_FILE_DIAGNOSTICREPORTS_CORE_ANALYTICS,
generated::fa_generated::FA_FILE_AGGREGATES,
generated::fa_generated::FA_FILE_AGGREGATES_2,
generated::fa_generated::FA_FILE_ETC_CRONTAB_2,
generated::fa_generated::FA_FILE_TABS,
generated::fa_generated::FA_FILE_TABS_2,
generated::fa_generated::FA_FILE_TABS_3,
generated::fa_generated::FA_FILE_TABS_4,
generated::fa_generated::FA_FILE_TABS_5,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_DOCK_PLIST,
generated::fa_generated::FA_FILE_DEFAULT_SQLINDEX,
generated::fa_generated::FA_FILE_DEFAULT_SQLINDEX_2,
generated::fa_generated::FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB,
generated::fa_generated::FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB_2,
generated::fa_generated::FA_FILE_PEOPLE_INTERACTIONC_DB,
generated::fa_generated::FA_FILE_PEOPLE_INTERACTIONC_DB_2,
generated::fa_generated::FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB,
generated::fa_generated::FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_2,
generated::fa_generated::FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_3,
generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB,
generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB_2,
generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB_3,
generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB_4,
generated::fa_generated::FA_FILE_FSEVENTSD,
generated::fa_generated::FA_FILE_DATA_FSEVENTSD,
generated::fa_generated::FA_FILE_RESOURCES_GKOPAQUE_DB,
generated::fa_generated::FA_FILE_RESOURCES_GKOPAQUE_DB_2,
generated::fa_generated::FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST,
generated::fa_generated::FA_FILE_ACCOUNTS,
generated::fa_generated::FA_FILE_PREFERENCES_MOBILEMEACCOUNTS_PLIST,
generated::fa_generated::FA_FILE_IDENTITYSERVICES_IDS_DB,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_IPOD_PLIST,
generated::fa_generated::FA_FILE_RECEIPTS_INSTALLHISTORY_PLIST,
generated::fa_generated::FA_FILE_LOG_INSTALL_LOG,
generated::fa_generated::FA_FILE_LOG_INSTALL_LOG_2,
generated::fa_generated::FA_FILE_LPROJ_ITXIB,
generated::fa_generated::FA_FILE_INFO_PLIST,
generated::fa_generated::FA_FILE_MANIFEST_PLIST,
generated::fa_generated::FA_FILE_MANIFEST_MDBD,
generated::fa_generated::FA_FILE_BACKUP,
generated::fa_generated::FA_FILE_STATUS_PLIST,
generated::fa_generated::FA_FILE_EXTENSIONS,
generated::fa_generated::FA_FILE_EXTENSIONS_2,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_HITOOLBOX_PLIST,
generated::fa_generated::FA_FILE_LOG_LASTLOG_2,
generated::fa_generated::FA_FILE_LAUNCHAGENTS_PLIST,
generated::fa_generated::FA_FILE_LAUNCHAGENTS_PLIST_2,
generated::fa_generated::FA_FILE_LAUNCHAGENTS_PLIST_3,
generated::fa_generated::FA_FILE_LAUNCHDAEMONS_PLIST,
generated::fa_generated::FA_FILE_LAUNCHDAEMONS_PLIST_2,
generated::fa_generated::FA_FILE_LAUNCHDAEMONS_PLIST_3,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST,
generated::fa_generated::FA_FILE_PREFERENCES_LOGINWINDOW_PLIST,
generated::fa_generated::FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST,
generated::fa_generated::FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST_2,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_2,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_3,
generated::fa_generated::FA_FILE_MAILDATA_ACCOUNTS_PLIST,
generated::fa_generated::FA_FILE_MAILDATA_BACKUPTOC_PLIST,
generated::fa_generated::FA_FILE_MAILBOXES,
generated::fa_generated::FA_FILE_MAIL_DOWNLOADS,
generated::fa_generated::FA_FILE_MAILDATA_ENVELOPE_INDEX,
generated::fa_generated::FA_FILE_IMAP,
generated::fa_generated::FA_FILE_V_0_9,
generated::fa_generated::FA_FILE_MAILDATA_OPENEDATTACHMENTSV2_PLIST,
generated::fa_generated::FA_FILE_POP,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_MAIL_PLIST,
generated::fa_generated::FA_FILE_ADDRESSBOOK_MAILRECENTS_V4_ABCDMR,
generated::fa_generated::FA_FILE_SIGNATURES,
generated::fa_generated::FA_FILE_MESSAGES_CHAT_DB,
generated::fa_generated::FA_FILE_NETWORKD_NETUSAGE_SQLITE,
generated::fa_generated::FA_FILE_NETWORKD_NETUSAGE_SQLITE_2,
generated::fa_generated::FA_FILE_NOTES_NOTESV_STOREDATA,
generated::fa_generated::FA_FILE_NOTIFICATIONCENTER_DB,
generated::fa_generated::FA_FILE_DB_DB,
generated::fa_generated::FA_FILE_DB2_DB,
generated::fa_generated::FA_FILE_DB_DB_2,
generated::fa_generated::FA_FILE_DB2_DB_2,
generated::fa_generated::FA_FILE_DAILY_LOCAL,
generated::fa_generated::FA_FILE_DEFAULTS_PERIODIC_CONF,
generated::fa_generated::FA_FILE_MONTHLY_LOCAL,
generated::fa_generated::FA_FILE_PERIODIC_2,
generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF,
generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF_LOCAL,
generated::fa_generated::FA_FILE_DAILY,
generated::fa_generated::FA_FILE_MONTHLY,
generated::fa_generated::FA_FILE_WEEKLY,
generated::fa_generated::FA_FILE_WEEKLY_LOCAL,
generated::fa_generated::FA_FILE_DAILY_LOCAL_2,
generated::fa_generated::FA_FILE_DEFAULTS_PERIODIC_CONF_2,
generated::fa_generated::FA_FILE_MONTHLY_LOCAL_2,
generated::fa_generated::FA_FILE_PERIODIC_2_2,
generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF_2,
generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF_LOCAL_2,
generated::fa_generated::FA_FILE_DAILY_2,
generated::fa_generated::FA_FILE_MONTHLY_2,
generated::fa_generated::FA_FILE_WEEKLY_2,
generated::fa_generated::FA_FILE_WEEKLY_LOCAL_2,
generated::fa_generated::FA_FILE_PERIODIC_2_3,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT_2,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_RECENTITEMS_PLIST,
generated::fa_generated::FA_FILE_CLIENTCACHES,
generated::fa_generated::FA_FILE_RMDB_RMDB_SQLITE3,
generated::fa_generated::FA_FILE_CLIENTCACHES_2,
generated::fa_generated::FA_FILE_RMDB_RMDB_SQLITE3_2,
generated::fa_generated::FA_FILE_CACHES_APPUSAGE_PLIST,
generated::fa_generated::FA_FILE_CACHES_APPUSAGE_PLIST_2,
generated::fa_generated::FA_FILE_CACHES_USERACCT_TMP,
generated::fa_generated::FA_FILE_CACHES_USERACCT_TMP_2,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_2,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_3,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_4,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_5,
generated::fa_generated::FA_FILE_RESOURCES_INFOPLIST_STRINGS,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_6,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_7,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_8,
generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_9,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_2,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_3,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_4,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_5,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_6,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_7,
generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_8,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST_2,
generated::fa_generated::FA_FILE_ASSISTANT_SIRIANALYTICS_DB,
generated::fa_generated::FA_FILE_SUGGESTIONS_ENTITIES_DB,
generated::fa_generated::FA_FILE_SUGGESTIONS_ENTITIES_DB_WAL,
generated::fa_generated::FA_FILE_PENDING_QUEUE_DB,
generated::fa_generated::FA_FILE_PENDING_QUEUE_DB_WAL,
generated::fa_generated::FA_FILE_SUGGESTIONS_SNIPPETS_DB,
generated::fa_generated::FA_FILE_SUGGESTIONS_SNIPPETS_DB_WAL,
generated::fa_generated::FA_FILE_VM_SLEEPIMAGE,
generated::fa_generated::FA_FILE_VM_SLEEPIMAGE_2,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_SOFTWAREUPDATE_PLIST,
generated::fa_generated::FA_FILE_STORE_V1_VOLUMECONFIG_PLIST,
generated::fa_generated::FA_FILE_SPOTLIGHT_V100_VOLUMECONFIGURATION_PLIST,
generated::fa_generated::FA_FILE_PLIST,
generated::fa_generated::FA_FILE_PLIST_2,
generated::fa_generated::FA_FILE_VM_SWAPFILE_0_9,
generated::fa_generated::FA_FILE_VM_SWAPFILE_0_9_2,
generated::fa_generated::FA_FILE_SYSTEMCONFIGURATION_PREFERENCES_PLIST,
generated::fa_generated::FA_FILE_LOG_2,
generated::fa_generated::FA_FILE_DB_SYSTEMPOLICY,
generated::fa_generated::FA_FILE_DB_SYSTEMPOLICY_2,
generated::fa_generated::FA_FILE_PLIST_3,
generated::fa_generated::FA_FILE_CORESERVICES_SYSTEMVERSION_PLIST,
generated::fa_generated::FA_FILE_COM_APPLE_TCC_TCC_DB,
generated::fa_generated::FA_FILE_COM_APPLE_TCC_TCC_DB_2,
generated::fa_generated::FA_FILE_KEYBOARDSERVICES_TEXTREPLACEMENTS_DB,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_TIMEMACHINE_PLIST,
generated::fa_generated::FA_FILE_DIAGNOSTICS_TRACEV3,
generated::fa_generated::FA_FILE_TRACEV3,
generated::fa_generated::FA_FILE_DIAGNOSTICS_TRACEV3_2,
generated::fa_generated::FA_FILE_TRACEV3_2,
generated::fa_generated::FA_FILE_DOCK_DESKTOPPICTURE_DB,
generated::fa_generated::FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST_2,
generated::fa_generated::FA_FILE_KEYCHAINS_KEYCHAIN,
generated::fa_generated::FA_FILE_OCSPCACHE_SQLITE3,
generated::fa_generated::FA_FILE_USER_DB,
generated::fa_generated::FA_FILE_KEYCHAIN_2_DB,
generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINITEMS_PLIST,
generated::fa_generated::FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENTAGENT_BACKGROUNDIT,
generated::fa_generated::FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V,
generated::fa_generated::FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V_2,
generated::fa_generated::FA_FILE_USERS_PLIST,
generated::fa_generated::FA_FILE_USERS_PLIST_2,
generated::fa_generated::FA_FILE_PREFERENCES,
generated::fa_generated::FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE,
generated::fa_generated::FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE_WAL,
generated::fa_generated::FA_FILE_TRASH,
generated::fa_generated::FA_FILE_RUN_UTMPX,
generated::fa_generated::FA_FILE_RUN_UTMPX_2,
generated::fa_generated::FA_FILE_PASSES_PASSES23_SQLITE,
generated::fa_generated::FA_FILE_AWDD_PERSISTENT_DB,
generated::fa_generated::FA_FILE_AWDD_PERSISTENT_DB_2,
generated::fa_generated::FA_FILE_IOS_DEVICE_LOGS_IOS_DEVICE_LOGS_DB,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASH_LOGOUT,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASH_PROFILE,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASHRC,
generated::fa_generated::FA_FILE_ETC_BASH_BASHRC,
generated::fa_generated::FA_FILE_ETC_BASHRC,
generated::fa_generated::FA_FILE_ETC_BASH_BASHRC_2,
generated::fa_generated::FA_FILE_ETC_BASHRC_2,
generated::fa_generated::FA_FILE_BASH_LOGOUT,
generated::fa_generated::FA_FILE_BASH_PROFILE,
generated::fa_generated::FA_FILE_BASHRC,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASH_HISTORY,
generated::fa_generated::FA_FILE_BASH_HISTORY,
generated::fa_generated::FA_FILE_BASH_SESSIONS,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_SH_HISTORY,
generated::fa_generated::FA_FILE_SH_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_CSHRC,
generated::fa_generated::FA_FILE_ETC_CSH_CSHRC,
generated::fa_generated::FA_FILE_ETC_CSH_LOGIN,
generated::fa_generated::FA_FILE_ETC_CSH_LOGOUT,
generated::fa_generated::FA_FILE_ETC_CSH_CSHRC_2,
generated::fa_generated::FA_FILE_ETC_CSH_LOGIN_2,
generated::fa_generated::FA_FILE_ETC_CSH_LOGOUT_2,
generated::fa_generated::FA_FILE_CSHRC,
generated::fa_generated::FA_FILE_CONF_D_CONFIG_FISH,
generated::fa_generated::FA_FILE_CONF_D_FISH,
generated::fa_generated::FA_FILE_FISH_CONFIG_FISH,
generated::fa_generated::FA_FILE_FISH_CONFIG_FISH_2,
generated::fa_generated::FA_FILE_FISH_FISH_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_KSH,
generated::fa_generated::FA_FILE_ETC_KSHRC,
generated::fa_generated::FA_FILE_ETC_KSHRC_2,
generated::fa_generated::FA_FILE_KSH,
generated::fa_generated::FA_FILE_ROOT_BASH_LOGOUT,
generated::fa_generated::FA_FILE_ROOT_BASH_PROFILE,
generated::fa_generated::FA_FILE_ROOT_BASHRC,
generated::fa_generated::FA_FILE_ROOT_CSHRC,
generated::fa_generated::FA_FILE_ROOT_KSH,
generated::fa_generated::FA_FILE_FISH_CONFIG_FISH_3,
generated::fa_generated::FA_FILE_ROOT_LOGOUT,
generated::fa_generated::FA_FILE_ROOT_PROFILE,
generated::fa_generated::FA_FILE_ROOT_TCSH,
generated::fa_generated::FA_FILE_ROOT_ZLOGIN,
generated::fa_generated::FA_FILE_ROOT_ZLOGOUT,
generated::fa_generated::FA_FILE_ROOT_ZPROFILE,
generated::fa_generated::FA_FILE_ROOT_BASH_HISTORY,
generated::fa_generated::FA_FILE_FISH_FISH_HISTORY_2,
generated::fa_generated::FA_FILE_ROOT_SH_HISTORY,
generated::fa_generated::FA_FILE_ROOT_ZHISTORY,
generated::fa_generated::FA_FILE_ROOT_ZSH_HISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_LOGOUT,
generated::fa_generated::FA_FILE_LOGOUT,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_PROFILE,
generated::fa_generated::FA_FILE_ETC_PROFILE,
generated::fa_generated::FA_FILE_ETC_PROFILE_2,
generated::fa_generated::FA_FILE_PROFILE,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_TCSH,
generated::fa_generated::FA_FILE_TCSH,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZLOGIN,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZLOGOUT,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZPROFILE,
generated::fa_generated::FA_FILE_ETC_ZSHENV,
generated::fa_generated::FA_FILE_ETC_ZSHRC,
generated::fa_generated::FA_FILE_ZSH_ZLOGIN,
generated::fa_generated::FA_FILE_ZSH_ZLOGOUT,
generated::fa_generated::FA_FILE_ZSH_ZPROFILE,
generated::fa_generated::FA_FILE_ZSH_ZSHENV,
generated::fa_generated::FA_FILE_ZSH_ZSHRC,
generated::fa_generated::FA_FILE_ETC_ZSHENV_2,
generated::fa_generated::FA_FILE_ETC_ZSHRC_2,
generated::fa_generated::FA_FILE_ZSH_ZLOGIN_2,
generated::fa_generated::FA_FILE_ZSH_ZLOGOUT_2,
generated::fa_generated::FA_FILE_ZSH_ZPROFILE_2,
generated::fa_generated::FA_FILE_ZSH_ZSHENV_2,
generated::fa_generated::FA_FILE_ZSH_ZSHRC_2,
generated::fa_generated::FA_FILE_ZLOGIN,
generated::fa_generated::FA_FILE_ZLOGOUT,
generated::fa_generated::FA_FILE_ZPROFILE,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZHISTORY,
generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZSH_HISTORY,
generated::fa_generated::FA_FILE_ZHISTORY,
generated::fa_generated::FA_FILE_ZSH_HISTORY,
generated::fa_generated::FA_FILE_ACCESS_LOG,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG,
generated::fa_generated::FA_FILE_CATALINA_OUT,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT,
generated::fa_generated::FA_FILE_ACCESS_LOG_2,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_2,
generated::fa_generated::FA_FILE_CATALINA_OUT_2,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_2,
generated::fa_generated::FA_FILE_ACCESS_LOG_3,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_3,
generated::fa_generated::FA_FILE_CATALINA_OUT_3,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_3,
generated::fa_generated::FA_FILE_ACCESS_LOG_4,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_4,
generated::fa_generated::FA_FILE_CATALINA_OUT_4,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_4,
generated::fa_generated::FA_FILE_ACCESS_LOG_5,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_5,
generated::fa_generated::FA_FILE_CATALINA_OUT_5,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_5,
generated::fa_generated::FA_FILE_ACCESS_LOG_6,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_6,
generated::fa_generated::FA_FILE_CATALINA_OUT_6,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_6,
generated::fa_generated::FA_FILE_ACCESS_LOG_7,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_7,
generated::fa_generated::FA_FILE_CATALINA_OUT_7,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_7,
generated::fa_generated::FA_FILE_ACCESS_LOG_8,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_8,
generated::fa_generated::FA_FILE_CATALINA_OUT_8,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_8,
generated::fa_generated::FA_FILE_ACCESS_LOG_9,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_9,
generated::fa_generated::FA_FILE_CATALINA_OUT_9,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_9,
generated::fa_generated::FA_FILE_ACCESS_LOG_10,
generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_10,
generated::fa_generated::FA_FILE_CATALINA_OUT_10,
generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_10,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_2,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_3,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_4,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_5,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_6,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_7,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_8,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_9,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_10,
generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_11,
generated::fa_generated::FA_FILE_ETC_GROUP,
generated::fa_generated::FA_FILE_ETC_GROUP_2,
generated::fa_generated::FA_FILE_ETC_HOSTS,
generated::fa_generated::FA_FILE_ETC_HOSTS_2,
generated::fa_generated::FA_FILE_ETC_LOCALTIME_2,
generated::fa_generated::FA_FILE_ETC_SHADOW_2,
generated::fa_generated::FA_FILE_ETC_SHADOW_3,
generated::fa_generated::FA_FILE_ETC_SHADOW_4,
generated::fa_generated::FA_FILE_ETC_SUDOERS,
generated::fa_generated::FA_FILE_ETC_SUDOERS_2,
generated::fa_generated::FA_FILE_LOG_BTMP_2,
generated::fa_generated::FA_FILE_RUN_UTMP_2,
generated::fa_generated::FA_CHROME_EXTENSIONS_5,
generated::fa_generated::FA_CHROME_EXTENSIONS_5_2,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_2,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_3,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_4,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_5,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_6,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_7,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_8,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_9,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_10,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_11,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_12,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_13,
generated::fa_generated::FA_FILE_FILE_SYSTEM_5_14,
generated::fa_generated::FA_FILE_INDEXEDDB_5,
generated::fa_generated::FA_FILE_INDEXEDDB_5_2,
generated::fa_generated::FA_FILE_INDEXEDDB_5_3,
generated::fa_generated::FA_FILE_INDEXEDDB_5_4,
generated::fa_generated::FA_FILE_INDEXEDDB_5_5,
generated::fa_generated::FA_FILE_INDEXEDDB_5_6,
generated::fa_generated::FA_FILE_INDEXEDDB_5_7,
generated::fa_generated::FA_FILE_INDEXEDDB_5_8,
generated::fa_generated::FA_FILE_INDEXEDDB_5_9,
generated::fa_generated::FA_FILE_INDEXEDDB_5_10,
generated::fa_generated::FA_FILE_INDEXEDDB_5_11,
generated::fa_generated::FA_FILE_INDEXEDDB_5_12,
generated::fa_generated::FA_FILE_INDEXEDDB_5_13,
generated::fa_generated::FA_FILE_INDEXEDDB_5_14,
generated::fa_generated::FA_FILE_LOCAL_STORAGE,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_2,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_3,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_4,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_5,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_6,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_7,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_8,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_9,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_10,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_11,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_12,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_13,
generated::fa_generated::FA_FILE_LOCAL_STORAGE_14,
generated::fa_generated::FA_FILE_PLATFORM_NOTIFICATIONS,
generated::fa_generated::FA_FILE_PLATFORM_NOTIFICATIONS_2,
generated::fa_generated::FA_FILE_PLATFORM_NOTIFICATIONS_3,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES,
generated::fa_generated::FA_FILE_PREFERENCES_2,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_2,
generated::fa_generated::FA_FILE_PREFERENCES_3,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_3,
generated::fa_generated::FA_FILE_PREFERENCES_4,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_4,
generated::fa_generated::FA_FILE_PREFERENCES_5,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_5,
generated::fa_generated::FA_FILE_PREFERENCES_6,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_6,
generated::fa_generated::FA_FILE_PREFERENCES_7,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_7,
generated::fa_generated::FA_FILE_PREFERENCES_8,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_8,
generated::fa_generated::FA_FILE_PREFERENCES_9,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_9,
generated::fa_generated::FA_FILE_PREFERENCES_10,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_10,
generated::fa_generated::FA_FILE_PREFERENCES_11,
generated::fa_generated::FA_FILE_SECURE_PREFERENCES_11,
generated::fa_generated::FA_FILE_PREFERENCES_12,
generated::fa_generated::FA_FILE_SESSION_STORAGE,
generated::fa_generated::FA_FILE_SESSION_STORAGE_2,
generated::fa_generated::FA_FILE_SESSION_STORAGE_3,
generated::fa_generated::FA_FILE_SESSION_STORAGE_4,
generated::fa_generated::FA_FILE_SESSIONS_SESSION,
generated::fa_generated::FA_FILE_SESSIONS_TABS,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_2,
generated::fa_generated::FA_FILE_SESSIONS_TABS_2,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_3,
generated::fa_generated::FA_FILE_SESSIONS_TABS_3,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_4,
generated::fa_generated::FA_FILE_SESSIONS_TABS_4,
generated::fa_generated::FA_FILE_SESSION_STORAGE_5,
generated::fa_generated::FA_FILE_SESSION_STORAGE_6,
generated::fa_generated::FA_FILE_SESSION_STORAGE_7,
generated::fa_generated::FA_FILE_SESSION_STORAGE_8,
generated::fa_generated::FA_FILE_SESSION_STORAGE_9,
generated::fa_generated::FA_FILE_SESSION_STORAGE_10,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_5,
generated::fa_generated::FA_FILE_SESSIONS_TABS_5,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_6,
generated::fa_generated::FA_FILE_SESSIONS_TABS_6,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_7,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_8,
generated::fa_generated::FA_FILE_SESSIONS_TABS_7,
generated::fa_generated::FA_FILE_SESSIONS_TABS_8,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_9,
generated::fa_generated::FA_FILE_SESSIONS_TABS_9,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_10,
generated::fa_generated::FA_FILE_SESSIONS_TABS_10,
generated::fa_generated::FA_FILE_SESSION_STORAGE_11,
generated::fa_generated::FA_FILE_SESSION_STORAGE_12,
generated::fa_generated::FA_FILE_SESSION_STORAGE_13,
generated::fa_generated::FA_FILE_SESSION_STORAGE_14,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_11,
generated::fa_generated::FA_FILE_SESSIONS_TABS_11,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_12,
generated::fa_generated::FA_FILE_SESSIONS_TABS_12,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_13,
generated::fa_generated::FA_FILE_SESSIONS_TABS_13,
generated::fa_generated::FA_FILE_SESSIONS_SESSION_14,
generated::fa_generated::FA_FILE_SESSIONS_TABS_14,
generated::fa_generated::FA_FILE_CACHE_DATA,
generated::fa_generated::FA_FILE_GPUCACHE,
generated::fa_generated::FA_FILE_MEDIA_CACHE,
generated::fa_generated::FA_FILE_CACHE_DATA_2,
generated::fa_generated::FA_FILE_GPUCACHE_2,
generated::fa_generated::FA_FILE_MEDIA_CACHE_2,
generated::fa_generated::FA_FILE_CACHE_5,
generated::fa_generated::FA_FILE_CACHE_6,
generated::fa_generated::FA_FILE_CACHE_DATA_3,
generated::fa_generated::FA_FILE_GPUCACHE_3,
generated::fa_generated::FA_FILE_MEDIA_CACHE_3,
generated::fa_generated::FA_FILE_CACHE_7,
generated::fa_generated::FA_FILE_CACHE_8,
generated::fa_generated::FA_FILE_CACHE_DATA_4,
generated::fa_generated::FA_FILE_GPUCACHE_4,
generated::fa_generated::FA_FILE_MEDIA_CACHE_4,
generated::fa_generated::FA_FILE_CACHE_9,
generated::fa_generated::FA_FILE_CACHE_10,
generated::fa_generated::FA_FILE_CACHE_DATA_5,
generated::fa_generated::FA_FILE_GPUCACHE_5,
generated::fa_generated::FA_FILE_MEDIA_CACHE_5,
generated::fa_generated::FA_FILE_CACHE_11,
generated::fa_generated::FA_FILE_CACHE_12,
generated::fa_generated::FA_FILE_CACHE_DATA_6,
generated::fa_generated::FA_FILE_GPUCACHE_6,
generated::fa_generated::FA_FILE_MEDIA_CACHE_6,
generated::fa_generated::FA_FILE_CACHE_13,
generated::fa_generated::FA_FILE_CACHE_14,
generated::fa_generated::FA_FILE_CACHE_DATA_7,
generated::fa_generated::FA_FILE_GPUCACHE_7,
generated::fa_generated::FA_FILE_MEDIA_CACHE_7,
generated::fa_generated::FA_FILE_CACHE_15,
generated::fa_generated::FA_FILE_CACHE_16,
generated::fa_generated::FA_FILE_CACHE_DATA_8,
generated::fa_generated::FA_FILE_GPUCACHE_8,
generated::fa_generated::FA_FILE_MEDIA_CACHE_8,
generated::fa_generated::FA_FILE_CACHE_17,
generated::fa_generated::FA_FILE_CACHE_18,
generated::fa_generated::FA_FILE_CACHE_DATA_9,
generated::fa_generated::FA_FILE_GPUCACHE_9,
generated::fa_generated::FA_FILE_MEDIA_CACHE_9,
generated::fa_generated::FA_FILE_CACHE_DATA_10,
generated::fa_generated::FA_FILE_CACHE_19,
generated::fa_generated::FA_FILE_CACHE_20,
generated::fa_generated::FA_FILE_CACHE_DATA_11,
generated::fa_generated::FA_FILE_GPUCACHE_10,
generated::fa_generated::FA_FILE_MEDIA_CACHE_10,
generated::fa_generated::FA_FILE_CACHE_21,
generated::fa_generated::FA_FILE_CACHE_22,
generated::fa_generated::FA_FILE_CACHE_23,
generated::fa_generated::FA_FILE_CACHE_24,
generated::fa_generated::FA_FILE_APPLICATION_CACHE,
generated::fa_generated::FA_FILE_CACHE_25,
generated::fa_generated::FA_FILE_CACHE_26,
generated::fa_generated::FA_FILE_GPUCACHE_11,
generated::fa_generated::FA_FILE_MEDIA_CACHE_11,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_2,
generated::fa_generated::FA_FILE_CACHE_27,
generated::fa_generated::FA_FILE_CACHE_28,
generated::fa_generated::FA_FILE_CACHE_29,
generated::fa_generated::FA_FILE_GPUCACHE_12,
generated::fa_generated::FA_FILE_MEDIA_CACHE_12,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_2,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_3,
generated::fa_generated::FA_FILE_CACHE_30,
generated::fa_generated::FA_FILE_CACHE_31,
generated::fa_generated::FA_FILE_GPUCACHE_13,
generated::fa_generated::FA_FILE_MEDIA_CACHE_13,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_3,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_4,
generated::fa_generated::FA_FILE_CACHE_32,
generated::fa_generated::FA_FILE_CACHE_33,
generated::fa_generated::FA_FILE_CACHE_34,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_5,
generated::fa_generated::FA_FILE_CACHE_35,
generated::fa_generated::FA_FILE_CACHE_36,
generated::fa_generated::FA_FILE_CACHE_37,
generated::fa_generated::FA_FILE_GPUCACHE_14,
generated::fa_generated::FA_FILE_MEDIA_CACHE_14,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_4,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_6,
generated::fa_generated::FA_FILE_CACHE_38,
generated::fa_generated::FA_FILE_CACHE_39,
generated::fa_generated::FA_FILE_CACHE_40,
generated::fa_generated::FA_FILE_GPUCACHE_15,
generated::fa_generated::FA_FILE_MEDIA_CACHE_15,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_5,
generated::fa_generated::FA_FILE_GPUCACHE_16,
generated::fa_generated::FA_FILE_MEDIA_CACHE_16,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_6,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_7,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_8,
generated::fa_generated::FA_FILE_CACHE_41,
generated::fa_generated::FA_FILE_CACHE_42,
generated::fa_generated::FA_FILE_GPUCACHE_17,
generated::fa_generated::FA_FILE_MEDIA_CACHE_17,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_7,
generated::fa_generated::FA_FILE_CACHE_43,
generated::fa_generated::FA_FILE_CACHE_44,
generated::fa_generated::FA_FILE_GPUCACHE_18,
generated::fa_generated::FA_FILE_MEDIA_CACHE_18,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_8,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_9,
generated::fa_generated::FA_FILE_CACHE_45,
generated::fa_generated::FA_FILE_CACHE_46,
generated::fa_generated::FA_FILE_GPUCACHE_19,
generated::fa_generated::FA_FILE_MEDIA_CACHE_19,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_9,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_10,
generated::fa_generated::FA_FILE_CACHE_47,
generated::fa_generated::FA_FILE_CACHE_48,
generated::fa_generated::FA_FILE_GPUCACHE_20,
generated::fa_generated::FA_FILE_MEDIA_CACHE_20,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_10,
generated::fa_generated::FA_FILE_CACHE_49,
generated::fa_generated::FA_FILE_CACHE_50,
generated::fa_generated::FA_FILE_CACHE_51,
generated::fa_generated::FA_FILE_CACHE_52,
generated::fa_generated::FA_FILE_MEDIA_CACHE_21,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_11,
generated::fa_generated::FA_FILE_CACHE_53,
generated::fa_generated::FA_FILE_CACHE_54,
generated::fa_generated::FA_FILE_MEDIA_CACHE_22,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_12,
generated::fa_generated::FA_FILE_MEDIA_CACHE_23,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_13,
generated::fa_generated::FA_FILE_CACHE_DATA_12,
generated::fa_generated::FA_FILE_CACHE_DATA_13,
generated::fa_generated::FA_FILE_CACHE_55,
generated::fa_generated::FA_FILE_CACHE_56,
generated::fa_generated::FA_FILE_CACHE_DATA_14,
generated::fa_generated::FA_FILE_MEDIA_CACHE_24,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_14,
generated::fa_generated::FA_FILE_CACHE_57,
generated::fa_generated::FA_FILE_CACHE_58,
generated::fa_generated::FA_FILE_CACHE_DATA_15,
generated::fa_generated::FA_FILE_MEDIA_CACHE_25,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_15,
generated::fa_generated::FA_FILE_CACHE_59,
generated::fa_generated::FA_FILE_CACHE_60,
generated::fa_generated::FA_FILE_CACHE_DATA_16,
generated::fa_generated::FA_FILE_MEDIA_CACHE_26,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_16,
generated::fa_generated::FA_FILE_CACHE_61,
generated::fa_generated::FA_FILE_CACHE_62,
generated::fa_generated::FA_FILE_CACHE_DATA_17,
generated::fa_generated::FA_FILE_MEDIA_CACHE_27,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_17,
generated::fa_generated::FA_FILE_CACHE_DATA_18,
generated::fa_generated::FA_FILE_CACHE_DATA_19,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_11,
generated::fa_generated::FA_FILE_CACHE_63,
generated::fa_generated::FA_FILE_CACHE_64,
generated::fa_generated::FA_FILE_GPUCACHE_21,
generated::fa_generated::FA_FILE_MEDIA_CACHE_28,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_18,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_12,
generated::fa_generated::FA_FILE_CACHE_65,
generated::fa_generated::FA_FILE_CACHE_66,
generated::fa_generated::FA_FILE_CACHE_DATA_20,
generated::fa_generated::FA_FILE_GPUCACHE_22,
generated::fa_generated::FA_FILE_MEDIA_CACHE_29,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_19,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_13,
generated::fa_generated::FA_FILE_CACHE_67,
generated::fa_generated::FA_FILE_CACHE_68,
generated::fa_generated::FA_FILE_CACHE_DATA_21,
generated::fa_generated::FA_FILE_GPUCACHE_23,
generated::fa_generated::FA_FILE_MEDIA_CACHE_30,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_20,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_14,
generated::fa_generated::FA_FILE_CACHE_69,
generated::fa_generated::FA_FILE_CACHE_70,
generated::fa_generated::FA_FILE_CACHE_DATA_22,
generated::fa_generated::FA_FILE_GPUCACHE_24,
generated::fa_generated::FA_FILE_MEDIA_CACHE_31,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_21,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_15,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_16,
generated::fa_generated::FA_FILE_CACHE_71,
generated::fa_generated::FA_FILE_CACHE_72,
generated::fa_generated::FA_FILE_GPUCACHE_25,
generated::fa_generated::FA_FILE_MEDIA_CACHE_32,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_22,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_17,
generated::fa_generated::FA_FILE_CACHE_73,
generated::fa_generated::FA_FILE_CACHE_74,
generated::fa_generated::FA_FILE_GPUCACHE_26,
generated::fa_generated::FA_FILE_MEDIA_CACHE_33,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_23,
generated::fa_generated::FA_FILE_CACHE_75,
generated::fa_generated::FA_FILE_CACHE_76,
generated::fa_generated::FA_FILE_CACHE_DATA_23,
generated::fa_generated::FA_FILE_GPUCACHE_27,
generated::fa_generated::FA_FILE_MEDIA_CACHE_34,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_24,
generated::fa_generated::FA_FILE_GPUCACHE_28,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_18,
generated::fa_generated::FA_FILE_CACHE_77,
generated::fa_generated::FA_FILE_CACHE_78,
generated::fa_generated::FA_FILE_GPUCACHE_29,
generated::fa_generated::FA_FILE_GPUCACHE_30,
generated::fa_generated::FA_FILE_MEDIA_CACHE_35,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_25,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_19,
generated::fa_generated::FA_FILE_CACHE_79,
generated::fa_generated::FA_FILE_CACHE_80,
generated::fa_generated::FA_FILE_GPUCACHE_31,
generated::fa_generated::FA_FILE_MEDIA_CACHE_36,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_26,
generated::fa_generated::FA_FILE_APPLICATION_CACHE_20,
generated::fa_generated::FA_FILE_CACHE_81,
generated::fa_generated::FA_FILE_CACHE_82,
generated::fa_generated::FA_FILE_GPUCACHE_32,
generated::fa_generated::FA_FILE_MEDIA_CACHE_37,
generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_27,
generated::fa_generated::FA_FILE_NETWORK_COOKIES,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL,
generated::fa_generated::FA_FILE_COOKIES,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_2,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_2,
generated::fa_generated::FA_FILE_COOKIES_2,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_2,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_3,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_3,
generated::fa_generated::FA_FILE_COOKIES_3,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_3,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_4,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_4,
generated::fa_generated::FA_FILE_COOKIES_4,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_4,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_5,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_5,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_6,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_6,
generated::fa_generated::FA_FILE_COOKIES_5,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_5,
generated::fa_generated::FA_FILE_COOKIES_6,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_6,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_7,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_7,
generated::fa_generated::FA_FILE_COOKIES_7,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_7,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_8,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_8,
generated::fa_generated::FA_FILE_COOKIES_8,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_8,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_9,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_9,
generated::fa_generated::FA_FILE_COOKIES_9,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_9,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_10,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_10,
generated::fa_generated::FA_FILE_COOKIES_10,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_10,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_11,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_11,
generated::fa_generated::FA_FILE_COOKIES_11,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_11,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_12,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_12,
generated::fa_generated::FA_FILE_COOKIES_12,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_12,
generated::fa_generated::FA_FILE_OPERA_COOKIES,
generated::fa_generated::FA_FILE_OPERA_COOKIES_JOURNAL,
generated::fa_generated::FA_FILE_COOKIES_13,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_13,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_13,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_13,
generated::fa_generated::FA_FILE_COOKIES_14,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_14,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_14,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_14,
generated::fa_generated::FA_FILE_COOKIES_15,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_15,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_15,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_15,
generated::fa_generated::FA_FILE_COOKIES_16,
generated::fa_generated::FA_FILE_COOKIES_JOURNAL_16,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_16,
generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_16,
generated::fa_generated::FA_FILE_EXTENSIONS_10,
generated::fa_generated::FA_FILE_EXTENSIONS_10_2,
generated::fa_generated::FA_FILE_EXTENSIONS_10_3,
generated::fa_generated::FA_FILE_EXTENSIONS_10_4,
generated::fa_generated::FA_FILE_EXTENSIONS_10_5,
generated::fa_generated::FA_FILE_EXTENSIONS_10_6,
generated::fa_generated::FA_FILE_EXTENSIONS_10_7,
generated::fa_generated::FA_FILE_EXTENSIONS_10_8,
generated::fa_generated::FA_FILE_EXTENSIONS_10_9,
generated::fa_generated::FA_FILE_EXTENSIONS_10_10,
generated::fa_generated::FA_FILE_EXTENSIONS_10_11,
generated::fa_generated::FA_FILE_EXTENSIONS_10_12,
generated::fa_generated::FA_FILE_EXTENSIONS_10_13,
generated::fa_generated::FA_FILE_EXTENSIONS_10_14,
generated::fa_generated::FA_FILE_EXTENSIONS_10_15,
generated::fa_generated::FA_FILE_EXTENSIONS_10_16,
generated::fa_generated::FA_FILE_EXTENSIONS_10_17,
generated::fa_generated::FA_FILE_EXTENSIONS_10_18,
generated::fa_generated::FA_FILE_EXTENSIONS_10_19,
generated::fa_generated::FA_FILE_EXTENSIONS_10_20,
generated::fa_generated::FA_FILE_EXTENSIONS_10_21,
generated::fa_generated::FA_FILE_EXTENSIONS_10_22,
generated::fa_generated::FA_FILE_EXTENSIONS_10_23,
generated::fa_generated::FA_FILE_EXTENSIONS_10_24,
generated::fa_generated::FA_FILE_EXTENSIONS_10_25,
generated::fa_generated::FA_FILE_EXTENSIONS_10_26,
generated::fa_generated::FA_FILE_EXTENSIONS_10_27,
generated::fa_generated::FA_FILE_EXTENSIONS_10_28,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_2,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_3,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_4,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_5,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_6,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_7,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_8,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_9,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_10,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_11,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_12,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_13,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_14,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_15,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_16,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_17,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_18,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_19,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_20,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_21,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_22,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_23,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_24,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_25,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_26,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_27,
generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_28,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL,
generated::fa_generated::FA_FILE_FAVICONS,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_2,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_2,
generated::fa_generated::FA_FILE_FAVICONS_2,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_2,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_3,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_3,
generated::fa_generated::FA_FILE_FAVICONS_3,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_3,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_4,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_4,
generated::fa_generated::FA_FILE_FAVICONS_4,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_4,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_5,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_5,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_6,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_6,
generated::fa_generated::FA_FILE_FAVICONS_5,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_5,
generated::fa_generated::FA_FILE_FAVICONS_6,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_6,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_7,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_7,
generated::fa_generated::FA_FILE_FAVICONS_7,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_7,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_8,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_8,
generated::fa_generated::FA_FILE_FAVICONS_8,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_8,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_9,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_9,
generated::fa_generated::FA_FILE_FAVICONS_9,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_9,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_10,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_10,
generated::fa_generated::FA_FILE_FAVICONS_10,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_10,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_11,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_11,
generated::fa_generated::FA_FILE_FAVICONS_11,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_11,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_12,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_12,
generated::fa_generated::FA_FILE_FAVICONS_12,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_12,
generated::fa_generated::FA_FILE_OPERA_FAVICONS,
generated::fa_generated::FA_FILE_OPERA_FAVICONS_JOURNAL,
generated::fa_generated::FA_FILE_FAVICONS_13,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_13,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_13,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_13,
generated::fa_generated::FA_FILE_FAVICONS_14,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_14,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_14,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_14,
generated::fa_generated::FA_FILE_FAVICONS_15,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_15,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_15,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_15,
generated::fa_generated::FA_FILE_FAVICONS_16,
generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_16,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_16,
generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_16,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL,
generated::fa_generated::FA_FILE_HISTORY,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_2,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_2,
generated::fa_generated::FA_FILE_HISTORY_2,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_2,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_3,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_3,
generated::fa_generated::FA_FILE_HISTORY_3,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_3,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_4,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_4,
generated::fa_generated::FA_FILE_HISTORY_4,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_4,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_5,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_5,
generated::fa_generated::FA_FILE_HISTORY_5,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_5,
generated::fa_generated::FA_FILE_HISTORY_6,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_6,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_6,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_6,
generated::fa_generated::FA_FILE_HISTORY_7,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_7,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_7,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_7,
generated::fa_generated::FA_FILE_HISTORY_8,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_8,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_8,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_8,
generated::fa_generated::FA_FILE_HISTORY_9,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_9,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_9,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_9,
generated::fa_generated::FA_FILE_HISTORY_10,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_10,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_10,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_10,
generated::fa_generated::FA_FILE_HISTORY_11,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_11,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_11,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_11,
generated::fa_generated::FA_FILE_HISTORY_12,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_12,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_12,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_12,
generated::fa_generated::FA_FILE_HISTORY_13,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_13,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_13,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_13,
generated::fa_generated::FA_FILE_HISTORY_14,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_14,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_14,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_14,
generated::fa_generated::FA_FILE_HISTORY_15,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_15,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_15,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_15,
generated::fa_generated::FA_FILE_HISTORY_16,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_16,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_16,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_16,
generated::fa_generated::FA_FILE_HISTORY_17,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_17,
generated::fa_generated::FA_FILE_HISTORY_18,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_18,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_17,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_17,
generated::fa_generated::FA_FILE_HISTORY_19,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_19,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_18,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_18,
generated::fa_generated::FA_FILE_HISTORY_20,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_20,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_19,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_19,
generated::fa_generated::FA_FILE_HISTORY_21,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_21,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_20,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_20,
generated::fa_generated::FA_FILE_HISTORY_22,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_22,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_21,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_21,
generated::fa_generated::FA_FILE_HISTORY_23,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_23,
generated::fa_generated::FA_FILE_HISTORY_24,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_24,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_22,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_22,
generated::fa_generated::FA_FILE_HISTORY_25,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_25,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_23,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_23,
generated::fa_generated::FA_FILE_HISTORY_26,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_26,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_24,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_24,
generated::fa_generated::FA_FILE_HISTORY_27,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_27,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_25,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_25,
generated::fa_generated::FA_FILE_HISTORY_28,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_28,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_26,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_26,
generated::fa_generated::FA_FILE_HISTORY_29,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_29,
generated::fa_generated::FA_FILE_HISTORY_30,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_30,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_27,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_27,
generated::fa_generated::FA_FILE_HISTORY_31,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_31,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_28,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_28,
generated::fa_generated::FA_FILE_HISTORY_32,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_32,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_29,
generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_29,
generated::fa_generated::FA_FILE_HISTORY_33,
generated::fa_generated::FA_FILE_HISTORY_JOURNAL_33,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL,
generated::fa_generated::FA_FILE_LOGIN_DATA,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_2,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_2,
generated::fa_generated::FA_FILE_LOGIN_DATA_2,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_2,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_3,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_3,
generated::fa_generated::FA_FILE_LOGIN_DATA_3,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_3,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_4,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_4,
generated::fa_generated::FA_FILE_LOGIN_DATA_4,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_4,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_5,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_5,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_6,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_6,
generated::fa_generated::FA_FILE_LOGIN_DATA_5,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_5,
generated::fa_generated::FA_FILE_LOGIN_DATA_6,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_6,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_7,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_7,
generated::fa_generated::FA_FILE_LOGIN_DATA_7,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_7,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_8,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_8,
generated::fa_generated::FA_FILE_LOGIN_DATA_8,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_8,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_9,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_9,
generated::fa_generated::FA_FILE_LOGIN_DATA_9,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_9,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_10,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_10,
generated::fa_generated::FA_FILE_LOGIN_DATA_10,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_10,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_11,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_11,
generated::fa_generated::FA_FILE_LOGIN_DATA_11,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_11,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_12,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_12,
generated::fa_generated::FA_FILE_LOGIN_DATA_12,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_12,
generated::fa_generated::FA_FILE_OPERA_LOGIN_DATA,
generated::fa_generated::FA_FILE_OPERA_LOGIN_DATA_JOURNAL,
generated::fa_generated::FA_FILE_LOGIN_DATA_13,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_13,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_13,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_13,
generated::fa_generated::FA_FILE_LOGIN_DATA_14,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_14,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_14,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_14,
generated::fa_generated::FA_FILE_LOGIN_DATA_15,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_15,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_15,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_15,
generated::fa_generated::FA_FILE_LOGIN_DATA_16,
generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_16,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_16,
generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_16,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL,
generated::fa_generated::FA_FILE_WEB_DATA,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_2,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_2,
generated::fa_generated::FA_FILE_WEB_DATA_2,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_2,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_3,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_3,
generated::fa_generated::FA_FILE_WEB_DATA_3,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_3,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_4,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_4,
generated::fa_generated::FA_FILE_WEB_DATA_4,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_4,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_5,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_5,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_6,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_6,
generated::fa_generated::FA_FILE_WEB_DATA_5,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_5,
generated::fa_generated::FA_FILE_WEB_DATA_6,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_6,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_7,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_7,
generated::fa_generated::FA_FILE_WEB_DATA_7,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_7,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_8,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_8,
generated::fa_generated::FA_FILE_WEB_DATA_8,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_8,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_9,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_9,
generated::fa_generated::FA_FILE_WEB_DATA_9,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_9,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_10,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_10,
generated::fa_generated::FA_FILE_WEB_DATA_10,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_10,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_11,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_11,
generated::fa_generated::FA_FILE_WEB_DATA_11,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_11,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_12,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_12,
generated::fa_generated::FA_FILE_WEB_DATA_12,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_12,
generated::fa_generated::FA_FILE_OPERA_WEB_DATA,
generated::fa_generated::FA_FILE_OPERA_WEB_DATA_JOURNAL,
generated::fa_generated::FA_FILE_WEB_DATA_13,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_13,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_13,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_13,
generated::fa_generated::FA_FILE_WEB_DATA_14,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_14,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_14,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_14,
generated::fa_generated::FA_FILE_WEB_DATA_15,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_15,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_15,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_15,
generated::fa_generated::FA_FILE_WEB_DATA_16,
generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_16,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_16,
generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_16,
generated::fa_generated::FA_FILE_CACHE_83,
generated::fa_generated::FA_FILE_CACHE2,
generated::fa_generated::FA_FILE_DOOMED,
generated::fa_generated::FA_FILE_ENTRIES,
generated::fa_generated::FA_FILE_CACHE_84,
generated::fa_generated::FA_FILE_CACHE2_2,
generated::fa_generated::FA_FILE_DOOMED_2,
generated::fa_generated::FA_FILE_ENTRIES_2,
generated::fa_generated::FA_FILE_CACHE_85,
generated::fa_generated::FA_FILE_CACHE_86,
generated::fa_generated::FA_FILE_CACHE2_3,
generated::fa_generated::FA_FILE_DOOMED_3,
generated::fa_generated::FA_FILE_ENTRIES_3,
generated::fa_generated::FA_FILE_CACHE_87,
generated::fa_generated::FA_FILE_CACHE2_4,
generated::fa_generated::FA_FILE_DOOMED_4,
generated::fa_generated::FA_FILE_ENTRIES_4,
generated::fa_generated::FA_FILE_CACHE_88,
generated::fa_generated::FA_FILE_CACHE2_5,
generated::fa_generated::FA_FILE_DOOMED_5,
generated::fa_generated::FA_FILE_ENTRIES_5,
generated::fa_generated::FA_FILE_CACHE_89,
generated::fa_generated::FA_FILE_CACHE2_6,
generated::fa_generated::FA_FILE_DOOMED_6,
generated::fa_generated::FA_FILE_ENTRIES_6,
generated::fa_generated::FA_FILE_CACHE_90,
generated::fa_generated::FA_FILE_CACHE2_7,
generated::fa_generated::FA_FILE_DOOMED_7,
generated::fa_generated::FA_FILE_ENTRIES_7,
generated::fa_generated::FA_FILE_CACHE_91,
generated::fa_generated::FA_FILE_CACHE2_8,
generated::fa_generated::FA_FILE_DOOMED_8,
generated::fa_generated::FA_FILE_ENTRIES_8,
generated::fa_generated::FA_FILE_COOKIES_SQLITE,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_2,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_SHM,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL_2,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_3,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL_3,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_4,
generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL_4,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_2,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL_2,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_3,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL_3,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_4,
generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL_4,
generated::fa_generated::FA_FILE_PLACES_SQLITE,
generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL,
generated::fa_generated::FA_FILE_PLACES_SQLITE_2,
generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_2,
generated::fa_generated::FA_FILE_PLACES_SQLITE_3,
generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_3,
generated::fa_generated::FA_FILE_PLACES_SQLITE_4,
generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_4,
generated::fa_generated::FA_FILE_PLACES_SQLITE_5,
generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_5,
generated::fa_generated::FA_FILE_ADDONS_JSON,
generated::fa_generated::FA_FILE_EXTENSIONS_JSON,
generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON,
generated::fa_generated::FA_FILE_ADDONS_JSON_2,
generated::fa_generated::FA_FILE_EXTENSIONS_JSON_2,
generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON_2,
generated::fa_generated::FA_FILE_ADDONS_JSON_3,
generated::fa_generated::FA_FILE_EXTENSIONS_JSON_3,
generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON_3,
generated::fa_generated::FA_FILE_ADDONS_JSON_4,
generated::fa_generated::FA_FILE_EXTENSIONS_JSON_4,
generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON_4,
generated::fa_generated::FA_EXPLORER_BROWSER_HELPER_OBJECTS,
generated::fa_generated::FA_EXPLORER_BROWSER_HELPER_OBJECTS_2,
generated::fa_generated::FA_FILE_COOKIES_INDEX_DAT,
generated::fa_generated::FA_FILE_LOW_INDEX_DAT,
generated::fa_generated::FA_FILE_WEBCACHE_WEBCACHEV_DAT,
generated::fa_generated::FA_FILE_IEDOWNLOADHISTORY_INDEX_DAT,
generated::fa_generated::FA_FILE_FEEDS_CACHE_INDEX_DAT,
generated::fa_generated::FA_FILE_INDEX_DAT,
generated::fa_generated::FA_FILE_HISTORY_IE5_INDEX_DAT,
generated::fa_generated::FA_FILE_INDEX_DAT_2,
generated::fa_generated::FA_FILE_HISTORY_IE5_INDEX_DAT_2,
generated::fa_generated::FA_FILE_CONTENT_IE5_INDEX_DAT,
generated::fa_generated::FA_FILE_CONTENT_IE5_INDEX_DAT_2,
generated::fa_generated::FA_FILE_HISTORY_IE5_INDEX_DAT_3,
generated::fa_generated::FA_INTERNET_EXPLORER_MAIN_NOPROTECTEDMODEBANNER,
generated::fa_generated::FA_INTERNET_EXPLORER_TYPEDURLS,
generated::fa_generated::FA_FILE_OPERA_GLOBAL_HISTORY_DAT,
generated::fa_generated::FA_FILE_OPERA_GLOBAL_HISTORY_DAT_2,
generated::fa_generated::FA_FILE_OPERA_GLOBAL_HISTORY_DAT_3,
generated::fa_generated::FA_FILE_OPERA_STABLE_HISTORY,
generated::fa_generated::FA_FILE_OPERA_STABLE_HISTORY_JOURNAL,
generated::fa_generated::FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB,
generated::fa_generated::FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB_WAL,
generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB,
generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL,
generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB_2,
generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL_2,
generated::fa_generated::FA_FILE_SAFARI_CACHE_DB,
generated::fa_generated::FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB,
generated::fa_generated::FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB_WAL,
generated::fa_generated::FA_FILE_COOKIES_COOKIES_BINARYCOOKIES,
generated::fa_generated::FA_FILE_COOKIES_COOKIES_BINARYCOOKIES_2,
generated::fa_generated::FA_FILE_SAFARI_DOWNLOADS_PLIST,
generated::fa_generated::FA_FILE_SAFARI_DOWNLOADS_PLIST_2,
generated::fa_generated::FA_FILE_SAFARI_DOWNLOADS_PLIST_3,
generated::fa_generated::FA_FILE_FAVICON_CACHE_FAVICONS_DB,
generated::fa_generated::FA_FILE_FAVICON_CACHE_FAVICONS_DB_WAL,
generated::fa_generated::FA_FILE_SAFARI_HISTORY_PLIST,
generated::fa_generated::FA_FILE_SAFARI_HISTORY_PLIST_2,
generated::fa_generated::FA_FILE_SAFARI_HISTORY_PLIST_3,
generated::fa_generated::FA_FILE_SAFARI_HISTORY_DB,
generated::fa_generated::FA_FILE_SAFARI_HISTORY_DB_WAL,
generated::fa_generated::FA_FILE_SAFARI_PERSITEPREFERENCES_DB,
generated::fa_generated::FA_FILE_SAFARI_PERSITEPREFERENCES_DB_WAL,
generated::fa_generated::FA_FILE_TABSNAPSHOTS_METADATA_DB,
generated::fa_generated::FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB,
generated::fa_generated::FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB_WAL,
generated::fa_generated::FA_FILE_DATABASE_DATABASE_SQLITE3,
generated::fa_generated::FA_FILE_APACHE_ACCESS_LOG,
generated::fa_generated::FA_FILE_APACHE_ACCESS_LOG_2,
generated::fa_generated::FA_FILE_APACHE2_ACCESS_LOG,
generated::fa_generated::FA_FILE_APACHE2_ACCESS_LOG_2,
generated::fa_generated::FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG,
generated::fa_generated::FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG_2,
generated::fa_generated::FA_FILE_HTTPD_ACCESS_LOG,
generated::fa_generated::FA_FILE_HTTPD_ACCESS_LOG_2,
generated::fa_generated::FA_FILE_APACHE2_CONF,
generated::fa_generated::FA_FILE_HTTPD_CONF,
generated::fa_generated::FA_FILE_CONF_MODULES_D_CONF,
generated::fa_generated::FA_FILE_SITES_AVAILABLE_000_DEFAULT_CONF,
generated::fa_generated::FA_FILE_APACHE_ERROR,
generated::fa_generated::FA_FILE_APACHE_ERROR_LOG,
generated::fa_generated::FA_FILE_APACHE2_ERROR,
generated::fa_generated::FA_FILE_APACHE2_ERROR_LOG,
generated::fa_generated::FA_FILE_HTTPD_ERROR,
generated::fa_generated::FA_FILE_HTTPD_ERROR_LOG,
generated::fa_generated::FA_FILE_LOGS_ERROR_LOG,
generated::fa_generated::FA_FILE_NGINX_ACCESS_LOG,
generated::fa_generated::FA_FILE_NGINX_ERROR_LOG,
generated::fa_generated::FA_FILE_WP_CONFIG_PHP,
generated::fa_generated::FA_FILE_WWW_WP_CONFIG_PHP,
generated::fa_generated::FA_FILE_WP_CONFIG_PHP_2,
generated::fa_generated::FA_FILE_WWW_WP_CONFIG_PHP_2,
generated::fa_generated::FA_FILE_WP_WP_CONFIG_PHP,
generated::fa_generated::FA_FILE_LOGFILES_LOG,
generated::fa_generated::FA_FILE_W3SVC_LOG,
generated::fa_generated::FA_FILE_W3SVC_LOG_2,
generated::fa_generated::FA_FILE_W3SVC_LOG_3,
generated::fa_generated::FA_DESKTOP_COMPONENTS,
generated::fa_generated::FA_INTERNET_EXPLORER_DESKTOP_GENERAL,
generated::fa_generated::FA_FILE_NTDS_NTDS_DIT,
generated::fa_generated::FA_FILE_NTDS_DIT,
generated::fa_generated::FA_FILE_NTDS_DIT_2,
generated::fa_generated::FA_FILE_SYSTEM32_NTDS_DIT,
generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT,
generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT,
generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT_2,
generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT_2,
generated::fa_generated::FA_FILE_L_USERS_USERNAME_ACTIVITIESCACHE_DB,
generated::fa_generated::FA_FILE_PROGRAMS_AMCACHE_HVE,
generated::fa_generated::FA_FILE_PROGRAMS_AMCACHE_HVE_LOG1,
generated::fa_generated::FA_FILE_PROGRAMS_AMCACHE_HVE_LOG2,
generated::fa_generated::FA_CONTROL_SESSION_MANAGER_APPCERTDLLS,
generated::fa_generated::FA_CURRENTVERSION_APP_PATHS,
generated::fa_generated::FA_CURRENTVERSION_APP_PATHS_2,
generated::fa_generated::FA_FILE_APPPATCH_DRVMAIN_SDB,
generated::fa_generated::FA_FILE_APPPATCH_FRXMAIN_SDB,
generated::fa_generated::FA_FILE_APPPATCH_MSIMAIN_SDB,
generated::fa_generated::FA_FILE_APPPATCH_PCAMAIN_SDB,
generated::fa_generated::FA_FILE_APPPATCH_SYSMAIN_SDB,
generated::fa_generated::FA_FILE_CUSTOM,
generated::fa_generated::FA_FILE_CUSTOM_2,
generated::fa_generated::FA_FILE_CUSTOM64,
generated::fa_generated::FA_FILE_CUSTOMSDB,
generated::fa_generated::FA_FILE_SYSTEM32_WINAPPXRT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_WINAPPXRT_DLL,
generated::fa_generated::FA_FILE_WBEM_WINAPPXRT_DLL,
generated::fa_generated::FA_FILE_V1_0_WINAPPXRT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_AUTOEXEC_BAT,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AUTOEXEC_NT,
generated::fa_generated::FA_CURRENTVERSION_AUTOEXCLUSIONLIST,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_AUTORUN_INF,
generated::fa_generated::FA_CURRENTVERSION_TIME_ZONES,
generated::fa_generated::FA_BAM_USERSETTINGS,
generated::fa_generated::FA_STATE_USERSETTINGS,
generated::fa_generated::FA_DAM_USERSETTINGS,
generated::fa_generated::FA_STATE_USERSETTINGS_2,
generated::fa_generated::FA_FILE_DOWNLOADER_QMGR_DAT,
generated::fa_generated::FA_FILE_DOWNLOADER_QMGR_DB,
generated::fa_generated::FA_FILE_BOOT_BCD,
generated::fa_generated::FA_FILE_BOOT_BCD_LOG,
generated::fa_generated::FA_FILE_BOOT_BCD_LOG1,
generated::fa_generated::FA_FILE_BOOT_BCD_LOG2,
generated::fa_generated::FA_FILE_BOOT_BCD_2,
generated::fa_generated::FA_FILE_BOOT_BCD_LOG_2,
generated::fa_generated::FA_FILE_BOOT_BCD_LOG1_2,
generated::fa_generated::FA_FILE_BOOT_BCD_LOG2_2,
generated::fa_generated::FA_FILE_RECOVERY_BCD,
generated::fa_generated::FA_FILE_RECOVERY_BCD_LOG,
generated::fa_generated::FA_FILE_RECOVERY_BCD_LOG1,
generated::fa_generated::FA_FILE_RECOVERY_BCD_LOG2,
generated::fa_generated::FA_FILE_REPOSITORY_CIM_REP,
generated::fa_generated::FA_FILE_REPOSITORY_CIM_REC,
generated::fa_generated::FA_FILE_REPOSITORY_CIM_REP_2,
generated::fa_generated::FA_FILE_REPOSITORY_INDEX_BTR,
generated::fa_generated::FA_FILE_REPOSITORY_INDEX_MAP,
generated::fa_generated::FA_FILE_REPOSITORY_MAPPING_VER,
generated::fa_generated::FA_FILE_REPOSITORY_MAPPING_1_3_MAP,
generated::fa_generated::FA_FILE_REPOSITORY_OBJECTS_DATA,
generated::fa_generated::FA_FILE_REPOSITORY_OBJECTS_MAP,
generated::fa_generated::FA_FILE_FS_INDEX_BTR,
generated::fa_generated::FA_FILE_FS_INDEX_MAP,
generated::fa_generated::FA_FILE_FS_MAPPING_VER,
generated::fa_generated::FA_FILE_FS_MAPPING_1_2_MAP,
generated::fa_generated::FA_FILE_FS_OBJECTS_DATA,
generated::fa_generated::FA_FILE_FS_OBJECTS_MAP,
generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_INDEX_BTR,
generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_INDEX_MAP,
generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_MAPPING_VER,
generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_MAPPING_1_3_MAP,
generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_OBJECTS_DATA,
generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_OBJECTS_MAP,
generated::fa_generated::FA_FILE_FS_INDEX_BTR_2,
generated::fa_generated::FA_FILE_FS_INDEX_MAP_2,
generated::fa_generated::FA_FILE_FS_MAPPING_VER_2,
generated::fa_generated::FA_FILE_FS_MAPPING_1_2_MAP_2,
generated::fa_generated::FA_FILE_FS_OBJECTS_DATA_2,
generated::fa_generated::FA_FILE_FS_OBJECTS_MAP_2,
generated::fa_generated::FA_FILE_INTERNET_EXPLORER_SXS_DLL,
generated::fa_generated::FA_FILE_INTERNET_EXPLORER_SXS_DLL_2,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_EXPLORER_EXE,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_PROGRAM_EXE,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_LINKINFO_DLL,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_NTSHRUI_DLL,
generated::fa_generated::FA_FILE_SYSTEM32_OCI_DLL,
generated::fa_generated::FA_FILE_SYSPREP_CRYPTBASE_DLL,
generated::fa_generated::FA_FILE_SYSWOW64_OCI_DLL,
generated::fa_generated::FA_FILE_SYSPREP_CRYPTBASE_DLL_2,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_CONFIG_SYS,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CONFIG_NT,
generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS,
generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS_2,
generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS_3,
generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS_4,
generated::fa_generated::FA_FILE_INDEXED_DB_INDEXEDDB_EDB,
generated::fa_generated::FA_FILE_ESEDATABASE_CORTANACOREINSTANCE_CORTANACOREDB_DAT,
generated::fa_generated::FA_FILE_WER,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_DMP,
generated::fa_generated::FA_FILE_MINIDUMP_DMP,
generated::fa_generated::FA_FILE_CRASHDUMPS,
generated::fa_generated::FA_FILE_TEMP_DMP,
generated::fa_generated::FA_FILE_CRASHDUMPS_2,
generated::fa_generated::FA_FILE_TEMP_DMP_2,
generated::fa_generated::FA_FILE_TEMP_DMP_3,
generated::fa_generated::FA_FILE_CRASHDUMPS_3,
generated::fa_generated::FA_FILE_WER_2,
generated::fa_generated::FA_FILE_TEMP_DMP_4,
generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS,
generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS_2,
generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDERS,
generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDERS_2,
generated::fa_generated::FA_FILE_METADATA,
generated::fa_generated::FA_FILE_METADATA_2,
generated::fa_generated::FA_FILE_METADATA_3,
generated::fa_generated::FA_FILE_CONTENT,
generated::fa_generated::FA_FILE_CONTENT_2,
generated::fa_generated::FA_FILE_CONTENT_3,
generated::fa_generated::FA_DISALLOWED_CERTIFICATES,
generated::fa_generated::FA_DISALLOWED_CERTIFICATES_2,
generated::fa_generated::FA_DISALLOWED_CERTIFICATES_3,
generated::fa_generated::FA_DISALLOWED_CERTIFICATES_4,
generated::fa_generated::FA_FILE_CONFIG_APPEVENT_EVT,
generated::fa_generated::FA_WINEVT_PUBLISHERS,
generated::fa_generated::FA_FILE_CONFIG_EVT,
generated::fa_generated::FA_FILE_LOGS_EVTX,
generated::fa_generated::FA_FILE_CONFIG_SECEVENT_EVT,
generated::fa_generated::FA_EVENTLOG,
generated::fa_generated::FA_FILE_CONFIG_SYSEVENT_EVT,
generated::fa_generated::FA_FILE_SHUTDOWNLOGGER_ETL,
generated::fa_generated::FA_FILE_COLLECTORS_ETL,
generated::fa_generated::FA_FILE_WFP_ETL,
generated::fa_generated::FA_FILE_LOGS_ETL,
generated::fa_generated::FA_FILE_SYSTEM_ETL,
generated::fa_generated::FA_FILE_PERSONAL_ETL,
generated::fa_generated::FA_FILE_EXPLORER_ETL,
generated::fa_generated::FA_FILE_LOCALSTATE_ETL,
generated::fa_generated::FA_FILE_ETL,
generated::fa_generated::FA_FILE_PANTHER_ETL,
generated::fa_generated::FA_FILE_LOGS_ETL_2,
generated::fa_generated::FA_FILE_LOGS_ETL_3,
generated::fa_generated::FA_FILE_WMI_ETL,
generated::fa_generated::FA_FILE_WMI_ETL_0,
generated::fa_generated::FA_FILE_RTBACKUP_ETL,
generated::fa_generated::FA_FILE_SLEEPSTUDY_ETL,
generated::fa_generated::FA_FILE_SCREENON_ETL,
generated::fa_generated::FA_FILE_LOGFILES_ETL,
generated::fa_generated::FA_FILE_LOGFILES_ETL_0,
generated::fa_generated::FA_FILE_ETL_2,
generated::fa_generated::FA_AUTOPLAYHANDLERS_HANDLERS,
generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE,
generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE_2,
generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE_3,
generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE_4,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_4,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_2,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_5,
generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_6,
generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE,
generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE_2,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE,
generated::fa_generated::FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_2,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACEWOW64_DELEGATEFOLDERS,
generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE,
generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE_3,
generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE_4,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_4,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_5,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_2,
generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_6,
generated::fa_generated::FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_3,
generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE,
generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE_2,
generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_DESKTOP_NAMESPACE,
generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE_3,
generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE_4,
generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_4,
generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_5,
generated::fa_generated::FA_DESKTOP_NAMESPACE_2,
generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_6,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE_2,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE_3,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE_4,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_4,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_5,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_2,
generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_6,
generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE,
generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_2,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_3,
generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_4,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_4,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_5,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_2,
generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_6,
generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE,
generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_2,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_2,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_3,
generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_3,
generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_4,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_4,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_5,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_2,
generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_6,
generated::fa_generated::FA_FILE_FIREWALL_PFIREWALL_LOG,
generated::fa_generated::FA_FILE_SCRIPTS_PSSCRIPTS_INI,
generated::fa_generated::FA_FILE_SCRIPTS_SCRIPTS_INI,
generated::fa_generated::FA_FILE_LOGOFF,
generated::fa_generated::FA_FILE_LOGON,
generated::fa_generated::FA_FILE_SCRIPTS_PSSCRIPTS_INI_2,
generated::fa_generated::FA_FILE_SCRIPTS_SCRIPTS_INI_2,
generated::fa_generated::FA_FILE_SHUTDOWN,
generated::fa_generated::FA_FILE_STARTUP,
generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST,
generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_2,
generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_3,
generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_4,
generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_5,
generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST,
generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_2,
generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_3,
generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_4,
generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_5,
generated::fa_generated::FA_CURRENTVERSION_FONT_DRIVERS,
generated::fa_generated::FA_FILE_DATABASE_HCDATA_EDB,
generated::fa_generated::FA_FILE_ETC_LMHOSTS,
generated::fa_generated::FA_FILE_SYSTEM32_MAGNIFIER_EXE,
generated::fa_generated::FA_FILE_SYSTEM32_SETHC_EXE,
generated::fa_generated::FA_FILE_SYSTEM32_UTILMAN_EXE,
generated::fa_generated::FA_CURRENTVERSION_EXPLORER_MAP_NETWORK_DRIVE_MRU,
generated::fa_generated::FA_FILE_AC_INETCACHE,
generated::fa_generated::FA_FILE_AC_INETCOOKIES,
generated::fa_generated::FA_FILE_AC_INETHISTORY,
generated::fa_generated::FA_FILE_WINDOWS_ROAMINGTILES,
generated::fa_generated::FA_SYSTEM_MOUNTEDDEVICES,
generated::fa_generated::FA_MSDTC_MTXOCI,
generated::fa_generated::FA_MSDTC_MTXOCI_2,
generated::fa_generated::FA_CURRENTVERSION_DRIVERS32,
generated::fa_generated::FA_CURRENTVERSION_DRIVERS32_2,
generated::fa_generated::FA_CURRENTVERSION_DRIVERS32_3,
generated::fa_generated::FA_CURRENTVERSION_DRIVERS32_4,
generated::fa_generated::FA_SOFTWARE_MICROSOFT_NETSH,
generated::fa_generated::FA_WOW6432NODE_MICROSOFT_NETSH,
generated::fa_generated::FA_OPENSAVEMRU,
generated::fa_generated::FA_OPENSAVEPIDLMRU,
generated::fa_generated::FA_AUTHENTICATION_PLAP_PROVIDERS,
generated::fa_generated::FA_AUTHENTICATION_PLAP_PROVIDERS_2,
generated::fa_generated::FA_EXPLORER_DISALLOWRUN,
generated::fa_generated::FA_EXPLORER_DISALLOWRUN_2,
generated::fa_generated::FA_,
generated::fa_generated::FA_FILE_V1_0_PROFILE_PS1,
generated::fa_generated::FA_FILE_V1_0_MICROSOFT_POWERSHELL_PROFILE_PS1,
generated::fa_generated::FA_FILE_WINDOWSPOWERSHELL_PROFILE_PS1,
generated::fa_generated::FA_FILE_WINDOWSPOWERSHELL_MICROSOFT_POWERSHELL_PROFILE_PS1,
generated::fa_generated::FA_FILE_PSREADLINE_CONSOLEHOST_HISTORY_TXT,
generated::fa_generated::FA_FILE_PREFETCH_PF,
generated::fa_generated::FA_FILE_NOTIFICATIONS_WPNDATABASE_DB,
generated::fa_generated::FA_FILE_NOTIFICATIONS_WPNDATABASE_DB_2,
generated::fa_generated::FA_FILE_PROGRAMS_RECENTFILECACHE_BCF,
generated::fa_generated::FA_FILE_RECYCLE_BIN,
generated::fa_generated::FA_FILE_RECYCLER,
generated::fa_generated::FA_FILE_I,
generated::fa_generated::FA_FILE_INFO2,
generated::fa_generated::FA_FILE_SYSTEM32_ROVER_DLL,
generated::fa_generated::FA_CLSID_16D12736_7A9E_4765_BEC6_F301D679CAAA,
generated::fa_generated::FA_EXPLORER_RUN,
generated::fa_generated::FA_CURRENTVERSION_RUN,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE,
generated::fa_generated::FA_RUNONCE_SETUP,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX,
generated::fa_generated::FA_CURRENTVERSION_RUN_2,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_2,
generated::fa_generated::FA_RUNONCE_SETUP_2,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_2,
generated::fa_generated::FA_EXPLORER_RUN_2,
generated::fa_generated::FA_EXPLORER_RUN_3,
generated::fa_generated::FA_CURRENTVERSION_RUN_3,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_3,
generated::fa_generated::FA_RUNONCE_SETUP_3,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_3,
generated::fa_generated::FA_EXPLORER_RUN_4,
generated::fa_generated::FA_CURRENTVERSION_RUN_4,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_4,
generated::fa_generated::FA_RUNONCE_SETUP_4,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_4,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE_2,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES_2,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE_3,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES_3,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE_4,
generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES_4,
generated::fa_generated::FA_FILE_TASKS_10,
generated::fa_generated::FA_FILE_TASKS_10_2,
generated::fa_generated::FA_FILE_TASKS_10_3,
generated::fa_generated::FA_FILE_WINDOWS_WINDOWS_EDB,
generated::fa_generated::FA_CONTROL_SECURITYPROVIDERS,
generated::fa_generated::FA_FILE_DATABASE_SECEDIT_SDB,
generated::fa_generated::FA_FILE_TEMPLATES_SPSECUPD_SDB,
generated::fa_generated::FA_CURRENTCONTROLSET_SERVICES,
generated::fa_generated::FA_EXPLORER_SHAREDTASKSCHEDULER,
generated::fa_generated::FA_EXPLORER_SHAREDTASKSCHEDULER_2,
generated::fa_generated::FA_EXPLORER_SHELLEXECUTEHOOKS,
generated::fa_generated::FA_EXPLORER_SHELLEXECUTEHOOKS_2,
generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED,
generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_2,
generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_3,
generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_4,
generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_2,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_2,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_2,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_2,
generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS_2,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_3,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_3,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_3,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_3,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_4,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_4,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_4,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_4,
generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS_3,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_5,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_5,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_5,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_5,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_6,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_6,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_6,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_6,
generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS_4,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_7,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_7,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_7,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_7,
generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_8,
generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_8,
generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_8,
generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_8,
generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS,
generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_2,
generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_3,
generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_4,
generated::fa_generated::FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD,
generated::fa_generated::FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD_2,
generated::fa_generated::FA_FILE_MESSAGESTORE_SMSINTERCEPTSTORE_DB,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_SETUPAPI_LOG,
generated::fa_generated::FA_FILE_INF_SETUPAPI_APP_LOG,
generated::fa_generated::FA_FILE_INF_SETUPAPI_DEV_LOG,
generated::fa_generated::FA_FILE_INF_SETUPAPI_OFFLINE_LOG,
generated::fa_generated::FA_FILE_APPREPOSITORY_STATEREPOSITORY_DEPLOYMENT_SRD,
generated::fa_generated::FA_FILE_APPREPOSITORY_STATEREPOSITORY_MACHINE_SRD,
generated::fa_generated::FA_FILE_STARTUP_2,
generated::fa_generated::FA_FILE_STARTUP_3,
generated::fa_generated::FA_FILE_STARTUP_4,
generated::fa_generated::FA_FILE_STARTUP_5,
generated::fa_generated::FA_FILE_PREFETCH_AG_DB,
generated::fa_generated::FA_FILE_PREFETCH_AG_DB_TRX,
generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_SYSTEM_INI,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WIN_INI,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WININIT_INI,
generated::fa_generated::FA_FILE_REGBACK_SAM,
generated::fa_generated::FA_FILE_REGBACK_SECURITY,
generated::fa_generated::FA_FILE_REGBACK_SOFTWARE,
generated::fa_generated::FA_FILE_REGBACK_SYSTEM,
generated::fa_generated::FA_FILE_REGBACK_SAM_LOG,
generated::fa_generated::FA_FILE_REGBACK_SAM_LOG1,
generated::fa_generated::FA_FILE_REGBACK_SAM_LOG2,
generated::fa_generated::FA_FILE_REGBACK_SECURITY_LOG,
generated::fa_generated::FA_FILE_REGBACK_SECURITY_LOG1,
generated::fa_generated::FA_FILE_REGBACK_SECURITY_LOG2,
generated::fa_generated::FA_FILE_REGBACK_SOFTWARE_LOG,
generated::fa_generated::FA_FILE_REGBACK_SOFTWARE_LOG1,
generated::fa_generated::FA_FILE_REGBACK_SOFTWARE_LOG2,
generated::fa_generated::FA_FILE_REGBACK_SYSTEM_LOG,
generated::fa_generated::FA_FILE_REGBACK_SYSTEM_LOG1,
generated::fa_generated::FA_FILE_REGBACK_SYSTEM_LOG2,
generated::fa_generated::FA_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE,
generated::fa_generated::FA_FILE_CONFIG_SAM,
generated::fa_generated::FA_FILE_CONFIG_SECURITY,
generated::fa_generated::FA_FILE_CONFIG_SOFTWARE,
generated::fa_generated::FA_FILE_CONFIG_SYSTEM,
generated::fa_generated::FA_FILE_CONFIG_SAM_LOG,
generated::fa_generated::FA_FILE_CONFIG_SAM_LOG1,
generated::fa_generated::FA_FILE_CONFIG_SAM_LOG2,
generated::fa_generated::FA_FILE_CONFIG_SECURITY_LOG,
generated::fa_generated::FA_FILE_CONFIG_SECURITY_LOG1,
generated::fa_generated::FA_FILE_CONFIG_SECURITY_LOG2,
generated::fa_generated::FA_FILE_CONFIG_SOFTWARE_LOG,
generated::fa_generated::FA_FILE_CONFIG_SOFTWARE_LOG1,
generated::fa_generated::FA_FILE_CONFIG_SOFTWARE_LOG2,
generated::fa_generated::FA_FILE_CONFIG_SYSTEM_LOG,
generated::fa_generated::FA_FILE_CONFIG_SYSTEM_LOG1,
generated::fa_generated::FA_FILE_CONFIG_SYSTEM_LOG2,
generated::fa_generated::FA_FILE_SRU_SRUDB_DAT,
generated::fa_generated::FA_FILE_STARTUPINFO_XML,
generated::fa_generated::FA_FILE_TEMP,
generated::fa_generated::FA_FILE_TEMP_2,
generated::fa_generated::FA_FILE_TEMP_3,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_5,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_5,
generated::fa_generated::FA_CURRENTVERSION_RUN_5,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_6,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_6,
generated::fa_generated::FA_CURRENTVERSION_RUN_6,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_7,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_7,
generated::fa_generated::FA_CURRENTVERSION_RUN_7,
generated::fa_generated::FA_CURRENTVERSION_RUNONCE_8,
generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_8,
generated::fa_generated::FA_CURRENTVERSION_RUN_8,
generated::fa_generated::FA_FILE_EXPLORER_THUMBCACHE_DB,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_BACKUPPATH,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_CHKDSKPATH,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_CLEANUPPATH,
generated::fa_generated::FA_EXPLORER_MYCOMPUTER_DEFRAGPATH,
generated::fa_generated::FA_FILE_DATABASE_VEDATAMODEL_EDB,
generated::fa_generated::FA_UNINSTALL,
generated::fa_generated::FA_UNINSTALL_2,
generated::fa_generated::FA_UNINSTALL_3,
generated::fa_generated::FA_FILE_CATDB,
generated::fa_generated::FA_FILE_DATASTORE_DATASTORE_EDB,
generated::fa_generated::FA_FILE_SYSTEM_ETL_2,
generated::fa_generated::FA_FILE_CBS_CBS_LOG,
generated::fa_generated::FA_FILE_WINDOWSUPDATE_WINDOWSUPDATE_ETL,
generated::fa_generated::FA_FILE_UPDATESTORE_STORE_DB,
generated::fa_generated::FA_FILE_SUM_MDB,
generated::fa_generated::FA_FILE_AUTOMATICDESTINATIONS_AUTOMATICDESTINATIONS_MS,
generated::fa_generated::FA_FILE_CUSTOMDESTINATIONS_CUSTOMDESTINATIONS_MS,
generated::fa_generated::FA_FILE_RECENT,
generated::fa_generated::FA_FILE_RECENT_2,
generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT,
generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_MAN,
generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT,
generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG,
generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG1,
generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG2,
generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT_LOG,
generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT_LOG1,
generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT_LOG2,
generated::fa_generated::FA_EXPLORER_SHELL_FOLDERS,
generated::fa_generated::FA_USERS_SID_ENVIRONMENT,
generated::fa_generated::FA_USERS_SID_VOLATILE_ENVIRONMENT,
generated::fa_generated::FA_FILE_CACHESTORAGE_CACHESTORAGE_EDB,
generated::fa_generated::FA_ALTERNATESHELLS_AVAILABLESHELLS,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINSTART_BAT,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DOSSTART_BAT,
generated::fa_generated::FA_EXPLORER_WORDWHEELQUERY,
generated::fa_generated::FA_FILE_LOGS_APPLICATION_EVTX,
generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4ADMIN_EVTX,
generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4OPERATIONAL_EVTX,
generated::fa_generated::FA_FILE_LOGS_POWERSHELLCORE_OPERATIONAL_EVTX,
generated::fa_generated::FA_FILE_LOGS_WINDOWS_POWERSHELL_EVTX,
generated::fa_generated::FA_FILE_LOGS_SECURITY_EVTX,
generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_SYSMON_4OPERATIONAL_EVTX,
generated::fa_generated::FA_FILE_LOGS_SYSTEM_EVTX,
generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSION,
generated::fa_generated::FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES,
generated::fa_generated::FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES64,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_EXPLORERFRAME_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DUSER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DUI70_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_UXTHEME_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_POWRPROF_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DWMAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SLC_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_GDIPLUS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SECUR32_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SSPICLI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PROPSYS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINSTA_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CRYPTBASE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINDOWSCODECS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PROFAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_APPHELP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_EHSTORSHELL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCDLL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTSHRUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SRVCLI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ICONCODECSERVICE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CRYPTSP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RSAENH_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RPCRTREMOTE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SNDVOLSSO_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_HID_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MMDEVAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TIMEDATE_CPL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ATL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACTXPRXY_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTMARTA_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SHDOCVW_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_LINKINFO_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_USERENV_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SHACCT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_GAMEUX_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_XMLLITE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SAMLIB_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSLS31_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TIPTSF_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AUTHUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CRYPTUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSILTCFG_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_VERSION_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NETWORKEXPLORER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINMM_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WDMAUD_DRV,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_KSUSER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AVRT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AUDIOSES_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSACM32_DRV,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSACM32_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MIDIMAP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NETUTILS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_STOBJECT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_BATMETER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WTSAPI32_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ES_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PRNFLDR_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINSPOOL_DRV,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DXP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCREG_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NETSHELL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IPHLPAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINNSI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NLAAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ALTTAB_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PNIDUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_QUTIL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WEVTAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DHCPCSVC6_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DHCPCSVC_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CREDSSP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NPMPROXY_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCOBJ_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WLANAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WLANUTIL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WWANAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WWAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_QAGENT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SRCHADMIN_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSSPRXY_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_BTHPROPS_CPL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IEFRAME_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_OLEACC_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCCENTER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACTIONCENTER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IMAPI2_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SXS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_HGCPL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PROVSVC_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WKSCLI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FXSST_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FXSAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FXSRESM_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IEPROXY_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_THUMBCACHE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RASADHLP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MPR_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_VMHGFS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DRPROV_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTLANMAN_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DAVCLNT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DAVHLPR_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_STRUCTUREDQUERY_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_UIANIMATION_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DEVRTL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MLANG_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WSCINTEROP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WSCAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WSCUI_CPL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WERCONCPL_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FRAMEDYNOS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WERCPLSUPPORT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSXML6_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_HCPROVIDERS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ZIPFLDR_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RAREXT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_7_ZIP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TWEXT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINCDEMUCONTEXTMENU_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCENG_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SHLEXT010_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ATL90_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACPPAGE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SFC_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SFC_OS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DSROLE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACLUI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTDSAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PHOTOBASE_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SBDROP_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TQUERY_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_EHSTORAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SEARCHFOLDER_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NATURALLANGUAGE6_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NLSDATA0009_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NLSLEXICONS0009_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSFTEDIT_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DNSAPI_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RASAPI32_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RASMAN_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RTUTILS_DLL,
generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SENSAPI_DLL,
// ── kape_generated (2422 entries) ────────────────────────────────────
generated::kape_generated::KAPE_FILE_KAPETRIAGE_TKAPE,
generated::kape_generated::KAPE_FILE_USER_APPDATA,
generated::kape_generated::KAPE_FILE_REGEX_3GP_AA_AAC_ACT_AIFF_ALAC_AMR_APE_AU_AWB_DSS,
generated::kape_generated::KAPE_FILE_REGEX_XLS_XLSX_CSV_TSV_XLT_XLM_XLSM_XLTX_XLTM_XLSB,
generated::kape_generated::KAPE_FILE_REGEX_PDF_XPS_OXPS,
generated::kape_generated::KAPE_FILE_REGEX_AI_BMP_BPG_CDR_CPC_EPS_EXR_FLIF_GIF_HEIF_ILB,
generated::kape_generated::KAPE_FILE_REGEX_DB_SQLITE,
generated::kape_generated::KAPE_FILE_REGEX_3G2_3GP_AMV_ASF_AVI_DRC_FLV_F4V_F4P_F4A_F4B,
generated::kape_generated::KAPE_FILE_C_ZIP,
generated::kape_generated::KAPE_FILE_REGEX_DOC_DOCX_DOCM_DOTX_DOTM_DOCB_DOT_WBK_ODT_FOD,
generated::kape_generated::KAPE_FILE_USER_DESKTOP,
generated::kape_generated::KAPE_FILE_USER_DOCUMENTS,
generated::kape_generated::KAPE_FILE_USER_DOWNLOADS,
generated::kape_generated::KAPE_FILE_USER_DROPBOX,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_LOG,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_REPORT,
generated::kape_generated::KAPE_FILE_AVG_AV_LOGS,
generated::kape_generated::KAPE_FILE_AVG_REPORT_LOGS,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_LOGS,
generated::kape_generated::KAPE_FILE_AVG_ANTIVIRUSFILEINFO2_DB,
generated::kape_generated::KAPE_FILE_AVG_ANTIVIRUSLSDB2_JSON,
generated::kape_generated::KAPE_FILE_AVAST_LOG,
generated::kape_generated::KAPE_FILE_AVAST_AV_LOGS,
generated::kape_generated::KAPE_FILE_AVAST_AV_USER_LOGS,
generated::kape_generated::KAPE_FILE_CHEST_INDEX_XML,
generated::kape_generated::KAPE_FILE_AVAST_LOGS,
generated::kape_generated::KAPE_FILE_ICARUS_LOGS,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_LOGFILES,
generated::kape_generated::KAPE_FILE_SECURITY_LOGS,
generated::kape_generated::KAPE_FILE_AVIRA_VPN,
generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS,
generated::kape_generated::KAPE_FILE_PROFILES_LOGS,
generated::kape_generated::KAPE_FILE_REGEX_DB_DB_WAL_DB_SHM,
generated::kape_generated::KAPE_FILE_C_COMBOFIX_TXT,
generated::kape_generated::KAPE_FILE_CROWDSTRIKE_QUARANTINE,
generated::kape_generated::KAPE_FILE_CRS1_LOGS,
generated::kape_generated::KAPE_FILE_APV2_LOGS,
generated::kape_generated::KAPE_FILE_CRB1_LOGS,
generated::kape_generated::KAPE_FILE_CYLANCE_DESKTOP,
generated::kape_generated::KAPE_FILE_OPTICS_LOG,
generated::kape_generated::KAPE_FILE_DESKTOP_LOG,
generated::kape_generated::KAPE_FILE_ESET_NOD32_ANTIVIRUS_LOGS,
generated::kape_generated::KAPE_FILE_ESET_NOD32_AV_LOGS,
generated::kape_generated::KAPE_FILE_ESET_SECURITY_LOGS,
generated::kape_generated::KAPE_FILE_ERAAGENTAPPLICATIONDATA_LOGS,
generated::kape_generated::KAPE_FILE_ESET_SECURITY_QUARANTINE,
generated::kape_generated::KAPE_FILE_SYSTEM_USER_QUARANTI,
generated::kape_generated::KAPE_FILE_LOG_LOG,
generated::kape_generated::KAPE_FILE_EQUARANTINE,
generated::kape_generated::KAPE_FILE_ELASTIC_DEFEND_QUARA,
generated::kape_generated::KAPE_FILE_REPORTS_SCAN_TXT,
generated::kape_generated::KAPE_FILE_F_SECURE_LOG,
generated::kape_generated::KAPE_FILE_F_SECURE_USER_LOGS,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_SCHEDULEDSCANREPORTS,
generated::kape_generated::KAPE_FILE_HITMANPRO_LOGS,
generated::kape_generated::KAPE_FILE_HITMANPRO_ALERT_LOGS,
generated::kape_generated::KAPE_FILE_HITMANPRO_ALERT_EXCALIBUR_DB,
generated::kape_generated::KAPE_FILE_HITMANPRO_QUARANTINE,
generated::kape_generated::KAPE_FILE_LOGS_MBAM_LOG_XML,
generated::kape_generated::KAPE_FILE_LOGS_MBAMSERVICE_LOG,
generated::kape_generated::KAPE_FILE_MALWAREBYTES_ANTI_MALWARE_LOGS,
generated::kape_generated::KAPE_FILE_MBAMSERVICE_SCANRESULTS,
generated::kape_generated::KAPE_FILE_MCAFEE_DESKTOPPROTECTION,
generated::kape_generated::KAPE_FILE_MCAFEE_DESKTOP_PROTE,
generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS_2,
generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS_OLD,
generated::kape_generated::KAPE_FILE_MCAFEE_VIRUSSCAN,
generated::kape_generated::KAPE_FILE_MSC_LOGS,
generated::kape_generated::KAPE_FILE_AGENT_AGENTEVENTS,
generated::kape_generated::KAPE_FILE_AGENT_LOGS,
generated::kape_generated::KAPE_FILE_DATAREPUTATION_LOGS,
generated::kape_generated::KAPE_FILE_VIRUSSCAN_LOGS,
generated::kape_generated::KAPE_FILE_COMMON_FRAMEWORK_AGENTEVENTS,
generated::kape_generated::KAPE_FILE_MCLOGS_SAE,
generated::kape_generated::KAPE_FILE_DATREPUTATION_LOGS,
generated::kape_generated::KAPE_FILE_MCAFEE_MANAGED_VIRUS,
generated::kape_generated::KAPE_FILE_WCF_SERVICE_LOG,
generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS_3,
generated::kape_generated::KAPE_FILE_APACHE2_LOGS,
generated::kape_generated::KAPE_FILE_DB_EVENTS,
generated::kape_generated::KAPE_FILE_EVENTS_DEBUG,
generated::kape_generated::KAPE_FILE_SERVER_LOGS,
generated::kape_generated::KAPE_FILE_DEBUG_MSERT_LOG,
generated::kape_generated::KAPE_FILE_LOGS_ADLICEREPORT_JSON,
generated::kape_generated::KAPE_FILE_SUPERANTISPYWARE_LOGS,
generated::kape_generated::KAPE_FILE_SECUREAGE_LOG,
generated::kape_generated::KAPE_FILE_SENTINEL_LOGS,
generated::kape_generated::KAPE_FILE_SOPHOS_LOGS,
generated::kape_generated::KAPE_FILE_LOGS,
generated::kape_generated::KAPE_FILE_SOPHOS_LOGS_2,
generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE,
generated::kape_generated::KAPE_FILE_LOGS_AV,
generated::kape_generated::KAPE_FILE_DATA_LOGS,
generated::kape_generated::KAPE_FILE_SYMANTEC_ENDPOINT_PROTECTION_LOGS,
generated::kape_generated::KAPE_FILE_LOGS_SYMANTEC_ENDPOINT_PROTECTION_CLIENT_EVTX,
generated::kape_generated::KAPE_FILE_SYMANTEC_EVENT_LOG_W,
generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_2,
generated::kape_generated::KAPE_FILE_SYMANTEC_ENDPOINT_PROTECTION_QUARANTINE,
generated::kape_generated::KAPE_FILE_DATA_QUARANTINE,
generated::kape_generated::KAPE_FILE_CMNCLNT_CCSUBSDK,
generated::kape_generated::KAPE_FILE_DATA_REGISTRATIONINFO_XML,
generated::kape_generated::KAPE_FILE_TOTALAV_LOGS,
generated::kape_generated::KAPE_FILE_TOTALAV_LOGS_2,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_TREND_MICRO,
generated::kape_generated::KAPE_FILE_REPORT_LOG,
generated::kape_generated::KAPE_FILE_CONNLOG_LOG,
generated::kape_generated::KAPE_FILE_QUARANTINE,
generated::kape_generated::KAPE_FILE_VIPRE_BUSINESS_AGENT_LOGS,
generated::kape_generated::KAPE_FILE_ROAMING_VIPRE_BUSINESS,
generated::kape_generated::KAPE_FILE_ANTIMALWARE_LOGS,
generated::kape_generated::KAPE_FILE_VIPRE_BUSINESS_USER,
generated::kape_generated::KAPE_FILE_WRDATA_WRLOG_LOG,
generated::kape_generated::KAPE_FILE_DETECTIONHISTORY,
generated::kape_generated::KAPE_FILE_MICROSOFT_ANTIMALWARE_SUPPORT,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_WINDOWS_DEFENDER_EVTX,
generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_EVE,
generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_SUPPORT,
generated::kape_generated::KAPE_FILE_TEMP_MPCMDRUN_LOG,
generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_LOG,
generated::kape_generated::KAPE_FILE_DETECTIONHISTORY_2,
generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_QUARANTINE,
generated::kape_generated::KAPE_FILE_SERVICE_DETECTIONS_LOG,
generated::kape_generated::KAPE_FILE_1PASSWORD_DATA_1PASSWORD10_SQLITE,
generated::kape_generated::KAPE_FILE_1PASSWORD_BACKUPS_1PASSWORD10_SQLITE,
generated::kape_generated::KAPE_FILE_1PASSWORD_LOGS_LOG,
generated::kape_generated::KAPE_FILE_4K_VIDEO_DOWNLOADER_4K_VIDEO_DOWNLOADER_SQLITE,
generated::kape_generated::KAPE_FILE_4K_VIDEO_DOWNLOADER,
generated::kape_generated::KAPE_FILE_USER_DOCUMENTS_ATC,
generated::kape_generated::KAPE_FILE_LOGS_TI_DEMON,
generated::kape_generated::KAPE_FILE_TRUEIMAGEHOME_DATABASEARCHIVES_DB,
generated::kape_generated::KAPE_FILE_TRUEIMAGEHOME_SCRIPTS,
generated::kape_generated::KAPE_FILE_ACTION1_LOGS_LOG,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_ALIASES_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_ALI,
generated::kape_generated::KAPE_FILE_ADVANCED_IP_SCANNER,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_ALIASES_B,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_ALIASES_B_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_A,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_COMMENTS_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_COM,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_COM_2,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_COMMENTS,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_COMMENTS_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_C,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER_2,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_MAC_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_MAC,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_MAC_2,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_MAC_BIN,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_MAC_BIN_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_M,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER_3,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_FAVORITES_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_FAV,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_FAV_2,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_FAVORITES,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_FAVORITES_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_F,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER_4,
generated::kape_generated::KAPE_FILE_C_ADVANCED_IP_SCANNER_FAVORITES_BIN,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_ALIASES_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER,
generated::kape_generated::KAPE_FILE_ADVANCED_PORT_SCANNE,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_ALIASES,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_ALIASES_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_COMMENTS_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_2,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_3,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_COMMENT,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_COMMENT_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN_2,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_MAC_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_4,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_5,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_MAC_BIN,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_MAC_BIN_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER_3,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN_3,
generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_FAVORITES_BIN,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_6,
generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_7,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_FAVORIT,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_FAVORIT_2,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER_4,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN_4,
generated::kape_generated::KAPE_FILE_C_ADVANCED_PORT_SCANNER_FAVORITES_BIN,
generated::kape_generated::KAPE_FILE_AGENTRANSACK_CONFIG,
generated::kape_generated::KAPE_FILE_AGENTRANSACK_CRASHREPORTS,
generated::kape_generated::KAPE_FILE_AGENTRANSACK_INDEXLOG,
generated::kape_generated::KAPE_FILE_AGENTRANSACK_LOGS,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_AMMYY,
generated::kape_generated::KAPE_FILE_ANYDESK_TRACE,
generated::kape_generated::KAPE_FILE_ANYDESK_LOGS_PROGRAM,
generated::kape_generated::KAPE_FILE_ANYDESK_CONF,
generated::kape_generated::KAPE_FILE_ANYDESK_CONF_2,
generated::kape_generated::KAPE_FILE_ANYDESK_ANYDESK,
generated::kape_generated::KAPE_FILE_ANYDESK_CONNECTION_TRACE_TXT,
generated::kape_generated::KAPE_FILE_ANYDESK_CONNECTION_TRACE_TXT_2,
generated::kape_generated::KAPE_FILE_ROAMING_ANYDESK,
generated::kape_generated::KAPE_FILE_ANYDESK_CHAT_TXT,
generated::kape_generated::KAPE_FILE_ROAMING_ANYDESK_FILE_TRANSFER_TRACE_TXT,
generated::kape_generated::KAPE_FILE_ANYDESK_FILE_TRANSFER_TRACE_TXT,
generated::kape_generated::KAPE_FILE_LOG_LOG_2,
generated::kape_generated::KAPE_FILE_ASPERA_SERVER_LOGS,
generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_INI,
generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_TXT,
generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_DB,
generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_CONFIG,
generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_CFG,
generated::kape_generated::KAPE_FILE_BOX_BOX,
generated::kape_generated::KAPE_FILE_LOCAL_BOX_SYNC,
generated::kape_generated::KAPE_FILE_USER_BOX,
generated::kape_generated::KAPE_FILE_USER_BOX_SYNC,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB,
generated::kape_generated::KAPE_FILE_INDEXEDDB_HTTPS_CHATGPT_COM_0_INDEXEDDB_LEVELDB,
generated::kape_generated::KAPE_FILE_CHATGPT_CACHE,
generated::kape_generated::KAPE_FILE_SYSTEMAPPDATA_HELIUM_DAT,
generated::kape_generated::KAPE_FILE_OPENAI_CHATGPT_DESKTOP_2P2NQSD0C76G0_SETTINGS_SETT,
generated::kape_generated::KAPE_FILE_LOGS_LOG,
generated::kape_generated::KAPE_FILE_HISTORY_DB,
generated::kape_generated::KAPE_FILE_CLIPBOARDMASTER_CLIPBOARD_CLM4,
generated::kape_generated::KAPE_FILE_CLIPBOARDMASTER_PICS,
generated::kape_generated::KAPE_FILE_CLIPBOARDMASTER_CLIPBOARD_CLM4_BA,
generated::kape_generated::KAPE_FILE_LOGS_LOG_2,
generated::kape_generated::KAPE_FILE_CONFLUENCE_WIKI_LOG,
generated::kape_generated::KAPE_FILE_DWAGENT_LOG,
generated::kape_generated::KAPE_FILE_AWS_CREDENTIALS,
generated::kape_generated::KAPE_FILE_AWS_CONFIG,
generated::kape_generated::KAPE_FILE_KUBE_CONFIG,
generated::kape_generated::KAPE_FILE_DOCKER_CONFIG_JSON,
generated::kape_generated::KAPE_FILE_USER_GIT_CREDENTIALS,
generated::kape_generated::KAPE_FILE_USER_GITCONFIG,
generated::kape_generated::KAPE_FILE_SSH_CONFIG,
generated::kape_generated::KAPE_FILE_SSH_KNOWN_HOSTS,
generated::kape_generated::KAPE_FILE_USER_NPMRC,
generated::kape_generated::KAPE_FILE_MRU_RENAME_FOLDERS_OSD,
generated::kape_generated::KAPE_FILE_MRU_RENAME_FILES_OSD,
generated::kape_generated::KAPE_FILE_MRU_FIND_CONTAINS_OSD,
generated::kape_generated::KAPE_FILE_MRU_FIND_NAME_OSD,
generated::kape_generated::KAPE_FILE_MRU_FIND_PATH_OSD,
generated::kape_generated::KAPE_FILE_STATE_DATA_RECENT_OSD,
generated::kape_generated::KAPE_FILE_STATE_DATA_BACKUPCONFIG_OSD,
generated::kape_generated::KAPE_FILE_DIRECTORY_OPUS_THUMBNAIL_CACHE,
generated::kape_generated::KAPE_FILE_DIRECTORY_OPUS_LOGS,
generated::kape_generated::KAPE_FILE_DISCORD_CACHE,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_2,
generated::kape_generated::KAPE_FILE_DOUBLECMD_HISTORY_XML,
generated::kape_generated::KAPE_FILE_DOUBLECMD_DOUBLECMD_XML,
generated::kape_generated::KAPE_FILE_DOUBLECMD_DOUBLECMD_LOG,
generated::kape_generated::KAPE_FILE_DOUBLECMD_MULTIARC_INI,
generated::kape_generated::KAPE_FILE_DOUBLECMD_SESSION_INI,
generated::kape_generated::KAPE_FILE_DOUBLECMD_PIXMAPS_TXT,
generated::kape_generated::KAPE_FILE_DOUBLECMD_SHORTCUTS_SCF,
generated::kape_generated::KAPE_FILE_DROPBOX_INFO_JSON,
generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DB,
generated::kape_generated::KAPE_FILE_DROPBOX_MACHINE_STORAGETRAY_THUMBNAILS_DB,
generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DBX,
generated::kape_generated::KAPE_FILE_PROTECT,
generated::kape_generated::KAPE_FILE_DROPBOX_INSTANCE,
generated::kape_generated::KAPE_FILE_USER_DROPBOX_2,
generated::kape_generated::KAPE_FILE_ROAMING_EFSOFTWARE,
generated::kape_generated::KAPE_FILE_DATABASES_ACCOUNTS,
generated::kape_generated::KAPE_FILE_DATABASES_EXB,
generated::kape_generated::KAPE_FILE_DATABASES_EXB_SNIPPETS,
generated::kape_generated::KAPE_FILE_EVERYTHING_EVERYTHING_DB,
generated::kape_generated::KAPE_FILE_EVERYTHING_RUN_HISTORY_CSV,
generated::kape_generated::KAPE_FILE_EVERYTHING_SEARCH_HISTORY_CSV,
generated::kape_generated::KAPE_FILE_EVERYTHING_EVERYTHING_INI,
generated::kape_generated::KAPE_FILE_FSIV_FSIV_DB,
generated::kape_generated::KAPE_FILE_FENCES_BACKUPS,
generated::kape_generated::KAPE_FILE_FILEZILLA_XML,
generated::kape_generated::KAPE_FILE_FILEZILLA_SQLITE3,
generated::kape_generated::KAPE_FILE_FILEZILLA_SERVER_XML,
generated::kape_generated::KAPE_FILE_LOGS_LOG_3,
generated::kape_generated::KAPE_FILE_LOGS_TRACE,
generated::kape_generated::KAPE_FILE_FORTICLIENT_TRACE_LO,
generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_INI,
generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_FTP_INI,
generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_HIST_INI,
generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_FAV_XML,
generated::kape_generated::KAPE_FILE_SETTINGS_BKP_SETTINGS,
generated::kape_generated::KAPE_FILE_TEMP_FC_LOG,
generated::kape_generated::KAPE_FILE_TEMP_FREECOMMANDER,
generated::kape_generated::KAPE_FILE_FREE_DOWNLOAD_MANAGER_FDM_SQLITE,
generated::kape_generated::KAPE_FILE_BACKUP_BACKUP_INFO,
generated::kape_generated::KAPE_FILE_BACKUP_USERDATA_ZIP,
generated::kape_generated::KAPE_FILE_FREEFILESYNC_LOGS,
generated::kape_generated::KAPE_FILE_USER_GOOGLE_DRIVE,
generated::kape_generated::KAPE_FILE_GOOGLE_DRIVE,
generated::kape_generated::KAPE_FILE_GOOGLE_DRIVEFS,
generated::kape_generated::KAPE_FILE_GOOGLE_GOOGLEEARTH_MYPLACES_KML,
generated::kape_generated::KAPE_FILE_GOOGLE_GOOGLEEARTH_MYPLACES_BACKUP_KML,
generated::kape_generated::KAPE_FILE_GOOGLE_EARTH_MY_PLAC,
generated::kape_generated::KAPE_FILE_GOOGLE_GOOGLEEARTH_MYPLACES_BACKUP_KML_2,
generated::kape_generated::KAPE_FILE_HEIDISQL_BACKUPS,
generated::kape_generated::KAPE_FILE_HEIDISQL_TABS_INI,
generated::kape_generated::KAPE_FILE_HEXCHAT_LOGS,
generated::kape_generated::KAPE_FILE_ARCHIVE_CLEANUP,
generated::kape_generated::KAPE_FILE_BACKUP,
generated::kape_generated::KAPE_FILE_DELETE,
generated::kape_generated::KAPE_FILE_RESTORE,
generated::kape_generated::KAPE_FILE_LOGXML_XML,
generated::kape_generated::KAPE_FILE_TRACEFILE_TXT,
generated::kape_generated::KAPE_FILE_IBCOMMON_IDMAPPEDDRIVES_TXT,
generated::kape_generated::KAPE_FILE_IBCOMMON_SCHEDULE_XML,
generated::kape_generated::KAPE_FILE_IBCOMMON_SCH_TRACE_TXT,
generated::kape_generated::KAPE_FILE_IBCOMMON_IDRIVE_INI,
generated::kape_generated::KAPE_FILE_IBCOMMON_GET_ALLDRIVES_TXT,
generated::kape_generated::KAPE_FILE_IBCOMMON_EXCLUDE,
generated::kape_generated::KAPE_FILE_IBCOMMON_AUTOCOMP_INI,
generated::kape_generated::KAPE_FILE_IBDS,
generated::kape_generated::KAPE_FILE_ISLCLIENT_OUT,
generated::kape_generated::KAPE_FILE_CONF,
generated::kape_generated::KAPE_FILE_ISL_ALWAYSON_SESSION_XML,
generated::kape_generated::KAPE_FILE_TRACE_OUT,
generated::kape_generated::KAPE_FILE_ISL_ALWAYSON_OUT,
generated::kape_generated::KAPE_FILE_ISL_LIGHT_LOGS_SESSI,
generated::kape_generated::KAPE_FILE_STATUS_TRAY,
generated::kape_generated::KAPE_FILE_ISL_ALWAYSON_STATICCONFIGURATION_INI,
generated::kape_generated::KAPE_FILE_ENDPOINT_MANAGER_RMMLOGS,
generated::kape_generated::KAPE_FILE_ITARIAN,
generated::kape_generated::KAPE_FILE_COMODO,
generated::kape_generated::KAPE_FILE_ENDPOINT_MANAGER_RMMLOGS_2,
generated::kape_generated::KAPE_FILE_ICECHAT_LOGS,
generated::kape_generated::KAPE_FILE_LOG_FILES_IMGBURN_LOG,
generated::kape_generated::KAPE_FILE_IRFANVIEW_I_VIEW32_INI,
generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_DOWNLOADLIST_ZIP,
generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_LINKCOLLECTOR_ZIP,
generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_ORG_JDOWNLOADER_SETTINGS_GENER,
generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_ORG_JDOWNLOADER_GUI_VIEWS_LINK,
generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_ORG_JDOWNLOADER_SETTINGS_INTER,
generated::kape_generated::KAPE_FILE_IDX,
generated::kape_generated::KAPE_FILE_JAVA_WEBSTART_CACHE,
generated::kape_generated::KAPE_FILE_IDX_2,
generated::kape_generated::KAPE_FILE_IDX_3,
generated::kape_generated::KAPE_FILE_IDX_4,
generated::kape_generated::KAPE_FILE_IDX_5,
generated::kape_generated::KAPE_FILE_IDX_6,
generated::kape_generated::KAPE_FILE_IDX_7,
generated::kape_generated::KAPE_FILE_IDX_8,
generated::kape_generated::KAPE_FILE_IDX_9,
generated::kape_generated::KAPE_FILE_IDX_10,
generated::kape_generated::KAPE_FILE_KASEYA_LOG,
generated::kape_generated::KAPE_FILE_LOG_KASEYALIVECONNECT,
generated::kape_generated::KAPE_FILE_LOG_ENDPOINT,
generated::kape_generated::KAPE_FILE_KASEYA_AGENT_ENDPOIN,
generated::kape_generated::KAPE_FILE_AGENTMON_LOG,
generated::kape_generated::KAPE_FILE_TEMP_KASETUP_LOG,
generated::kape_generated::KAPE_FILE_KASEYA_SETUP_LOG,
generated::kape_generated::KAPE_FILE_TEMP_KASETUP_LOG_2,
generated::kape_generated::KAPE_FILE_LOG_KASEYAEDGESERVICES,
generated::kape_generated::KAPE_FILE_KEEPASS_XML,
generated::kape_generated::KAPE_FILE_KEEPASS_PASSWORD_SAFE_XML,
generated::kape_generated::KAPE_FILE_KEEPASS_PASSWORD_SAFE_CONFIG,
generated::kape_generated::KAPE_FILE_KEEPASSXC_INI,
generated::kape_generated::KAPE_FILE_KEEPASS_ROAMING_INI,
generated::kape_generated::KAPE_FILE_PROGRAM_FILES_LEVEL_LOG,
generated::kape_generated::KAPE_FILE_LOGMEIN_LOGS,
generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_3,
generated::kape_generated::KAPE_FILE_TEMP_LOGMEINLOGS,
generated::kape_generated::KAPE_FILE_MACRIUM_MACRIUM_SERVICE,
generated::kape_generated::KAPE_FILE_MACRIUM_REFLECT,
generated::kape_generated::KAPE_FILE_MACRIUM_REFLECT_LAUNCHER,
generated::kape_generated::KAPE_FILE_MATTERMOST_INDEXEDDB,
generated::kape_generated::KAPE_FILE_ROAMING_MEDIAMONKEY_MM_DB,
generated::kape_generated::KAPE_FILE_ROAMING_MEDIAMONKEY_MEDIAMONKEY_INI,
generated::kape_generated::KAPE_FILE_MEGA_LIMITED_MEGASYNC,
generated::kape_generated::KAPE_FILE_MESH_AGENT_MSH,
generated::kape_generated::KAPE_FILE_MESH_AGENT_LOG,
generated::kape_generated::KAPE_FILE_AZCOPY_LOG,
generated::kape_generated::KAPE_FILE_PLANS_STE,
generated::kape_generated::KAPE_FILE_FULLTEXTSEARCHINDEX,
generated::kape_generated::KAPE_FILE_ONENOTE_NOTIFICATIONSRECENTNOTEBOOKS_SEENURLS,
generated::kape_generated::KAPE_FILE_16_0_ACCESSIBILITYCHECKERINDEX,
generated::kape_generated::KAPE_FILE_16_0_NOTETAGS_LIVEID_DB,
generated::kape_generated::KAPE_FILE_16_0_RECENTSEARCHESRECENTSEARCHES_DB,
generated::kape_generated::KAPE_FILE_STICKYNOTES_STICKYNOTES_SNT,
generated::kape_generated::KAPE_FILE_LOCALSTATE_PLUM_SQLITE,
generated::kape_generated::KAPE_FILE_INDEXEDDB_HTTPS_TEAMS_MICROSOFT_COM_0_INDEXEDDB_LE,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_3,
generated::kape_generated::KAPE_FILE_TEAMS_CACHE,
generated::kape_generated::KAPE_FILE_TEAMS_DESKTOP_CONFIG_JSON,
generated::kape_generated::KAPE_FILE_MSTEAMS_LOGS,
generated::kape_generated::KAPE_FILE_TODOSQLITE_DB,
generated::kape_generated::KAPE_FILE_AVATARS_USERAVATAR_JPG,
generated::kape_generated::KAPE_FILE_USER_MIDNIGHT_COMMANDER,
generated::kape_generated::KAPE_FILE_ROAMING_MOBAXTERM,
generated::kape_generated::KAPE_FILE_MSTY_DB,
generated::kape_generated::KAPE_FILE_LOCAL_MULTICOMMANDER,
generated::kape_generated::KAPE_FILE_MULTICOMMANDER_CONFIG,
generated::kape_generated::KAPE_FILE_MULTICOMMANDER_LOGS,
generated::kape_generated::KAPE_FILE_MULTICOMMANDER_USERDATA,
generated::kape_generated::KAPE_FILE_MULTICOMMANDER_MULTICOMMANDER_LOG,
generated::kape_generated::KAPE_FILE_NESSUS_CONF,
generated::kape_generated::KAPE_FILE_NESSUS_LOGS,
generated::kape_generated::KAPE_FILE_LOG_USER,
generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_DATA,
generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_CONFIG,
generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_TMP,
generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_LOG,
generated::kape_generated::KAPE_FILE_NET_MONITOR_CLIENT_C,
generated::kape_generated::KAPE_FILE_NOTEPAD_BACKUP,
generated::kape_generated::KAPE_FILE_NOTEPAD_CONFIG_XML,
generated::kape_generated::KAPE_FILE_NOTEPAD_SESSION_XML,
generated::kape_generated::KAPE_FILE_ROAMING_NOTION_NOTION_DB,
generated::kape_generated::KAPE_FILE_PARTITIONS_NOTION_CUSTOM_DICTIONARY_TXT,
generated::kape_generated::KAPE_FILE_USER_ONECOMMANDER,
generated::kape_generated::KAPE_FILE_ONEC,
generated::kape_generated::KAPE_FILE_MICROSOFT_ONEDRIVE,
generated::kape_generated::KAPE_FILE_USER_ONEDRIVE,
generated::kape_generated::KAPE_FILE_SSH_CONFIG_2,
generated::kape_generated::KAPE_FILE_SSH_KNOWN_HOSTS_2,
generated::kape_generated::KAPE_FILE_SSH_PUB,
generated::kape_generated::KAPE_FILE_SSH_ID_RSA,
generated::kape_generated::KAPE_FILE_SSH_ID_ECDSA,
generated::kape_generated::KAPE_FILE_SSH_ID_ECDSA_SK,
generated::kape_generated::KAPE_FILE_SSH_ID_ED25519,
generated::kape_generated::KAPE_FILE_SSH_ID_ED25519_SK,
generated::kape_generated::KAPE_FILE_SSH_ID_DSA,
generated::kape_generated::KAPE_FILE_SSH_SSHD_CONFIG,
generated::kape_generated::KAPE_FILE_LOGS_2,
generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_ECDSA_KEY,
generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_ED25519_KEY,
generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_DSA_KEY,
generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_RSA_KEY,
generated::kape_generated::KAPE_FILE_SSH_AUTHORIZED_KEYS,
generated::kape_generated::KAPE_FILE_SSH_AUTHORIZED_KEYS2,
generated::kape_generated::KAPE_FILE_SSH_ADMINISTRATORS_AUTHORIZED_KEYS,
generated::kape_generated::KAPE_FILE_OPENVPN_CONFIG,
generated::kape_generated::KAPE_FILE_OPENVPN_CLIENT_CONFI,
generated::kape_generated::KAPE_FILE_LOG_LOG_3,
generated::kape_generated::KAPE_FILE_OUTLOOK_PST,
generated::kape_generated::KAPE_FILE_OUTLOOK_OST,
generated::kape_generated::KAPE_FILE_OUTLOOK_FILES_PST,
generated::kape_generated::KAPE_FILE_OUTLOOK_FILES_OST,
generated::kape_generated::KAPE_FILE_PST,
generated::kape_generated::KAPE_FILE_OST,
generated::kape_generated::KAPE_FILE_OUTLOOK_NST,
generated::kape_generated::KAPE_FILE_INETCACHE_CONTENT_OUTLOOK,
generated::kape_generated::KAPE_FILE_PDQ_DEPLOY_DB,
generated::kape_generated::KAPE_FILE_PALO_ALTO_NETWORKS_GLOBALPROTECT_PANGP_LOG,
generated::kape_generated::KAPE_FILE_PALO_ALTO_NETWORKS_GLOBALPROTECT_LOG,
generated::kape_generated::KAPE_FILE_ROAMING_PEAZIP,
generated::kape_generated::KAPE_FILE_PROTONVPN_LOGS,
generated::kape_generated::KAPE_FILE_PROTON_VPN_LOGS,
generated::kape_generated::KAPE_FILE_SERVICEDATA_LOGS,
generated::kape_generated::KAPE_FILE_PROTON_VPN_STORAGE,
generated::kape_generated::KAPE_FILE_PULSE_SECURE_LOGGING,
generated::kape_generated::KAPE_FILE_PULSE_SECURE_LOGS_IN,
generated::kape_generated::KAPE_FILE_PULSE_SECURE_SETUP_CLIENT_LOG,
generated::kape_generated::KAPE_FILE_PULSE_SECURE_LOGGING_PULSECLIENT_LOG,
generated::kape_generated::KAPE_FILE_Q_DIR_Q_DIR_INI,
generated::kape_generated::KAPE_FILE_Q_DIR_START_QDR,
generated::kape_generated::KAPE_FILE_QNAP_QFINDERPRO,
generated::kape_generated::KAPE_FILE_LOG_PROXY_TXT,
generated::kape_generated::KAPE_FILE_LOG_PROXY_LOG,
generated::kape_generated::KAPE_FILE_LOG_SCHEDULER_TXT,
generated::kape_generated::KAPE_FILE_LOG_SCHEDULER_LOG,
generated::kape_generated::KAPE_FILE_C_RDG,
generated::kape_generated::KAPE_FILE_C_RDG_OLD,
generated::kape_generated::KAPE_FILE_REMOTE_DESKTOP_CONNECTION_MANAGER_SETTINGS,
generated::kape_generated::KAPE_FILE_MY_CERTIFICATES,
generated::kape_generated::KAPE_FILE_RSERVER30_RADM_LOG_HTM,
generated::kape_generated::KAPE_FILE_RADMIN_SERVER_64BIT,
generated::kape_generated::KAPE_FILE_HTM,
generated::kape_generated::KAPE_FILE_HTM_2,
generated::kape_generated::KAPE_FILE_RADMIN_VIEWER_CHATS,
generated::kape_generated::KAPE_FILE_USERS_USER_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_SYSTEM,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_CONFIG_RCLONE_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_CONFIG_RCLONE_RCLONE_CONF_2,
generated::kape_generated::KAPE_FILE_CONFIG_RCLONE_RCLONE_CONF_3,
generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_LOCALS,
generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_NETWOR,
generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_2,
generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_3,
generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_4,
generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_5,
generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_2,
generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_3,
generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_4,
generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_5,
generated::kape_generated::KAPE_FILE_WINDOWS_SYSWOW64_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_WINDOWS_SYSTEM32_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_C_WINDOWS_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_C_RCLONE_CONF,
generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_FALLBA,
generated::kape_generated::KAPE_FILE_ROAMING_REMCOS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_ROAMING_SCREENSHOTS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_ROAMING_NOTESS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_ROAMING_MICRECORDS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_ROAMING_HPSUPPORT_LOGS_DAT,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_REMCOS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_NOTESS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_SCREENSHOTS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_MICRECORDS_LOGS_DAT,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_HPSUPPORT_LOGS_DAT,
generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_DB,
generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_XML,
generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_CONNECTIONS_LOG,
generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_REMOTEDESKTOPMANA,
generated::kape_generated::KAPE_FILE_MRU_XML,
generated::kape_generated::KAPE_FILE_FAVORITES_XML,
generated::kape_generated::KAPE_FILE_REMOTE_MANIPULATOR_SYSTEM_HOST_LOGS_RMS_LOG_HTML,
generated::kape_generated::KAPE_FILE_REMOTE_MANIPULATOR_SYSTEM_LOGS_RMS_LOG_HTML,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_REMOTE_MANIPULATOR_SYSTEM_INSTALL_LOG,
generated::kape_generated::KAPE_FILE_REMOTE_UTILITIES_HOST_LOGS_RUT_LOG_HTML,
generated::kape_generated::KAPE_FILE_REMOTE_UTILITIES_LOGS_RUT_LOG_HTML,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_REMOTE_UTILITIES_INSTALL_LOG,
generated::kape_generated::KAPE_FILE_SCRIPTS_S,
generated::kape_generated::KAPE_FILE_DEBUG_LOG,
generated::kape_generated::KAPE_FILE_LOGS_3,
generated::kape_generated::KAPE_FILE_CONFIG_XML,
generated::kape_generated::KAPE_FILE_SSH_KEYS,
generated::kape_generated::KAPE_FILE_SSL_CERTIFICATES,
generated::kape_generated::KAPE_FILE_PGP_KEYS,
generated::kape_generated::KAPE_FILE_ROBO_FTP_SSH_KEYS,
generated::kape_generated::KAPE_FILE_ROBO_FTP_SSL_CERTIFI,
generated::kape_generated::KAPE_FILE_ROBO_FTP_PGP_KEYS,
generated::kape_generated::KAPE_FILE_DEBUG,
generated::kape_generated::KAPE_FILE_ROBO_FTP_SCRIPT_TRAC,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_CONFIG_XML,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_SCHEDULERSERVICE_SQLITE,
generated::kape_generated::KAPE_FILE_ROAMING_RUSTDESK,
generated::kape_generated::KAPE_FILE_LOG_SERVER,
generated::kape_generated::KAPE_FILE_POWERSHELL_PSREADLINECONSOLEHOST_HISTORY_TXT,
generated::kape_generated::KAPE_FILE_USERS_USER_BASH_HISTORY,
generated::kape_generated::KAPE_FILE_USERS_USER_ZSH_HISTORY,
generated::kape_generated::KAPE_FILE_USERS_USER_PS1,
generated::kape_generated::KAPE_FILE_USERS_USER_BAT,
generated::kape_generated::KAPE_FILE_USERS_USER_CMD,
generated::kape_generated::KAPE_FILE_USERS_USER_SH,
generated::kape_generated::KAPE_FILE_USER_SSHKNOWN_HOSTS,
generated::kape_generated::KAPE_FILE_USER_SSHCONFIG,
generated::kape_generated::KAPE_FILE_USER_SSH,
generated::kape_generated::KAPE_FILE_APP_DATA_SESSION_DB,
generated::kape_generated::KAPE_FILE_APP_DATA_USER_XML,
generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_4,
generated::kape_generated::KAPE_FILE_SCREENCONNECT_CLIENT_USER_CONFIG,
generated::kape_generated::KAPE_FILE_ROAMING_SESSION,
generated::kape_generated::KAPE_FILE_DOCUMENTS_SHAREX,
generated::kape_generated::KAPE_FILE_PORTAL_SETTINGS,
generated::kape_generated::KAPE_FILE_SIGNAL_ATTACHMENTS_NOINDEX,
generated::kape_generated::KAPE_FILE_SIGNAL_LOGS,
generated::kape_generated::KAPE_FILE_SIGNAL_CONFIG_JSON,
generated::kape_generated::KAPE_FILE_SQL_DB_SQLITE,
generated::kape_generated::KAPE_FILE_JWRAPPER_REMOTE_ACCESS_LOGS,
generated::kape_generated::KAPE_FILE_SIMPLEHELP_LOGS,
generated::kape_generated::KAPE_FILE_JWRAPPER_SIMPLEHELP_TECHNICIAN_LOGS,
generated::kape_generated::KAPE_FILE_MAIN_DB,
generated::kape_generated::KAPE_FILE_SKYPE_DB,
generated::kape_generated::KAPE_FILE_MAIN_DB_XP,
generated::kape_generated::KAPE_FILE_MAIN_DB_WIN7,
generated::kape_generated::KAPE_FILE_LOCALSTATE_S4L_DB,
generated::kape_generated::KAPE_FILE_INDEXEDDB_LEVELDB,
generated::kape_generated::KAPE_FILE_SKYPE_FOR_DESKTOP_CACHE,
generated::kape_generated::KAPE_FILE_SLACK_INDEXEDDB,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_4,
generated::kape_generated::KAPE_FILE_SLACK_LOGS,
generated::kape_generated::KAPE_FILE_SLACK_CACHE,
generated::kape_generated::KAPE_FILE_SLACK_STORAGE,
generated::kape_generated::KAPE_FILE_SNAGIT_DATASTORE,
generated::kape_generated::KAPE_FILE_C_NETSCAN_XML,
generated::kape_generated::KAPE_FILE_SPEEDPROJECT_SPEEDCOMMANDER_19,
generated::kape_generated::KAPE_FILE_SERVER_LOG,
generated::kape_generated::KAPE_FILE_TEMP_LOG,
generated::kape_generated::KAPE_FILE_SPLASHTOP_GATEWAY_LOG,
generated::kape_generated::KAPE_FILE_LOG,
generated::kape_generated::KAPE_FILE_APPCACHE_LIBRARYCACHE,
generated::kape_generated::KAPE_FILE_CONFIG_LOGINUSERS_VDF,
generated::kape_generated::KAPE_FILE_CONFIG_LOCALCONFIG_VDF,
generated::kape_generated::KAPE_FILE_CONFIG_AVATARCACHE,
generated::kape_generated::KAPE_FILE_STEAM_GAMES,
generated::kape_generated::KAPE_FILE_LOGS_BOOTSTRAP_LOG_TXT,
generated::kape_generated::KAPE_FILE_STEAM_GAME_IMAGE_FIL,
generated::kape_generated::KAPE_FILE_STEAM_LOGIN_METADATA,
generated::kape_generated::KAPE_FILE_STEAM_FRIEND_LIST_AN,
generated::kape_generated::KAPE_FILE_STEAM_USER_AVATAR_FI,
generated::kape_generated::KAPE_FILE_STEAM_GAME_TRAY_ICON,
generated::kape_generated::KAPE_FILE_STEAM_STARTUP_TIMES,
generated::kape_generated::KAPE_FILE_SETTINGS_SESSION_SUBLIME_SESSION,
generated::kape_generated::KAPE_FILE_LOCAL_SUBLIME_SESSION,
generated::kape_generated::KAPE_FILE_SUGARSYNC_SC1_LOG,
generated::kape_generated::KAPE_FILE_DOCUMENTS_SUGARSYNC_SHARED_FOLDERS,
generated::kape_generated::KAPE_FILE_DOCUMENTS_MY_SUGARSYNC,
generated::kape_generated::KAPE_FILE_LOCAL_SUMATRAPDFSUMATRAPDF_SETTINGS_TXT,
generated::kape_generated::KAPE_FILE_SUMATRAPDF_SUMATRAPDFCACHE,
generated::kape_generated::KAPE_FILE_SUPREMOREMOTEDESKTOP_LOG_LOG,
generated::kape_generated::KAPE_FILE_SUPREMOREMOTEDESKTOP_INBOX,
generated::kape_generated::KAPE_FILE_LOCAL_SYNCTHING,
generated::kape_generated::KAPE_FILE_LOCAL_SYNCTRAZOR,
generated::kape_generated::KAPE_FILE_ROAMING_SYNCTRAZOR,
generated::kape_generated::KAPE_FILE_CONFIG_REMEMBER_XML,
generated::kape_generated::KAPE_FILE_CONFIG_WINDOW_XML,
generated::kape_generated::KAPE_FILE_CONFIG_WINDOW1_XML,
generated::kape_generated::KAPE_FILE_TEAMVIEWER_CONNECTIONS_TXT,
generated::kape_generated::KAPE_FILE_TEAMVIEWER_TEAMVIEWER_LOGFILE,
generated::kape_generated::KAPE_FILE_TEAMVIEWER_APPLICATI,
generated::kape_generated::KAPE_FILE_MRU_REMOTESUPPORT,
generated::kape_generated::KAPE_FILE_ROAMING_TELEGRAM_DESKTOP,
generated::kape_generated::KAPE_FILE_DOWNLOADS_TELEGRAM_DESKTOP,
generated::kape_generated::KAPE_FILE_ROAMING_TERACOPY,
generated::kape_generated::KAPE_FILE_CRASH_REPORTS_INSTALLTIME,
generated::kape_generated::KAPE_FILE_THUNDERBIRD_PROFILES_INI,
generated::kape_generated::KAPE_FILE_PREFS_JS,
generated::kape_generated::KAPE_FILE_GLOBAL_MESSAGES_DB_SQLITE,
generated::kape_generated::KAPE_FILE_LOGINS_JSON,
generated::kape_generated::KAPE_FILE_PLACES_SQLITE,
generated::kape_generated::KAPE_FILE_IMAPMAIL_INBOX,
generated::kape_generated::KAPE_FILE_MAIL_INBOX,
generated::kape_generated::KAPE_FILE_CALENDAR_DATA_LOCAL_SQLITE,
generated::kape_generated::KAPE_FILE_ATTACHMENTS,
generated::kape_generated::KAPE_FILE_ABOOK_SQLITE,
generated::kape_generated::KAPE_FILE_GHISLER_WINCMD_INI,
generated::kape_generated::KAPE_FILE_C_TOTALCMD_LOG,
generated::kape_generated::KAPE_FILE_TEMP_FTP_TMP,
generated::kape_generated::KAPE_FILE_GHISLER_WCX_FTP_INI,
generated::kape_generated::KAPE_FILE_GHISLER_TREEINFO_WC,
generated::kape_generated::KAPE_FILE_GHISLER_TCDIRFRQ_TXT,
generated::kape_generated::KAPE_FILE_TEMP_TCFTP_LOG,
generated::kape_generated::KAPE_FILE_JAM_SOFTWARE_TREESIZE_SCANHISTORY_XML,
generated::kape_generated::KAPE_FILE_UEMS_AGENT_LOGS_LOG,
generated::kape_generated::KAPE_FILE_UNIFIED_ENDPOINT_MAN,
generated::kape_generated::KAPE_FILE_ROAMING_ULTRAVIEWER,
generated::kape_generated::KAPE_FILE_ULTRAVIEWER_SYSTEM_L,
generated::kape_generated::KAPE_FILE_PROGRAM_FILES_ULTRAVIEWERULTRAVIEWERSERVICE_LOG_TX,
generated::kape_generated::KAPE_FILE_PROGRAM_FILES_ULTRAVIEWERCONNECTIONLOG_LOG,
generated::kape_generated::KAPE_FILE_VLC_VLC_QT_INTERFACE_INI,
generated::kape_generated::KAPE_FILE_VIDEOS_VLC_AVI,
generated::kape_generated::KAPE_FILE_ROAMING_VMWARE,
generated::kape_generated::KAPE_FILE_C_VMEM,
generated::kape_generated::KAPE_FILE_C_VMSS,
generated::kape_generated::KAPE_FILE_C_VMSN,
generated::kape_generated::KAPE_FILE_REALVNC_VNCSERVER_LOG,
generated::kape_generated::KAPE_FILE_REALVNC_VNCVIEWER_LOG,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_REALVNC_SERVICEVNCSERVER_LOG,
generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_5,
generated::kape_generated::KAPE_FILE_SERVER_LOGS_2,
generated::kape_generated::KAPE_FILE_VIBERPC_CONFIG_DB,
generated::kape_generated::KAPE_FILE_VIBER_DB,
generated::kape_generated::KAPE_FILE_AVATARS,
generated::kape_generated::KAPE_FILE_BACKGROUNDS,
generated::kape_generated::KAPE_FILE_THUMBNAILS,
generated::kape_generated::KAPE_FILE_C_VBOX,
generated::kape_generated::KAPE_FILE_C_VBOX_PREV,
generated::kape_generated::KAPE_FILE_C_VBOX_LOG,
generated::kape_generated::KAPE_FILE_VIRTUALBOX_BACKUP_LO,
generated::kape_generated::KAPE_FILE_C_VBOXHARDENING_LOG,
generated::kape_generated::KAPE_FILE_C_SAV,
generated::kape_generated::KAPE_FILE_HISTORY,
generated::kape_generated::KAPE_FILE_GLOBALSTORAGE_STORAGE_JSON,
generated::kape_generated::KAPE_FILE_CACHEDEXTENSIONS_USER,
generated::kape_generated::KAPE_FILE_USER_SETTINGS_JSON,
generated::kape_generated::KAPE_FILE_CODE_PREFERENCES,
generated::kape_generated::KAPE_FILE_NETWORK_COOKIES,
generated::kape_generated::KAPE_FILE_NETWORK_NETWORK_PERSISTENT_STATE,
generated::kape_generated::KAPE_FILE_CODE_LOGS,
generated::kape_generated::KAPE_FILE_BACKUPS,
generated::kape_generated::KAPE_FILE_WHATSAPP_CACHE,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_5,
generated::kape_generated::KAPE_FILE_MICROSOFT_STORE_WHAT,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_2_2,
generated::kape_generated::KAPE_FILE_LOCALSTATE_PROFILEPICTURES,
generated::kape_generated::KAPE_FILE_TRANSFERSREGEX_JPG_MP4_PDF_WEBP,
generated::kape_generated::KAPE_FILE_C_WINSCP_INI,
generated::kape_generated::KAPE_FILE_LOCALCACHE_INDEXED,
generated::kape_generated::KAPE_FILE_XYPLORER_XYPLORER_INI,
generated::kape_generated::KAPE_FILE_PANE_INI,
generated::kape_generated::KAPE_FILE_XYPLORER_AUTOBACKUP,
generated::kape_generated::KAPE_FILE_ROAMING_XYPLORER_DAT,
generated::kape_generated::KAPE_FILE_PROGRAM_FILES_XEOX_LOG,
generated::kape_generated::KAPE_FILE_LOCAL_ZSCALER,
generated::kape_generated::KAPE_FILE_ZOHOMEETING_LOG,
generated::kape_generated::KAPE_FILE_LOCAL_ZOHOMEETING_CONF,
generated::kape_generated::KAPE_FILE_ZOHO_ASSIST_LOG_FILE,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_ZOHOMEETING_CONF,
generated::kape_generated::KAPE_FILE_ZOHOMEETING_LOGS,
generated::kape_generated::KAPE_FILE_UNATTENDED_ZOHOMEETING_CONF,
generated::kape_generated::KAPE_FILE_UNATTENDED_ZOHOMEETING_TXT,
generated::kape_generated::KAPE_FILE_ZOOM_LOGS,
generated::kape_generated::KAPE_FILE_ZOOM,
generated::kape_generated::KAPE_FILE_ZOOM_CLIENT_RECORDIN,
generated::kape_generated::KAPE_FILE_ROAMING_ZOOM_PLUGIN_JSON,
generated::kape_generated::KAPE_FILE_MOBILESYNC_BACKUP,
generated::kape_generated::KAPE_FILE_ITUNES_BACKUP_FOLDER,
generated::kape_generated::KAPE_FILE_MOBILESYNC_BACKUP_2,
generated::kape_generated::KAPE_FILE_MIRC_LOGS,
generated::kape_generated::KAPE_FILE_MIRC_CHAT_LOGS_2000,
generated::kape_generated::KAPE_FILE_MREMOTENG_MREMOTENG_LOG,
generated::kape_generated::KAPE_FILE_MREMOTENG_CONFCONS_XML,
generated::kape_generated::KAPE_FILE_MREMOTENG_USER_CONFIG,
generated::kape_generated::KAPE_FILE_PCLOUD_DB,
generated::kape_generated::KAPE_FILE_PCLOUD_DB_WAL,
generated::kape_generated::KAPE_FILE_PCLOUD_DB_SHM,
generated::kape_generated::KAPE_FILE_360BOOKMARKS,
generated::kape_generated::KAPE_FILE_COOKIES,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION,
generated::kape_generated::KAPE_FILE_CURRENT_TABS,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES,
generated::kape_generated::KAPE_FILE_FAVICONS,
generated::kape_generated::KAPE_FILE_360HISTORY,
generated::kape_generated::KAPE_FILE_LAST_SESSION,
generated::kape_generated::KAPE_FILE_LAST_TABS,
generated::kape_generated::KAPE_FILE_SESSIONS,
generated::kape_generated::KAPE_FILE_LOGIN_DATA,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE,
generated::kape_generated::KAPE_FILE_PREFERENCES,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL,
generated::kape_generated::KAPE_FILE_SHORTCUTS,
generated::kape_generated::KAPE_FILE_TOP_SITES,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS,
generated::kape_generated::KAPE_FILE_SYNC_DATA,
generated::kape_generated::KAPE_FILE_VISITED_LINKS,
generated::kape_generated::KAPE_FILE_WEB_DATA,
generated::kape_generated::KAPE_FILE_PROTECT_2,
generated::kape_generated::KAPE_FILE_SNAPSHOTS,
generated::kape_generated::KAPE_FILE_NETWORKCOOKIES,
generated::kape_generated::KAPE_FILE_FAVICONS_2,
generated::kape_generated::KAPE_FILE_HISTORY_2,
generated::kape_generated::KAPE_FILE_SESSIONS_2,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_2,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_2,
generated::kape_generated::KAPE_FILE_PREFERENCES_2,
generated::kape_generated::KAPE_FILE_SHORTCUTS_2,
generated::kape_generated::KAPE_FILE_TOP_SITES_2,
generated::kape_generated::KAPE_FILE_SYNC_DATA_2,
generated::kape_generated::KAPE_FILE_BOOKMARKS,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_2,
generated::kape_generated::KAPE_FILE_WEB_DATA_2,
generated::kape_generated::KAPE_FILE_LOCAL_ARCSTORABLE_JSON,
generated::kape_generated::KAPE_FILE_LOCALCACHE_LOCALCOM_PLIST,
generated::kape_generated::KAPE_FILE_BOOKMARKS_2,
generated::kape_generated::KAPE_FILE_COOKIES_2,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_2,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_2,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_2,
generated::kape_generated::KAPE_FILE_FAVICONS_3,
generated::kape_generated::KAPE_FILE_HISTORY_3,
generated::kape_generated::KAPE_FILE_DEFAULT_SESSIONS,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_3,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_3,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_2,
generated::kape_generated::KAPE_FILE_PREFERENCES_3,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_2,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_2,
generated::kape_generated::KAPE_FILE_SHORTCUTS_3,
generated::kape_generated::KAPE_FILE_PUBLISHER_INFO_DB,
generated::kape_generated::KAPE_FILE_TOP_SITES_3,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_3,
generated::kape_generated::KAPE_FILE_WEB_DATA_3,
generated::kape_generated::KAPE_FILE_SECURE_PREFERENCES,
generated::kape_generated::KAPE_FILE_CACHE,
generated::kape_generated::KAPE_FILE_CHROME_BETA_CACHE_FO,
generated::kape_generated::KAPE_FILE_CHROME_DEV_CACHE_FOL,
generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_CA,
generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_CACHE,
generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_BETA_C,
generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_DEV_CA,
generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_SXS_CA,
generated::kape_generated::KAPE_FILE_CHROMIUM_CACHE_FOLDE,
generated::kape_generated::KAPE_FILE_PROFILES,
generated::kape_generated::KAPE_FILE_WINDOWS_TEMPORARY_INTERNET_FILES,
generated::kape_generated::KAPE_FILE_CONTENT_IE5_INDEX_DAT,
generated::kape_generated::KAPE_FILE_WINDOWS_INETCACHE,
generated::kape_generated::KAPE_FILE_WINDOWS_WEBCACHE,
generated::kape_generated::KAPE_FILE_CACHE_CACHE_DATA,
generated::kape_generated::KAPE_FILE_BOOKMARKS_3,
generated::kape_generated::KAPE_FILE_COOKIES_3,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_3,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_3,
generated::kape_generated::KAPE_FILE_FAVICONS_4,
generated::kape_generated::KAPE_FILE_HISTORY_4,
generated::kape_generated::KAPE_FILE_LAST_SESSION_2,
generated::kape_generated::KAPE_FILE_LAST_TABS_2,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_4,
generated::kape_generated::KAPE_FILE_PREFERENCES_4,
generated::kape_generated::KAPE_FILE_SHORTCUTS_4,
generated::kape_generated::KAPE_FILE_TOP_SITES_4,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_4,
generated::kape_generated::KAPE_FILE_WEB_DATA_4,
generated::kape_generated::KAPE_FILE_CHROME_BOOKMARKS,
generated::kape_generated::KAPE_FILE_CHROME_COOKIES,
generated::kape_generated::KAPE_FILE_CHROME_CURRENT_SESSI,
generated::kape_generated::KAPE_FILE_CHROME_CURRENT_TABS,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_3,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_2,
generated::kape_generated::KAPE_FILE_CHROME_FAVICONS,
generated::kape_generated::KAPE_FILE_CHROME_HISTORY,
generated::kape_generated::KAPE_FILE_CHROME_LAST_SESSION,
generated::kape_generated::KAPE_FILE_CHROME_LAST_TABS,
generated::kape_generated::KAPE_FILE_SESSIONS_3,
generated::kape_generated::KAPE_FILE_CHROME_LOGIN_DATA,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_2,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_4,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_3,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE,
generated::kape_generated::KAPE_FILE_CHROME_PREFERENCES,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_3,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_3,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL,
generated::kape_generated::KAPE_FILE_CHROME_SHORTCUTS,
generated::kape_generated::KAPE_FILE_CHROME_TOP_SITES,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_2,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3,
generated::kape_generated::KAPE_FILE_CHROME_VISITED_LINKS,
generated::kape_generated::KAPE_FILE_CHROME_WEB_DATA,
generated::kape_generated::KAPE_FILE_INDEXEDDB,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_6,
generated::kape_generated::KAPE_FILE_PROTECT_3,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_2,
generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_HISTOR,
generated::kape_generated::KAPE_FILE_BOOKMARKS_4,
generated::kape_generated::KAPE_FILE_COOKIES_4,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_4,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_4,
generated::kape_generated::KAPE_FILE_FAVICONS_5,
generated::kape_generated::KAPE_FILE_HISTORY_5,
generated::kape_generated::KAPE_FILE_LAST_SESSION_3,
generated::kape_generated::KAPE_FILE_LAST_TABS_3,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_5,
generated::kape_generated::KAPE_FILE_PREFERENCES_5,
generated::kape_generated::KAPE_FILE_SHORTCUTS_5,
generated::kape_generated::KAPE_FILE_TOP_SITES_5,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_5,
generated::kape_generated::KAPE_FILE_WEB_DATA_5,
generated::kape_generated::KAPE_FILE_CHROME_BETA_BOOKMARK,
generated::kape_generated::KAPE_FILE_CHROME_BETA_COOKIES,
generated::kape_generated::KAPE_FILE_CHROME_BETA_CURRENT,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_2_2,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_4,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_3,
generated::kape_generated::KAPE_FILE_CHROME_BETA_FAVICONS,
generated::kape_generated::KAPE_FILE_CHROME_BETA_HISTORY,
generated::kape_generated::KAPE_FILE_CHROME_BETA_LAST_SES,
generated::kape_generated::KAPE_FILE_CHROME_BETA_LAST_TAB,
generated::kape_generated::KAPE_FILE_SESSIONS_4,
generated::kape_generated::KAPE_FILE_CHROME_BETA_LOGIN_DA,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_3,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_5,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_4,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_2,
generated::kape_generated::KAPE_FILE_CHROME_BETA_PREFEREN,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_4,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_2,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_4,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_2,
generated::kape_generated::KAPE_FILE_CHROME_BETA_SHORTCUT,
generated::kape_generated::KAPE_FILE_CHROME_BETA_TOP_SITE,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_3,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_2,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_2,
generated::kape_generated::KAPE_FILE_CHROME_BETA_VISITED,
generated::kape_generated::KAPE_FILE_CHROME_BETA_WEB_DATA,
generated::kape_generated::KAPE_FILE_INDEXEDDB_2,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_7,
generated::kape_generated::KAPE_FILE_PROTECT_4,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_3,
generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_BETA_H,
generated::kape_generated::KAPE_FILE_BOOKMARKS_5,
generated::kape_generated::KAPE_FILE_COOKIES_5,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_5,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_5,
generated::kape_generated::KAPE_FILE_FAVICONS_6,
generated::kape_generated::KAPE_FILE_HISTORY_6,
generated::kape_generated::KAPE_FILE_LAST_SESSION_4,
generated::kape_generated::KAPE_FILE_LAST_TABS_4,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_6,
generated::kape_generated::KAPE_FILE_PREFERENCES_6,
generated::kape_generated::KAPE_FILE_SHORTCUTS_6,
generated::kape_generated::KAPE_FILE_TOP_SITES_6,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_6,
generated::kape_generated::KAPE_FILE_WEB_DATA_6,
generated::kape_generated::KAPE_FILE_CHROME_DEV_BOOKMARKS,
generated::kape_generated::KAPE_FILE_CHROME_DEV_COOKIES,
generated::kape_generated::KAPE_FILE_CHROME_DEV_CURRENT_S,
generated::kape_generated::KAPE_FILE_CHROME_DEV_CURRENT_T,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_5,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_4,
generated::kape_generated::KAPE_FILE_CHROME_DEV_FAVICONS,
generated::kape_generated::KAPE_FILE_CHROME_DEV_HISTORY,
generated::kape_generated::KAPE_FILE_CHROME_DEV_LAST_SESS,
generated::kape_generated::KAPE_FILE_CHROME_DEV_LAST_TABS,
generated::kape_generated::KAPE_FILE_SESSIONS_5,
generated::kape_generated::KAPE_FILE_CHROME_DEV_LOGIN_DAT,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_4,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_6,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_5,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_3,
generated::kape_generated::KAPE_FILE_CHROME_DEV_PREFERENC,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_5,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_3,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_5,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_3,
generated::kape_generated::KAPE_FILE_CHROME_DEV_SHORTCUTS,
generated::kape_generated::KAPE_FILE_CHROME_DEV_TOP_SITES,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_4,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_3,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_3,
generated::kape_generated::KAPE_FILE_CHROME_DEV_VISITED_L,
generated::kape_generated::KAPE_FILE_CHROME_DEV_WEB_DATA,
generated::kape_generated::KAPE_FILE_INDEXEDDB_3,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_8,
generated::kape_generated::KAPE_FILE_PROTECT_5,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_4,
generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_DEV_HI,
generated::kape_generated::KAPE_FILE_EXTENSIONS_MANIFEST_JSON,
generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON,
generated::kape_generated::KAPE_FILE_CHROME_BETA_BROWSER,
generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON_2,
generated::kape_generated::KAPE_FILE_CHROME_DEV_BROWSER_E,
generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON_3,
generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_BR,
generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON_4,
generated::kape_generated::KAPE_FILE_EXTENSIONS,
generated::kape_generated::KAPE_FILE_CHROME_EXTENSION_FIL,
generated::kape_generated::KAPE_FILE_CHROME_BETA_EXTENSIO,
generated::kape_generated::KAPE_FILE_EXTENSIONS_2,
generated::kape_generated::KAPE_FILE_CHROME_DEV_EXTENSION,
generated::kape_generated::KAPE_FILE_EXTENSIONS_3,
generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_EX,
generated::kape_generated::KAPE_FILE_EXTENSIONS_4,
generated::kape_generated::KAPE_FILE_FILE_SYSTEM,
generated::kape_generated::KAPE_FILE_CHROME_BETA_HTML5_FI,
generated::kape_generated::KAPE_FILE_CHROME_DEV_HTML5_FIL,
generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_HT,
generated::kape_generated::KAPE_FILE_BOOKMARKS_6,
generated::kape_generated::KAPE_FILE_COOKIES_6,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_6,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_6,
generated::kape_generated::KAPE_FILE_FAVICONS_7,
generated::kape_generated::KAPE_FILE_HISTORY_7,
generated::kape_generated::KAPE_FILE_LAST_SESSION_5,
generated::kape_generated::KAPE_FILE_LAST_TABS_5,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_7,
generated::kape_generated::KAPE_FILE_PREFERENCES_7,
generated::kape_generated::KAPE_FILE_SHORTCUTS_7,
generated::kape_generated::KAPE_FILE_TOP_SITES_7,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_7,
generated::kape_generated::KAPE_FILE_WEB_DATA_7,
generated::kape_generated::KAPE_FILE_CHROME_SXS_BOOKMARKS,
generated::kape_generated::KAPE_FILE_CHROME_SXS_COOKIES,
generated::kape_generated::KAPE_FILE_CHROME_SXS_CURRENT_S,
generated::kape_generated::KAPE_FILE_CHROME_SXS_CURRENT_T,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_6,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_5,
generated::kape_generated::KAPE_FILE_CHROME_SXS_FAVICONS,
generated::kape_generated::KAPE_FILE_CHROME_SXS_HISTORY,
generated::kape_generated::KAPE_FILE_CHROME_SXS_LAST_SESS,
generated::kape_generated::KAPE_FILE_CHROME_SXS_LAST_TABS,
generated::kape_generated::KAPE_FILE_SESSIONS_6,
generated::kape_generated::KAPE_FILE_CHROME_SXS_LOGIN_DAT,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_5,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_7,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_6,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_4,
generated::kape_generated::KAPE_FILE_CHROME_SXS_PREFERENC,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_6,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_4,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_6,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_4,
generated::kape_generated::KAPE_FILE_CHROME_SXS_SHORTCUTS,
generated::kape_generated::KAPE_FILE_CHROME_SXS_TOP_SITES,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_5,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_4,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_4,
generated::kape_generated::KAPE_FILE_CHROME_SXS_VISITED_L,
generated::kape_generated::KAPE_FILE_CHROME_SXS_WEB_DATA,
generated::kape_generated::KAPE_FILE_INDEXEDDB_4,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_9,
generated::kape_generated::KAPE_FILE_PROTECT_6,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_5,
generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_SXS_HI,
generated::kape_generated::KAPE_FILE_BOOKMARKS_7,
generated::kape_generated::KAPE_FILE_COOKIES_7,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_7,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_7,
generated::kape_generated::KAPE_FILE_FAVICONS_8,
generated::kape_generated::KAPE_FILE_HISTORY_8,
generated::kape_generated::KAPE_FILE_LAST_SESSION_6,
generated::kape_generated::KAPE_FILE_LAST_TABS_6,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_8,
generated::kape_generated::KAPE_FILE_PREFERENCES_8,
generated::kape_generated::KAPE_FILE_SHORTCUTS_8,
generated::kape_generated::KAPE_FILE_TOP_SITES_8,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_8,
generated::kape_generated::KAPE_FILE_WEB_DATA_8,
generated::kape_generated::KAPE_FILE_CHROMIUM_BOOKMARKS,
generated::kape_generated::KAPE_FILE_CHROMIUM_COOKIES,
generated::kape_generated::KAPE_FILE_CHROMIUM_CURRENT_SES,
generated::kape_generated::KAPE_FILE_CHROMIUM_CURRENT_TAB,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_7,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_6,
generated::kape_generated::KAPE_FILE_CHROMIUM_FAVICONS,
generated::kape_generated::KAPE_FILE_CHROMIUM_HISTORY,
generated::kape_generated::KAPE_FILE_CHROMIUM_LAST_SESSIO,
generated::kape_generated::KAPE_FILE_CHROMIUM_LAST_TABS,
generated::kape_generated::KAPE_FILE_SESSIONS_7,
generated::kape_generated::KAPE_FILE_CHROMIUM_LOGIN_DATA,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_6,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_8,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_7,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_5,
generated::kape_generated::KAPE_FILE_CHROMIUM_PREFERENCES,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_7,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_5,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_7,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_5,
generated::kape_generated::KAPE_FILE_CHROMIUM_SHORTCUTS,
generated::kape_generated::KAPE_FILE_CHROMIUM_TOP_SITES,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_6,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_5,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_5,
generated::kape_generated::KAPE_FILE_CHROMIUM_VISITED_LIN,
generated::kape_generated::KAPE_FILE_CHROMIUM_WEB_DATA,
generated::kape_generated::KAPE_FILE_INDEXEDDB_5,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_10,
generated::kape_generated::KAPE_FILE_PROTECT_7,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_6,
generated::kape_generated::KAPE_FILE_SYSTEM_CHROMIUM_HIST,
generated::kape_generated::KAPE_FILE_BOOKMARKS_8,
generated::kape_generated::KAPE_FILE_COOKIES_8,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_8,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_8,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_8,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_7,
generated::kape_generated::KAPE_FILE_FAVICONS_9,
generated::kape_generated::KAPE_FILE_HISTORY_9,
generated::kape_generated::KAPE_FILE_LAST_SESSION_7,
generated::kape_generated::KAPE_FILE_LAST_TABS_7,
generated::kape_generated::KAPE_FILE_SESSIONS_8,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_9,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_7,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_9,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_8,
generated::kape_generated::KAPE_FILE_PREFERENCES_9,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_8,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_8,
generated::kape_generated::KAPE_FILE_SHORTCUTS_9,
generated::kape_generated::KAPE_FILE_TOP_SITES_9,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_7,
generated::kape_generated::KAPE_FILE_SYNC_DATA_3,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_9,
generated::kape_generated::KAPE_FILE_WEB_DATA_9,
generated::kape_generated::KAPE_FILE_PROTECT_8,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_7,
generated::kape_generated::KAPE_FILE_PACKAGES_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE,
generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE,
generated::kape_generated::KAPE_FILE_BOOKMARKS_9,
generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_2,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_9,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_9,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_8,
generated::kape_generated::KAPE_FILE_FAVICONS_10,
generated::kape_generated::KAPE_FILE_HISTORY_10,
generated::kape_generated::KAPE_FILE_LAST_SESSION_8,
generated::kape_generated::KAPE_FILE_LAST_TABS_8,
generated::kape_generated::KAPE_FILE_SESSIONS_9,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_10,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_8,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_10,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_9,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_6,
generated::kape_generated::KAPE_FILE_PREFERENCES_10,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_9,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_6,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_9,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_6,
generated::kape_generated::KAPE_FILE_SHORTCUTS_10,
generated::kape_generated::KAPE_FILE_TOP_SITES_10,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_8,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_6,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_6,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_10,
generated::kape_generated::KAPE_FILE_WEB_DATA_10,
generated::kape_generated::KAPE_FILE_INDEXEDDB_6,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_11,
generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE,
generated::kape_generated::KAPE_FILE_PROTECT_9,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_8,
generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_2,
generated::kape_generated::KAPE_FILE_BOOKMARKS_10,
generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_3,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_10,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_10,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_9,
generated::kape_generated::KAPE_FILE_FAVICONS_11,
generated::kape_generated::KAPE_FILE_HISTORY_11,
generated::kape_generated::KAPE_FILE_LAST_SESSION_9,
generated::kape_generated::KAPE_FILE_LAST_TABS_9,
generated::kape_generated::KAPE_FILE_SESSIONS_10,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_11,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_9,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_11,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_10,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_7,
generated::kape_generated::KAPE_FILE_PREFERENCES_11,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_10,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_7,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_10,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_7,
generated::kape_generated::KAPE_FILE_SHORTCUTS_11,
generated::kape_generated::KAPE_FILE_TOP_SITES_11,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_9,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_7,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_7,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_11,
generated::kape_generated::KAPE_FILE_WEB_DATA_11,
generated::kape_generated::KAPE_FILE_INDEXEDDB_7,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_12,
generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE_2,
generated::kape_generated::KAPE_FILE_PROTECT_10,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_9,
generated::kape_generated::KAPE_FILE_EXTENSIONS_5,
generated::kape_generated::KAPE_FILE_EDGE_BETA_CHROMIUM_E,
generated::kape_generated::KAPE_FILE_EDGE_DEV_CHROMIUM_EX,
generated::kape_generated::KAPE_FILE_EDGE_SXS_CANARY_CHRO,
generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_3,
generated::kape_generated::KAPE_FILE_BOOKMARKS_11,
generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_4,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_11,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_11,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_10,
generated::kape_generated::KAPE_FILE_FAVICONS_12,
generated::kape_generated::KAPE_FILE_HISTORY_12,
generated::kape_generated::KAPE_FILE_LAST_SESSION_10,
generated::kape_generated::KAPE_FILE_LAST_TABS_10,
generated::kape_generated::KAPE_FILE_SESSIONS_11,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_12,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_10,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_12,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_11,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_8,
generated::kape_generated::KAPE_FILE_PREFERENCES_12,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_11,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_8,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_11,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_8,
generated::kape_generated::KAPE_FILE_SHORTCUTS_12,
generated::kape_generated::KAPE_FILE_TOP_SITES_12,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_10,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_8,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_8,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_12,
generated::kape_generated::KAPE_FILE_WEB_DATA_12,
generated::kape_generated::KAPE_FILE_INDEXEDDB_8,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_13,
generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE_3,
generated::kape_generated::KAPE_FILE_PROTECT_11,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_10,
generated::kape_generated::KAPE_FILE_FILE_SYSTEM_2,
generated::kape_generated::KAPE_FILE_EDGE_BETA_HTML5_FILE,
generated::kape_generated::KAPE_FILE_EDGE_DEV_HTML5_FILE,
generated::kape_generated::KAPE_FILE_EDGE_SXS_CANARY_HTML,
generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_4,
generated::kape_generated::KAPE_FILE_BOOKMARKS_12,
generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_5,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_12,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_12,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_11,
generated::kape_generated::KAPE_FILE_FAVICONS_13,
generated::kape_generated::KAPE_FILE_HISTORY_13,
generated::kape_generated::KAPE_FILE_LAST_SESSION_11,
generated::kape_generated::KAPE_FILE_LAST_TABS_11,
generated::kape_generated::KAPE_FILE_SESSIONS_12,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_13,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_11,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_13,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_12,
generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_9,
generated::kape_generated::KAPE_FILE_PREFERENCES_13,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_12,
generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_9,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_12,
generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_9,
generated::kape_generated::KAPE_FILE_SHORTCUTS_13,
generated::kape_generated::KAPE_FILE_TOP_SITES_13,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_11,
generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_9,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_9,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_13,
generated::kape_generated::KAPE_FILE_WEB_DATA_13,
generated::kape_generated::KAPE_FILE_INDEXEDDB_9,
generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_14,
generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE_4,
generated::kape_generated::KAPE_FILE_PROTECT_12,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_11,
generated::kape_generated::KAPE_FILE_ADDONS_SQLITE,
generated::kape_generated::KAPE_FILE_WEAVE_BOOKMARKS_SQLITE,
generated::kape_generated::KAPE_FILE_BOOKMARKBACKUPS,
generated::kape_generated::KAPE_FILE_COOKIES_SQLITE,
generated::kape_generated::KAPE_FILE_FIREFOX_COOKIES_SQLITE,
generated::kape_generated::KAPE_FILE_DOWNLOADS_SQLITE,
generated::kape_generated::KAPE_FILE_EXTENSIONS_JSON,
generated::kape_generated::KAPE_FILE_FAVICONS_SQLITE,
generated::kape_generated::KAPE_FILE_FORMHISTORY_SQLITE,
generated::kape_generated::KAPE_FILE_PERMISSIONS_SQLITE,
generated::kape_generated::KAPE_FILE_PLACES_SQLITE_2,
generated::kape_generated::KAPE_FILE_PROTECTIONS_SQLITE,
generated::kape_generated::KAPE_FILE_SEARCH_SQLITE,
generated::kape_generated::KAPE_FILE_SIGNONS_SQLITE,
generated::kape_generated::KAPE_FILE_STORAGE_SYNC_SQLITE,
generated::kape_generated::KAPE_FILE_WEBAPPSTORE_SQLITE,
generated::kape_generated::KAPE_FILE_KEY_DB,
generated::kape_generated::KAPE_FILE_SIGNON,
generated::kape_generated::KAPE_FILE_LOGINS_JSON_2,
generated::kape_generated::KAPE_FILE_PREFS_JS_2,
generated::kape_generated::KAPE_FILE_SESSIONSTORE,
generated::kape_generated::KAPE_FILE_SESSIONSTORE_BACKUPS,
generated::kape_generated::KAPE_FILE_PLACES_XP,
generated::kape_generated::KAPE_FILE_DOWNLOADS_XP,
generated::kape_generated::KAPE_FILE_FORM_HISTORY_XP,
generated::kape_generated::KAPE_FILE_COOKIES_XP,
generated::kape_generated::KAPE_FILE_SIGNONS_XP,
generated::kape_generated::KAPE_FILE_WEBAPPSTORE_XP,
generated::kape_generated::KAPE_FILE_FAVICONS_XP,
generated::kape_generated::KAPE_FILE_ADDONS_XP,
generated::kape_generated::KAPE_FILE_SEARCH_XP,
generated::kape_generated::KAPE_FILE_PASSWORD_XP,
generated::kape_generated::KAPE_FILE_SIGNON_2,
generated::kape_generated::KAPE_FILE_LOGINS_JSON_2_2,
generated::kape_generated::KAPE_FILE_SESSIONSTORE_XP,
generated::kape_generated::KAPE_FILE_HISTORY_IE5_INDEX_DAT,
generated::kape_generated::KAPE_FILE_INDEX_DAT,
generated::kape_generated::KAPE_FILE_COOKIES_INDEX_DAT,
generated::kape_generated::KAPE_FILE_USERDATA_INDEX_DAT,
generated::kape_generated::KAPE_FILE_RECENT_INDEX_DAT,
generated::kape_generated::KAPE_FILE_INDEX_DAT_OFFICE,
generated::kape_generated::KAPE_FILE_MICROSOFT_INTERNET_EXPLORER,
generated::kape_generated::KAPE_FILE_ROAMING_INTERNET_EXP,
generated::kape_generated::KAPE_FILE_WINDOWS_HISTORY,
generated::kape_generated::KAPE_FILE_WINDOWS_COOKIES,
generated::kape_generated::KAPE_FILE_WINDOWS_IEDOWNLOADHISTORY,
generated::kape_generated::KAPE_FILE_WINDOWS_WEBCACHE_2,
generated::kape_generated::KAPE_FILE_WINDOWS_INETCOOKIES,
generated::kape_generated::KAPE_FILE_OPERA_SOFTWARE_OPERA_STABLE,
generated::kape_generated::KAPE_FILE_OPERA_ROAMING_FOLDER,
generated::kape_generated::KAPE_FILE_BOOKMARKS_13,
generated::kape_generated::KAPE_FILE_COOKIES_9,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_13,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_13,
generated::kape_generated::KAPE_FILE_FAVICONS_14,
generated::kape_generated::KAPE_FILE_HISTORY_14,
generated::kape_generated::KAPE_FILE_LAST_SESSION_12,
generated::kape_generated::KAPE_FILE_LAST_TABS_12,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_14,
generated::kape_generated::KAPE_FILE_PREFERENCES_14,
generated::kape_generated::KAPE_FILE_SHORTCUTS_14,
generated::kape_generated::KAPE_FILE_TOP_SITES_14,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_14,
generated::kape_generated::KAPE_FILE_WEB_DATA_14,
generated::kape_generated::KAPE_FILE_PRISMA_ACCESS_BROWSE,
generated::kape_generated::KAPE_FILE_COOKIES_2_2,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_2_2,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_2_3,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_9,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_12,
generated::kape_generated::KAPE_FILE_FAVICONS_2_2,
generated::kape_generated::KAPE_FILE_HISTORY_2_2,
generated::kape_generated::KAPE_FILE_LAST_SESSION_2_2,
generated::kape_generated::KAPE_FILE_LAST_TABS_2_2,
generated::kape_generated::KAPE_FILE_SESSIONS_13,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_2_2,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_12,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_14,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_13,
generated::kape_generated::KAPE_FILE_PREFERENCES_2_2,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_13,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_13,
generated::kape_generated::KAPE_FILE_SHORTCUTS_2_2,
generated::kape_generated::KAPE_FILE_TOP_SITES_2_2,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_12,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_10,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_2_2,
generated::kape_generated::KAPE_FILE_WEB_DATA_2_2,
generated::kape_generated::KAPE_FILE_PROTECT_13,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_12,
generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_HISTOR_2,
generated::kape_generated::KAPE_FILE_PRISMAACCESSBROWSER_USER_DATA_BACKUP,
generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERDATA_DB,
generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERAUTOCOMPLETES_DAT,
generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERPASSWORDFORMS_DAT,
generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERCREDENTIAL_DAT,
generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERSUBSCRIPTION,
generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERCOOKIES_DAT,
generated::kape_generated::KAPE_FILE_PUFFINSECUREBROWSER_IMAGE_CACHE,
generated::kape_generated::KAPE_FILE_BOOKMARKS_14,
generated::kape_generated::KAPE_FILE_COOKIES_10,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_14,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_14,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_10,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_13,
generated::kape_generated::KAPE_FILE_FAVICONS_15,
generated::kape_generated::KAPE_FILE_HISTORY_15,
generated::kape_generated::KAPE_FILE_LAST_SESSION_13,
generated::kape_generated::KAPE_FILE_LAST_TABS_13,
generated::kape_generated::KAPE_FILE_SESSIONS_14,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_15,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_13,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_15,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_14,
generated::kape_generated::KAPE_FILE_PREFERENCES_15,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_14,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_14,
generated::kape_generated::KAPE_FILE_SHORTCUTS_15,
generated::kape_generated::KAPE_FILE_TOP_SITES_15,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_13,
generated::kape_generated::KAPE_FILE_SYNC_DATA_4,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_15,
generated::kape_generated::KAPE_FILE_WEB_DATA_15,
generated::kape_generated::KAPE_FILE_PROTECT_14,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_13,
generated::kape_generated::KAPE_FILE_BOOKMARKS_15,
generated::kape_generated::KAPE_FILE_COOKIES_11,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_15,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_15,
generated::kape_generated::KAPE_FILE_FAVICONS_16,
generated::kape_generated::KAPE_FILE_HISTORY_16,
generated::kape_generated::KAPE_FILE_LAST_SESSION_14,
generated::kape_generated::KAPE_FILE_LAST_TABS_14,
generated::kape_generated::KAPE_FILE_SESSIONS_15,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_16,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_15,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_16,
generated::kape_generated::KAPE_FILE_PREFERENCES_16,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_15,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_14,
generated::kape_generated::KAPE_FILE_SYNC_DATA_5,
generated::kape_generated::KAPE_FILE_SHORTCUTS_16,
generated::kape_generated::KAPE_FILE_TOP_SITES_16,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_16,
generated::kape_generated::KAPE_FILE_WEB_DATA_16,
generated::kape_generated::KAPE_FILE_SUPERMIUM_BOOKMARKS,
generated::kape_generated::KAPE_FILE_SUPERMIUM_COOKIES,
generated::kape_generated::KAPE_FILE_SUPERMIUM_CURRENT_SE,
generated::kape_generated::KAPE_FILE_SUPERMIUM_CURRENT_TA,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_11,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_14,
generated::kape_generated::KAPE_FILE_SUPERMIUM_FAVICONS,
generated::kape_generated::KAPE_FILE_SUPERMIUM_HISTORY,
generated::kape_generated::KAPE_FILE_SUPERMIUM_LAST_SESSI,
generated::kape_generated::KAPE_FILE_SUPERMIUM_LAST_TABS,
generated::kape_generated::KAPE_FILE_SUPERMIUM_SESSIONS_F,
generated::kape_generated::KAPE_FILE_SUPERMIUM_LOGIN_DATA,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_14,
generated::kape_generated::KAPE_FILE_SUPERMIUM_NETWORK_AC,
generated::kape_generated::KAPE_FILE_SUPERMIUM_NETWORK_PE,
generated::kape_generated::KAPE_FILE_SUPERMIUM_PREFERENCE,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_15,
generated::kape_generated::KAPE_FILE_SUPERMIUM_REPORTING,
generated::kape_generated::KAPE_FILE_SUPERMIUM_SHORTCUTS,
generated::kape_generated::KAPE_FILE_SUPERMIUM_TOP_SITES,
generated::kape_generated::KAPE_FILE_SUPERMIUM_TRUST_TOKE,
generated::kape_generated::KAPE_FILE_SUPERMIUM_SYNCDATA_D,
generated::kape_generated::KAPE_FILE_SUPERMIUM_VISITED_LI,
generated::kape_generated::KAPE_FILE_SUPERMIUM_WEB_DATA,
generated::kape_generated::KAPE_FILE_PROTECT_15,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_14,
generated::kape_generated::KAPE_FILE_SYSTEM_SUPERMIUM_HIS,
generated::kape_generated::KAPE_FILE_BOOKMARKS_16,
generated::kape_generated::KAPE_FILE_COOKIES_12,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_16,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_16,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_12,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_15,
generated::kape_generated::KAPE_FILE_FAVICONS_17,
generated::kape_generated::KAPE_FILE_HISTORY_17,
generated::kape_generated::KAPE_FILE_LAST_SESSION_15,
generated::kape_generated::KAPE_FILE_LAST_TABS_15,
generated::kape_generated::KAPE_FILE_SESSIONS_16,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_17,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_15,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_17,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_16,
generated::kape_generated::KAPE_FILE_PREFERENCES_17,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_16,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_16,
generated::kape_generated::KAPE_FILE_SHORTCUTS_17,
generated::kape_generated::KAPE_FILE_TOP_SITES_17,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_15,
generated::kape_generated::KAPE_FILE_SYNC_DATA_6,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_17,
generated::kape_generated::KAPE_FILE_WEB_DATA_17,
generated::kape_generated::KAPE_FILE_PROTECT_16,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_15,
generated::kape_generated::KAPE_FILE_COOKIES_13,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_17,
generated::kape_generated::KAPE_FILE_FAVICONS_18,
generated::kape_generated::KAPE_FILE_HISTORY_18,
generated::kape_generated::KAPE_FILE_SESSIONS_17,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_18,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_18,
generated::kape_generated::KAPE_FILE_PREFERENCES_18,
generated::kape_generated::KAPE_FILE_TOP_SITES_18,
generated::kape_generated::KAPE_FILE_BOOKMARKS_17,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_18,
generated::kape_generated::KAPE_FILE_WEB_DATA_18,
generated::kape_generated::KAPE_FILE_USER_VIVALDI_REPORTING_DATA,
generated::kape_generated::KAPE_FILE_CALENDAR,
generated::kape_generated::KAPE_FILE_CONTACTS,
generated::kape_generated::KAPE_FILE_NOTES,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_13,
generated::kape_generated::KAPE_FILE_BOOKMARKS_18,
generated::kape_generated::KAPE_FILE_COOKIES_14,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_17,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_17,
generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_14,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_16,
generated::kape_generated::KAPE_FILE_FAVICONS_19,
generated::kape_generated::KAPE_FILE_HISTORY_19,
generated::kape_generated::KAPE_FILE_LAST_SESSION_16,
generated::kape_generated::KAPE_FILE_LAST_TABS_16,
generated::kape_generated::KAPE_FILE_SESSIONS_18,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_19,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_16,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_19,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_18,
generated::kape_generated::KAPE_FILE_PREFERENCES_19,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_17,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_17,
generated::kape_generated::KAPE_FILE_SHORTCUTS_18,
generated::kape_generated::KAPE_FILE_TOP_SITES_19,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_16,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_11,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_19,
generated::kape_generated::KAPE_FILE_WEB_DATA_19,
generated::kape_generated::KAPE_FILE_PROTECT_17,
generated::kape_generated::KAPE_FILE_SNAPSHOTS_16,
generated::kape_generated::KAPE_FILE_SYSTEM_WAVEBROWSER_H,
generated::kape_generated::KAPE_FILE_COOKIES_15,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_19,
generated::kape_generated::KAPE_FILE_FAVICONS_20,
generated::kape_generated::KAPE_FILE_HISTORY_20,
generated::kape_generated::KAPE_FILE_SESSIONS_19,
generated::kape_generated::KAPE_FILE_YA_PASSMAN_DATA,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_20,
generated::kape_generated::KAPE_FILE_PREFERENCES_20,
generated::kape_generated::KAPE_FILE_TOP_SITES_20,
generated::kape_generated::KAPE_FILE_BOOKMARKS_19,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_20,
generated::kape_generated::KAPE_FILE_WEB_DATA_20,
generated::kape_generated::KAPE_FILE_YA_AUTOFILL_DATA,
generated::kape_generated::KAPE_FILE_PASSMAN_LOGS,
generated::kape_generated::KAPE_FILE_SHORTCUTS_19,
generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE,
generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE,
generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE,
generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE,
generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE,
generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE,
generated::kape_generated::KAPE_FILE_SCHEDULEDTASKS_TKAPE,
generated::kape_generated::KAPE_FILE_SRUM_TKAPE,
generated::kape_generated::KAPE_FILE_THUMBCACHE_TKAPE,
generated::kape_generated::KAPE_FILE_USBDEVICESLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_WINDOWSINDEXSEARCH_TKAPE,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_TKAPE,
generated::kape_generated::KAPE_FILE_CLOUDSTORAGE_METADATA_TKAPE,
generated::kape_generated::KAPE_FILE_COMBINEDLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_GROUPPOLICY_TKAPE,
generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE_2,
generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_2,
generated::kape_generated::KAPE_FILE_FTPCLIENTS_TKAPE,
generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_2,
generated::kape_generated::KAPE_FILE_MESSAGINGCLIENTS_TKAPE,
generated::kape_generated::KAPE_FILE_NETWORKSCANNER_TKAPE,
generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE_2,
generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_2,
generated::kape_generated::KAPE_FILE_REMOTEADMIN_TKAPE,
generated::kape_generated::KAPE_FILE_SCHEDULEDTASKS_TKAPE_2,
generated::kape_generated::KAPE_FILE_SRUM_TKAPE_2,
generated::kape_generated::KAPE_FILE_SUM_TKAPE,
generated::kape_generated::KAPE_FILE_WER_TKAPE,
generated::kape_generated::KAPE_FILE_THUMBCACHE_TKAPE_2,
generated::kape_generated::KAPE_FILE_WBEM_TKAPE,
generated::kape_generated::KAPE_FILE_BITS_TKAPE,
generated::kape_generated::KAPE_FILE_WEBBROWSERS_TKAPE,
generated::kape_generated::KAPE_FILE_WINDOWSINDEXSEARCH_TKAPE_2,
generated::kape_generated::KAPE_FILE_WINDOWSTIMELINE_TKAPE,
generated::kape_generated::KAPE_FILE_AVAST_TKAPE,
generated::kape_generated::KAPE_FILE_AVG_TKAPE,
generated::kape_generated::KAPE_FILE_AVIRAAVLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_BITDEFENDER_TKAPE,
generated::kape_generated::KAPE_FILE_COMBOFIX_TKAPE,
generated::kape_generated::KAPE_FILE_CROWDSTRIKEFALCON_TKAPE,
generated::kape_generated::KAPE_FILE_CYBEREASON_TKAPE,
generated::kape_generated::KAPE_FILE_CYLANCE_TKAPE,
generated::kape_generated::KAPE_FILE_ELASTICDEFEND_TKAPE,
generated::kape_generated::KAPE_FILE_EMSISOFT_TKAPE,
generated::kape_generated::KAPE_FILE_ESET_TKAPE,
generated::kape_generated::KAPE_FILE_FSECURE_TKAPE,
generated::kape_generated::KAPE_FILE_HITMANPRO_TKAPE,
generated::kape_generated::KAPE_FILE_MALWAREBYTES_TKAPE,
generated::kape_generated::KAPE_FILE_MCAFEE_TKAPE,
generated::kape_generated::KAPE_FILE_MCAFEE_EPO_TKAPE,
generated::kape_generated::KAPE_FILE_MICROSOFTSAFETYSCANNER_TKAPE,
generated::kape_generated::KAPE_FILE_ROGUEKILLER_TKAPE,
generated::kape_generated::KAPE_FILE_SECUREAGE_TKAPE,
generated::kape_generated::KAPE_FILE_SENTINELONE_TKAPE,
generated::kape_generated::KAPE_FILE_SOPHOS_TKAPE,
generated::kape_generated::KAPE_FILE_SUPERANTISPYWARE_TKAPE,
generated::kape_generated::KAPE_FILE_SYMANTEC_AV_LOGS_TKAPE,
generated::kape_generated::KAPE_FILE_TOTALAV_TKAPE,
generated::kape_generated::KAPE_FILE_TRENDMICRO_TKAPE,
generated::kape_generated::KAPE_FILE_VIPRE_TKAPE,
generated::kape_generated::KAPE_FILE_WEBROOT_TKAPE,
generated::kape_generated::KAPE_FILE_WINDOWSDEFENDER_TKAPE,
generated::kape_generated::KAPE_FILE_BOXDRIVE_USERFILES_TKAPE,
generated::kape_generated::KAPE_FILE_DROPBOX_USERFILES_TKAPE,
generated::kape_generated::KAPE_FILE_GOOGLEDRIVEBACKUPSYNC_USERFILES_TKAPE,
generated::kape_generated::KAPE_FILE_ONEDRIVE_USERFILES_TKAPE,
generated::kape_generated::KAPE_FILE_PCLOUDDATABASE_TKAPE,
generated::kape_generated::KAPE_FILE_SUGARSYNC_TKAPE,
generated::kape_generated::KAPE_FILE_CLOUDSTORAGE_METADATA_TKAPE_2,
generated::kape_generated::KAPE_FILE_IDRIVE_TKAPE,
generated::kape_generated::KAPE_FILE_BOXDRIVE_METADATA_TKAPE,
generated::kape_generated::KAPE_FILE_DROPBOX_METADATA_TKAPE,
generated::kape_generated::KAPE_FILE_GOOGLEDRIVE_METADATA_TKAPE,
generated::kape_generated::KAPE_FILE_MEGASYNC_TKAPE,
generated::kape_generated::KAPE_FILE_ONEDRIVE_METADATA_TKAPE,
generated::kape_generated::KAPE_FILE_RCLONECONF_TKAPE,
generated::kape_generated::KAPE_FILE_FREEFILESYNC_TKAPE,
generated::kape_generated::KAPE_FILE_ONEDRIVE_METADATA_TKAPE_2,
generated::kape_generated::KAPE_FILE_REGISTRYHIVESUSER_TKAPE,
generated::kape_generated::KAPE_FILE_RECYCLEBIN_TKAPE,
generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_2,
generated::kape_generated::KAPE_FILE_EVENTTRACELOGS_TKAPE,
generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE_2,
generated::kape_generated::KAPE_FILE_POWERSHELLTRANSCRIPTS_TKAPE,
generated::kape_generated::KAPE_FILE_WINDOWSFIREWALL_TKAPE,
generated::kape_generated::KAPE_FILE_USBDEVICESLOGS_TKAPE_2,
generated::kape_generated::KAPE_FILE_NETCLRUSAGELOGS_TKAPE,
generated::kape_generated::KAPE_FILE_AMCACHE_TKAPE,
generated::kape_generated::KAPE_FILE_APPCOMPATPCA_TKAPE,
generated::kape_generated::KAPE_FILE_PREFETCH_TKAPE,
generated::kape_generated::KAPE_FILE_RECENTFILECACHE_TKAPE,
generated::kape_generated::KAPE_FILE_SYSCACHE_TKAPE,
generated::kape_generated::KAPE_FILE_EXCHANGECLIENTACCESS_TKAPE,
generated::kape_generated::KAPE_FILE_EXCHANGETRANSPORT_TKAPE,
generated::kape_generated::KAPE_FILE_EXCHANGESETUPLOG_TKAPE,
generated::kape_generated::KAPE_FILE_FILEZILLACLIENT_TKAPE,
generated::kape_generated::KAPE_FILE_FILEZILLASERVER_TKAPE,
generated::kape_generated::KAPE_FILE_WINSCP_TKAPE,
generated::kape_generated::KAPE_FILE_ROBO_FTP_TKAPE,
generated::kape_generated::KAPE_FILE_DIRECTORYOPUS_TKAPE,
generated::kape_generated::KAPE_FILE_DOUBLECOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_EFCOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_FREECOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_MIDNIGHTCOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_MULTICOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_ONECOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_Q_DIR_TKAPE,
generated::kape_generated::KAPE_FILE_SPEEDCOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_TABLACUSEXPLORER_TKAPE,
generated::kape_generated::KAPE_FILE_TOTALCOMMANDER_TKAPE,
generated::kape_generated::KAPE_FILE_XYPLORER_TKAPE,
generated::kape_generated::KAPE_FILE_MFT_TKAPE,
generated::kape_generated::KAPE_FILE_LOGFILE_TKAPE,
generated::kape_generated::KAPE_FILE_J_TKAPE,
generated::kape_generated::KAPE_FILE_SDS_TKAPE,
generated::kape_generated::KAPE_FILE_BOOT_TKAPE,
generated::kape_generated::KAPE_FILE_T_TKAPE,
generated::kape_generated::KAPE_FILE_HEXCHAT_TKAPE,
generated::kape_generated::KAPE_FILE_ICECHAT_TKAPE,
generated::kape_generated::KAPE_FILE_MIRC_TKAPE,
generated::kape_generated::KAPE_FILE_ANTIVIRUS_TKAPE_2,
generated::kape_generated::KAPE_FILE_CLOUDSTORAGE_METADATA_TKAPE_3,
generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_3,
generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE_3,
generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_3,
generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_3,
generated::kape_generated::KAPE_FILE_NOTEPAD_TKAPE,
generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE_3,
generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE_3,
generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_3,
generated::kape_generated::KAPE_FILE_REMOTEADMIN_TKAPE_2,
generated::kape_generated::KAPE_FILE_SCHEDULEDTASKS_TKAPE_3,
generated::kape_generated::KAPE_FILE_SRUM_TKAPE_3,
generated::kape_generated::KAPE_FILE_SUM_TKAPE_2,
generated::kape_generated::KAPE_FILE_WER_TKAPE_2,
generated::kape_generated::KAPE_FILE_WBEM_TKAPE_2,
generated::kape_generated::KAPE_FILE_WEBBROWSERS_TKAPE_2,
generated::kape_generated::KAPE_FILE_WINDOWSTIMELINE_TKAPE_2,
generated::kape_generated::KAPE_FILE_IRCCLIENTS_TKAPE,
generated::kape_generated::KAPE_FILE_CISCOJABBER_TKAPE,
generated::kape_generated::KAPE_FILE_DISCORD_TKAPE,
generated::kape_generated::KAPE_FILE_MATTERMOST_TKAPE,
generated::kape_generated::KAPE_FILE_MICROSOFTTEAMS_TKAPE,
generated::kape_generated::KAPE_FILE_SIGNAL_TKAPE,
generated::kape_generated::KAPE_FILE_SKYPE_TKAPE,
generated::kape_generated::KAPE_FILE_SLACK_TKAPE,
generated::kape_generated::KAPE_FILE_TELEGRAM_TKAPE,
generated::kape_generated::KAPE_FILE_VIBER_TKAPE,
generated::kape_generated::KAPE_FILE_WHATSAPP_TKAPE,
generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_4,
generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_4,
generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_4,
generated::kape_generated::KAPE_FILE_ADVANCEDIPSCANNER_TKAPE,
generated::kape_generated::KAPE_FILE_ADVANCEDPORTSCANNER_TKAPE,
generated::kape_generated::KAPE_FILE_SOFTPERFECTNETSCAN_TKAPE,
generated::kape_generated::KAPE_FILE_DC_TKAPE,
generated::kape_generated::KAPE_FILE_EMULE_TKAPE,
generated::kape_generated::KAPE_FILE_FROSTWIRE_TKAPE,
generated::kape_generated::KAPE_FILE_GIGATRIBE_TKAPE,
generated::kape_generated::KAPE_FILE_SHAREAZA_TKAPE,
generated::kape_generated::KAPE_FILE_SOULSEEK_TKAPE,
generated::kape_generated::KAPE_FILE_CHOCOLATEY_TKAPE,
generated::kape_generated::KAPE_FILE_AMCACHE_TKAPE_2,
generated::kape_generated::KAPE_FILE_APPCOMPATPCA_TKAPE_2,
generated::kape_generated::KAPE_FILE_PREFETCH_TKAPE_2,
generated::kape_generated::KAPE_FILE_RECENTFILECACHE_TKAPE_2,
generated::kape_generated::KAPE_FILE_SYSCACHE_TKAPE_2,
generated::kape_generated::KAPE_FILE_POWERSHELLTRANSCRIPTS_TKAPE_2,
generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE_4,
generated::kape_generated::KAPE_FILE_WBEM_TKAPE_3,
generated::kape_generated::KAPE_FILE_WER_TKAPE_3,
generated::kape_generated::KAPE_FILE_WINDOWSTIMELINE_TKAPE_3,
generated::kape_generated::KAPE_FILE_JUMPLISTS_TKAPE,
generated::kape_generated::KAPE_FILE_NETCLRUSAGELOGS_TKAPE_2,
generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE_4,
generated::kape_generated::KAPE_FILE_RECYCLEBIN_DATAFILES_TKAPE,
generated::kape_generated::KAPE_FILE_REGISTRYHIVESSYSTEM_TKAPE,
generated::kape_generated::KAPE_FILE_REGISTRYHIVESUSER_TKAPE_2,
generated::kape_generated::KAPE_FILE_REGISTRYHIVESMSIXAPPS_TKAPE,
generated::kape_generated::KAPE_FILE_ACTION1_TKAPE,
generated::kape_generated::KAPE_FILE_AMMYY_TKAPE,
generated::kape_generated::KAPE_FILE_ANYDESK_TKAPE,
generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_6,
generated::kape_generated::KAPE_FILE_DWAGENT_TKAPE,
generated::kape_generated::KAPE_FILE_ISLONLINE_TKAPE,
generated::kape_generated::KAPE_FILE_ITARIAN_TKAPE,
generated::kape_generated::KAPE_FILE_KASEYA_TKAPE,
generated::kape_generated::KAPE_FILE_LEVEL_TKAPE,
generated::kape_generated::KAPE_FILE_LOGMEIN_TKAPE,
generated::kape_generated::KAPE_FILE_MESHAGENT_TKAPE,
generated::kape_generated::KAPE_FILE_MREMOTENG_TKAPE,
generated::kape_generated::KAPE_FILE_NETMONITORFOREMPLOYEESPROFESSIONAL_TKAPE,
generated::kape_generated::KAPE_FILE_QUICKASSIST_TKAPE,
generated::kape_generated::KAPE_FILE_RADMIN_TKAPE,
generated::kape_generated::KAPE_FILE_RDPCACHE_TKAPE,
generated::kape_generated::KAPE_FILE_RDPLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_REMCOS_TKAPE,
generated::kape_generated::KAPE_FILE_REMOTEMANIPULATORSYSTEM_TKAPE,
generated::kape_generated::KAPE_FILE_REMOTEUTILITIES_APP_TKAPE,
generated::kape_generated::KAPE_FILE_RUSTDESK_TKAPE,
generated::kape_generated::KAPE_FILE_SCREENCONNECT_TKAPE,
generated::kape_generated::KAPE_FILE_SPLASHTOP_TKAPE,
generated::kape_generated::KAPE_FILE_SUPREMOREMOTEDESKTOP_TKAPE,
generated::kape_generated::KAPE_FILE_TEAMVIEWERLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_UEMS_TKAPE,
generated::kape_generated::KAPE_FILE_ULTRAVIEWER_TKAPE,
generated::kape_generated::KAPE_FILE_VNCLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_XEOX_TKAPE,
generated::kape_generated::KAPE_FILE_ZOHOASSIST_TKAPE,
generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_5,
generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE_4,
generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_5,
generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_4,
generated::kape_generated::KAPE_FILE_PREFETCH_TKAPE_3,
generated::kape_generated::KAPE_FILE_4K_VIDEO_DOWNLOADER_4K_VIDEO_DOWNLOADER_SQLITE_2,
generated::kape_generated::KAPE_FILE_FULLTEXTSEARCHINDEX_2,
generated::kape_generated::KAPE_FILE_ONENOTE_NOTIFICATIONSRECENTNOTEBOOKS_SEENURLS_2,
generated::kape_generated::KAPE_FILE_16_0_ACCESSIBILITYCHECKERINDEX_2,
generated::kape_generated::KAPE_FILE_16_0_NOTETAGS_LIVEID_DB_2,
generated::kape_generated::KAPE_FILE_16_0_RECENTSEARCHESRECENTSEARCHES_DB_2,
generated::kape_generated::KAPE_FILE_LOCALSTATE_PLUM_SQLITE_2,
generated::kape_generated::KAPE_FILE_TODOSQLITE_DB_2,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_SCHEDULERSERVICE_SQLITE_2,
generated::kape_generated::KAPE_FILE_TERACOPY_HISTORY_DB,
generated::kape_generated::KAPE_FILE_TERACOPY_MAIN_DB,
generated::kape_generated::KAPE_FILE_ROAMING_NOTION_NOTION_DB_2,
generated::kape_generated::KAPE_FILE_IDBS,
generated::kape_generated::KAPE_FILE_FILECACHE_DB,
generated::kape_generated::KAPE_FILE_CONFIG_DBX,
generated::kape_generated::KAPE_FILE_HOME_DB,
generated::kape_generated::KAPE_FILE_ICON_DB,
generated::kape_generated::KAPE_FILE_SYNC_HISTORY_DB,
generated::kape_generated::KAPE_FILE_SYNC_NUCLEUS_SQLITE3,
generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DB_2,
generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DBX_2,
generated::kape_generated::KAPE_FILE_SYNC_AGGREGATION_DBX,
generated::kape_generated::KAPE_FILE_AVATARCACHE_DB,
generated::kape_generated::KAPE_FILE_DROPBOX_METADATA,
generated::kape_generated::KAPE_FILE_CLOUD_GRAPH_CLOUD_GRAPH_DB,
generated::kape_generated::KAPE_FILE_CHANGE_BUFFER,
generated::kape_generated::KAPE_FILE_SNAPSHOT_DB,
generated::kape_generated::KAPE_FILE_SYNC_CONFIG_DB,
generated::kape_generated::KAPE_FILE_FILEZILLA_SQLITE3_2,
generated::kape_generated::KAPE_FILE_BOOKMARKS_20,
generated::kape_generated::KAPE_FILE_COOKIES_16,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_18,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_18,
generated::kape_generated::KAPE_FILE_FAVICONS_21,
generated::kape_generated::KAPE_FILE_HISTORY_21,
generated::kape_generated::KAPE_FILE_LAST_SESSION_17,
generated::kape_generated::KAPE_FILE_LAST_TABS_17,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_20,
generated::kape_generated::KAPE_FILE_PREFERENCES_21,
generated::kape_generated::KAPE_FILE_SHORTCUTS_20,
generated::kape_generated::KAPE_FILE_TOP_SITES_21,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_21,
generated::kape_generated::KAPE_FILE_WEB_DATA_21,
generated::kape_generated::KAPE_FILE_CHROME_BOOKMARKS_2,
generated::kape_generated::KAPE_FILE_CHROME_COOKIES_2,
generated::kape_generated::KAPE_FILE_CHROME_CURRENT_SESSI_2,
generated::kape_generated::KAPE_FILE_CHROME_CURRENT_TABS_2,
generated::kape_generated::KAPE_FILE_DOWNLOAD_METADATA,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_17,
generated::kape_generated::KAPE_FILE_CHROME_FAVICONS_2,
generated::kape_generated::KAPE_FILE_CHROME_HISTORY_2,
generated::kape_generated::KAPE_FILE_CHROME_LAST_SESSION_2,
generated::kape_generated::KAPE_FILE_CHROME_LAST_TABS_2,
generated::kape_generated::KAPE_FILE_CHROME_LOGIN_DATA_2,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_17,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_21,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_20,
generated::kape_generated::KAPE_FILE_CHROME_PREFERENCES_2,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_18,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_18,
generated::kape_generated::KAPE_FILE_CHROME_SHORTCUTS_2,
generated::kape_generated::KAPE_FILE_CHROME_TOP_SITES_2,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_17,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_12,
generated::kape_generated::KAPE_FILE_CHROME_VISITED_LINKS_2,
generated::kape_generated::KAPE_FILE_CHROME_WEB_DATA_2,
generated::kape_generated::KAPE_FILE_EDGE_BOOKMARKS,
generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_5,
generated::kape_generated::KAPE_FILE_EDGE_COOKIES,
generated::kape_generated::KAPE_FILE_EDGE_CURRENT_SESSION,
generated::kape_generated::KAPE_FILE_EDGE_CURRENT_TABS,
generated::kape_generated::KAPE_FILE_EDGE_FAVICONS,
generated::kape_generated::KAPE_FILE_EDGE_HISTORY,
generated::kape_generated::KAPE_FILE_EDGE_LAST_SESSION,
generated::kape_generated::KAPE_FILE_EDGE_LAST_TABS,
generated::kape_generated::KAPE_FILE_EDGE_LOGIN_DATA,
generated::kape_generated::KAPE_FILE_EDGE_MEDIA_HISTORY,
generated::kape_generated::KAPE_FILE_EDGE_NETWORK_ACTION,
generated::kape_generated::KAPE_FILE_EDGE_PREFERENCES,
generated::kape_generated::KAPE_FILE_EDGE_SHORTCUTS,
generated::kape_generated::KAPE_FILE_EDGE_TOP_SITES,
generated::kape_generated::KAPE_FILE_EDGE_SYNCDATA_DATABA,
generated::kape_generated::KAPE_FILE_BOOKMARKS_2_2,
generated::kape_generated::KAPE_FILE_EDGE_VISITED_LINKS,
generated::kape_generated::KAPE_FILE_EDGE_WEB_DATA,
generated::kape_generated::KAPE_FILE_ADDONS_SQLITE_2,
generated::kape_generated::KAPE_FILE_WEAVE_BOOKMARKS_SQLITE_2,
generated::kape_generated::KAPE_FILE_COOKIES_SQLITE_2,
generated::kape_generated::KAPE_FILE_FIREFOX_COOKIES_SQLITE_2,
generated::kape_generated::KAPE_FILE_DOWNLOADS_SQLITE_2,
generated::kape_generated::KAPE_FILE_FAVICONS_SQLITE_2,
generated::kape_generated::KAPE_FILE_FORMHISTORY_SQLITE_2,
generated::kape_generated::KAPE_FILE_PERMISSIONS_SQLITE_2,
generated::kape_generated::KAPE_FILE_PLACES_SQLITE_3,
generated::kape_generated::KAPE_FILE_PROTECTIONS_SQLITE_2,
generated::kape_generated::KAPE_FILE_SEARCH_SQLITE_2,
generated::kape_generated::KAPE_FILE_SIGNONS_SQLITE_2,
generated::kape_generated::KAPE_FILE_STORAGE_SYNC_SQLITE_2,
generated::kape_generated::KAPE_FILE_WEBAPPSTORE_SQLITE_2,
generated::kape_generated::KAPE_FILE_NOTIFICATIONS_WPNDATABASE_DB,
generated::kape_generated::KAPE_FILE_NOTIFICATIONS_APPDB_DAT,
generated::kape_generated::KAPE_FILE_ACTIVITIESCACHE_DB,
generated::kape_generated::KAPE_FILE_USOPRIVATE_UPDATESTORESTORE_DB,
generated::kape_generated::KAPE_FILE_REGEX_DB_DB_WAL_DB_SHM_2,
generated::kape_generated::KAPE_FILE_DIAGNOSIS_EVENTTRANSCRIPT_EVENTTRANSCRIPT_DB,
generated::kape_generated::KAPE_FILE_EVENTTRANSCRIPT_DB,
generated::kape_generated::KAPE_FILE_WEBSERVERS_TKAPE,
generated::kape_generated::KAPE_FILE_MONGODBLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_EXCHANGE_TKAPE,
generated::kape_generated::KAPE_FILE_CONFLUENCELOGS_TKAPE,
generated::kape_generated::KAPE_FILE_FILEZILLASERVER_TKAPE_2,
generated::kape_generated::KAPE_FILE_OPENSSHSERVER_TKAPE,
generated::kape_generated::KAPE_FILE_MANAGEENGINELOGS_TKAPE,
generated::kape_generated::KAPE_FILE_BITTORRENT_TKAPE,
generated::kape_generated::KAPE_FILE_QBITTORRENT_TKAPE,
generated::kape_generated::KAPE_FILE_UTORRENT_TKAPE,
generated::kape_generated::KAPE_FILE_USBDEVICESLOGS_TKAPE_3,
generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_5,
generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_6,
generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_5,
generated::kape_generated::KAPE_FILE_AMCACHE_TKAPE_3,
generated::kape_generated::KAPE_FILE_NEWSBINPRO_TKAPE,
generated::kape_generated::KAPE_FILE_NEWSLEECHER_TKAPE,
generated::kape_generated::KAPE_FILE_NZBGET_TKAPE,
generated::kape_generated::KAPE_FILE_SABNBZD_TKAPE,
generated::kape_generated::KAPE_FILE_VMWAREINVENTORY_TKAPE,
generated::kape_generated::KAPE_FILE_VMWAREMEMORY_TKAPE,
generated::kape_generated::KAPE_FILE_VIRTUALDISKS_TKAPE,
generated::kape_generated::KAPE_FILE_PROTONVPN_TKAPE,
generated::kape_generated::KAPE_FILE_OPENVPNCLIENT_TKAPE,
generated::kape_generated::KAPE_FILE_PALOALTO_TKAPE,
generated::kape_generated::KAPE_FILE_FORTICLIENTVPN_TKAPE,
generated::kape_generated::KAPE_FILE_PULSESECURE_TKAPE,
generated::kape_generated::KAPE_FILE_VIRTUALBOXLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_VIRTUALBOXMEMORY_TKAPE,
generated::kape_generated::KAPE_FILE_VIRTUALBOXCONFIG_TKAPE,
generated::kape_generated::KAPE_FILE_VIRTUALDISKS_TKAPE_2,
generated::kape_generated::KAPE_FILE_DEBIAN_TKAPE,
generated::kape_generated::KAPE_FILE_UBUNTU_TKAPE,
generated::kape_generated::KAPE_FILE_KALI_TKAPE,
generated::kape_generated::KAPE_FILE_OPENSUSE_TKAPE,
generated::kape_generated::KAPE_FILE_SUSELINUXENTERPRISESERVER_TKAPE,
generated::kape_generated::KAPE_FILE_360SECUREBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_ARC_TKAPE,
generated::kape_generated::KAPE_FILE_BRAVEBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_CHROME_TKAPE,
generated::kape_generated::KAPE_FILE_CHROMEBETA_TKAPE,
generated::kape_generated::KAPE_FILE_CHROMEDEV_TKAPE,
generated::kape_generated::KAPE_FILE_CHROMESXS_TKAPE,
generated::kape_generated::KAPE_FILE_CHROMIUM_TKAPE,
generated::kape_generated::KAPE_FILE_COCCOC_TKAPE,
generated::kape_generated::KAPE_FILE_EDGE_TKAPE,
generated::kape_generated::KAPE_FILE_EDGEBETACHROMIUM_TKAPE,
generated::kape_generated::KAPE_FILE_EDGECHROMIUM_TKAPE,
generated::kape_generated::KAPE_FILE_EDGEDEVCHROMIUM_TKAPE,
generated::kape_generated::KAPE_FILE_EDGESXSCHROMIUM_TKAPE,
generated::kape_generated::KAPE_FILE_FIREFOX_TKAPE,
generated::kape_generated::KAPE_FILE_INTERNETEXPLORER_TKAPE,
generated::kape_generated::KAPE_FILE_OPERA_TKAPE,
generated::kape_generated::KAPE_FILE_PRISMAACCESSBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_PUFFINSECUREBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_QQBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_SUPERMIUM_TKAPE,
generated::kape_generated::KAPE_FILE_UCBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_VIVALDI_TKAPE,
generated::kape_generated::KAPE_FILE_WAVEBROWSER_TKAPE,
generated::kape_generated::KAPE_FILE_YANDEX_TKAPE,
generated::kape_generated::KAPE_FILE_APACHEACCESSLOG_TKAPE,
generated::kape_generated::KAPE_FILE_IISLOGFILES_TKAPE,
generated::kape_generated::KAPE_FILE_NGINXLOGS_TKAPE,
generated::kape_generated::KAPE_FILE_MSSQLERRORLOG_TKAPE,
generated::kape_generated::KAPE_FILE_C_ACCESS_LOG,
generated::kape_generated::KAPE_FILE_W3SVC_LOG,
generated::kape_generated::KAPE_FILE_IIS_LOG_FILES,
generated::kape_generated::KAPE_FILE_LOGFILES_LOG,
generated::kape_generated::KAPE_FILE_W3SVC_LOG_2,
generated::kape_generated::KAPE_FILE_W3SVC_LOG_3,
generated::kape_generated::KAPE_FILE_HTTPERR_LOG,
generated::kape_generated::KAPE_FILE_FTPSVC_LOG,
generated::kape_generated::KAPE_FILE_LOG_2,
generated::kape_generated::KAPE_FILE_LOG_ERRORLOG,
generated::kape_generated::KAPE_FILE_MS_SQL_ERRORLOGS,
generated::kape_generated::KAPE_FILE_DESKTOPCENTRAL_SERVER_LOGS,
generated::kape_generated::KAPE_FILE_ADSELFSERVICE_PLUS_LOGS,
generated::kape_generated::KAPE_FILE_LOG_LOG_4,
generated::kape_generated::KAPE_FILE_LOGS_LOG_4,
generated::kape_generated::KAPE_FILE_MONGODB_LOGS_C_DATA,
generated::kape_generated::KAPE_FILE_MONGODB_LOGS_PROGRAM,
generated::kape_generated::KAPE_FILE_MONGODB_LOGS_ALTERNA,
generated::kape_generated::KAPE_FILE_LOGS_LOG_5,
generated::kape_generated::KAPE_FILE_PSREADLINE_HISTORY_TXT,
generated::kape_generated::KAPE_FILE_POWERSHELL_CONSOLE_L,
generated::kape_generated::KAPE_FILE_PSREADLINE_HISTORY_TXT_2,
generated::kape_generated::KAPE_FILE_AUTOSAVEFILES_PS1,
generated::kape_generated::KAPE_FILE_CONFIG,
generated::kape_generated::KAPE_FILE_BITTORRENT_DAT,
generated::kape_generated::KAPE_FILE_DC_LOGS,
generated::kape_generated::KAPE_FILE_FREENET_NODE,
generated::kape_generated::KAPE_FILE_FREENET_COMPLETED_LIST_DOWNLOADS,
generated::kape_generated::KAPE_FILE_FREENET_COMPLETED_LIST_UPLOADS,
generated::kape_generated::KAPE_FILE_FREENET_BAK,
generated::kape_generated::KAPE_FILE_FREENET_DOWNLOADS,
generated::kape_generated::KAPE_FILE_FROSTWIRE_TORRENT_DATA,
generated::kape_generated::KAPE_FILE_USER_FROSTWIRE5_FROSTWIRE_PROPS,
generated::kape_generated::KAPE_FILE_USER_FROSTWIRE5_ITUNES_PROPS,
generated::kape_generated::KAPE_FILE_LOCAL_SHALSOFT,
generated::kape_generated::KAPE_FILE_APPLICATION_DATA_GIGATRIBE,
generated::kape_generated::KAPE_FILE_APPLICATION_DATA_SHALSOFT,
generated::kape_generated::KAPE_FILE_NZBGET_NZBGET_LOG,
generated::kape_generated::KAPE_FILE_NZBGET_NZB,
generated::kape_generated::KAPE_FILE_NEWSBIN_DOWNLOADED_DB3,
generated::kape_generated::KAPE_FILE_NEWSLEECHER_DOWNLOADED_DAT,
generated::kape_generated::KAPE_FILE_NICOTINE_LOGS,
generated::kape_generated::KAPE_FILE_NICOTINE_INCOMPLETE,
generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYFILES_DB,
generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYSTREAMS_DB,
generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYMTIMES_DB,
generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYFILEINDEX_DB,
generated::kape_generated::KAPE_FILE_ROAMING_NICOTINE_BUDDYWORDINDEX_DB,
generated::kape_generated::KAPE_FILE_NICOTINE_CONFIG,
generated::kape_generated::KAPE_FILE_NICOTINE_USERSHARES,
generated::kape_generated::KAPE_FILE_ROAMING_NICOTINE_DOWNLOADS_JSON,
generated::kape_generated::KAPE_FILE_ROAMING_NICOTINE_UPLOADS_JSON,
generated::kape_generated::KAPE_FILE_LOGS_SABNZBD_LOG,
generated::kape_generated::KAPE_FILE_ADMIN_HISTORY1_DB,
generated::kape_generated::KAPE_FILE_ROAMING_SHAREAZA,
generated::kape_generated::KAPE_FILE_SOULSEEKQT_SOULSEEK_CHAT_LOGS,
generated::kape_generated::KAPE_FILE_1_DAT,
generated::kape_generated::KAPE_FILE_C_TORRENT,
generated::kape_generated::KAPE_FILE_C_NZB,
generated::kape_generated::KAPE_FILE_LOCAL_EMULE,
generated::kape_generated::KAPE_FILE_C_PART_MET,
generated::kape_generated::KAPE_FILE_QBITTORRENT_INI,
generated::kape_generated::KAPE_FILE_QBITTORRENT_LOGS,
generated::kape_generated::KAPE_FILE_QBITTORRENT_GEODB,
generated::kape_generated::KAPE_FILE_QBITTORRENT_BT_BACKUP,
generated::kape_generated::KAPE_FILE_UTORRENT_DAT,
generated::kape_generated::KAPE_FILE_C_BITMAP,
generated::kape_generated::KAPE_FILE_C_BOOT,
generated::kape_generated::KAPE_FILE_EXTEND_USNJRNL_J,
generated::kape_generated::KAPE_FILE_EXTEND_USNJRNL_MAX,
generated::kape_generated::KAPE_FILE_EXTEND_J,
generated::kape_generated::KAPE_FILE_EXTEND_MAX,
generated::kape_generated::KAPE_FILE_C_LOGFILE,
generated::kape_generated::KAPE_FILE_C_MFT,
generated::kape_generated::KAPE_FILE_C_MFTMIRR,
generated::kape_generated::KAPE_FILE_C_SECURE_SDS,
generated::kape_generated::KAPE_FILE_SDS,
generated::kape_generated::KAPE_FILE_TXFLOG_TOPS_T,
generated::kape_generated::KAPE_FILE_TXFLOG_T,
generated::kape_generated::KAPE_FILE_WINDOWS_NTDS,
generated::kape_generated::KAPE_FILE_WINDOWS_SYSVOL,
generated::kape_generated::KAPE_FILE_PROGRAMS_AMCACHE_HVE,
generated::kape_generated::KAPE_FILE_AMCACHE,
generated::kape_generated::KAPE_FILE_PROGRAMS_AMCACHE_HVE_LOG,
generated::kape_generated::KAPE_FILE_AMCACHE_TRANSACTION,
generated::kape_generated::KAPE_FILE_APPCOMPAT_PCA,
generated::kape_generated::KAPE_FILE_WINDOWSAPPS_DELETED,
generated::kape_generated::KAPE_FILE_WINDOWS_SYSTEMAPPS,
generated::kape_generated::KAPE_FILE_LOCAL_PACKAGES,
generated::kape_generated::KAPE_FILE_PACKAGES_STATEREPOSITORY_SRD,
generated::kape_generated::KAPE_FILE_PROGRAMDATA_PACKAGES,
generated::kape_generated::KAPE_FILE_CONFIG_APPEVENT_EVT,
generated::kape_generated::KAPE_FILE_APPLICATION_EVENT_LO,
generated::kape_generated::KAPE_FILE_LOGS_APPLICATION_EVTX,
generated::kape_generated::KAPE_FILE_LOGS_APPLICATION_EVTX_2,
generated::kape_generated::KAPE_FILE_BOOT_BCD,
generated::kape_generated::KAPE_FILE_BOOT_BCD_LOG,
generated::kape_generated::KAPE_FILE_NETWORK_DOWNLOADER,
generated::kape_generated::KAPE_FILE_CAPABILITYACCESSMANAGER_CAPABILITYACCESSMANAGER_DB,
generated::kape_generated::KAPE_FILE_MICROSOFT_CRYPTNETURLCACHE,
generated::kape_generated::KAPE_FILE_SYSTEM_WOW64_CRYPTNE,
generated::kape_generated::KAPE_FILE_USER_CRYPTNETURLCACH,
generated::kape_generated::KAPE_FILE_INETCACHE_IE,
generated::kape_generated::KAPE_FILE_DRIVERS_SYS,
generated::kape_generated::KAPE_FILE_PROGRAMS_ENCAPSULATIONLOGGING_HVE,
generated::kape_generated::KAPE_FILE_ENCAPSULATIONLOGGING,
generated::kape_generated::KAPE_FILE_PROGRAMS_ENCAPSULATIONLOGGING_HVE_LOG,
generated::kape_generated::KAPE_FILE_PROGRAMS_ENCAPSULATIONLOGGING_HVE_LOG_2,
generated::kape_generated::KAPE_FILE_LOGS_SYSTEM_EVTX,
generated::kape_generated::KAPE_FILE_EVENT_LOGS_WIN7,
generated::kape_generated::KAPE_FILE_LOGS_SECURITY_EVTX,
generated::kape_generated::KAPE_FILE_LOGS_SECURITY_EVTX_2,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_2,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCO,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCO_2,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONN,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONN_2,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSI,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSI_2,
generated::kape_generated::KAPE_FILE_CONFIG_EVT,
generated::kape_generated::KAPE_FILE_LOGS_EVTX,
generated::kape_generated::KAPE_FILE_EVENT_LOGS_WIN7_2,
generated::kape_generated::KAPE_FILE_LOGFILES_ETL,
generated::kape_generated::KAPE_FILE_WDI_TRACE_LOGS_1,
generated::kape_generated::KAPE_FILE_WDI,
generated::kape_generated::KAPE_FILE_WDI_TRACE_LOGS_2,
generated::kape_generated::KAPE_FILE_LOGFILES_WMI,
generated::kape_generated::KAPE_FILE_WMI_TRACE_LOGS,
generated::kape_generated::KAPE_FILE_SYSTEM32_SLEEPSTUDY,
generated::kape_generated::KAPE_FILE_SLEEPSTUDY_TRACE_LOG,
generated::kape_generated::KAPE_FILE_POWEREFFICIENCY_DIAGNOSTICS_ENERGY_NTKL_ETL,
generated::kape_generated::KAPE_FILE_LOGS_ETL,
generated::kape_generated::KAPE_FILE_DIAGNOSIS_EVENTTRANSCRIPT_EVENTTRANSCRIPT_DB_2,
generated::kape_generated::KAPE_FILE_EVENTTRANSCRIPT_DB_2,
generated::kape_generated::KAPE_FILE_TEMP_DIAGNOSTICS,
generated::kape_generated::KAPE_FILE_LOGGING_LOG,
generated::kape_generated::KAPE_FILE_B_A_ZA_Z0_9_8_B_COMPILED,
generated::kape_generated::KAPE_FILE_EXCHANGE_SERVER_MODI,
generated::kape_generated::KAPE_FILE_B_A_ZA_Z0_9_8_B_COMPILED_2,
generated::kape_generated::KAPE_FILE_B_A_ZA_Z0_9_8_B_COMPILED_3,
generated::kape_generated::KAPE_FILE_EXCHANGESETUPLOGS_EXCHANGESETUP_LOG,
generated::kape_generated::KAPE_FILE_LOGS_LOG_6,
generated::kape_generated::KAPE_FILE_SYSTEM32_GROUPPOLICY,
generated::kape_generated::KAPE_FILE_GROUP_POLICY_HISTORY,
generated::kape_generated::KAPE_FILE_USER_GROUP_POLICY_FI,
generated::kape_generated::KAPE_FILE_GROUPPOLICY_INI,
generated::kape_generated::KAPE_FILE_GROUPPOLICY_POL,
generated::kape_generated::KAPE_FILE_LOCAL_GROUP_POLICY_F,
generated::kape_generated::KAPE_FILE_SCRIPTS,
generated::kape_generated::KAPE_FILE_SCRIPTS_2,
generated::kape_generated::KAPE_FILE_ETC_HOSTS,
generated::kape_generated::KAPE_FILE_CONFIG_APPLICATIONHOST_CONFIG,
generated::kape_generated::KAPE_FILE_CONFIG_ADMINISTRATION_CONFIG,
generated::kape_generated::KAPE_FILE_CONFIG_REDIRECTION_CONFIG,
generated::kape_generated::KAPE_FILE_INETPUB_WWWROOT_WEB_CONFIG,
generated::kape_generated::KAPE_FILE_LOCAL_ICONCACHE_DB,
generated::kape_generated::KAPE_FILE_RECENT_AUTOMATICDESTINATIONS,
generated::kape_generated::KAPE_FILE_RECENT_CUSTOMDESTINATIONS,
generated::kape_generated::KAPE_FILE_WINDOWS_RECENT,
generated::kape_generated::KAPE_FILE_OFFICE_RECENT,
generated::kape_generated::KAPE_FILE_START_MENU_PROGRAMS_LNK,
generated::kape_generated::KAPE_FILE_USER_RECENT,
generated::kape_generated::KAPE_FILE_DESKTOP_LNK,
generated::kape_generated::KAPE_FILE_DESKTOP_LNK_FILES,
generated::kape_generated::KAPE_FILE_RP_LNK,
generated::kape_generated::KAPE_FILE_PROGRAMS_LNK,
generated::kape_generated::KAPE_FILE_BASH_HISTORY,
generated::kape_generated::KAPE_FILE_BASH_LOGOUT,
generated::kape_generated::KAPE_FILE_BASHRC,
generated::kape_generated::KAPE_FILE_PROFILE,
generated::kape_generated::KAPE_FILE_SYSTEM32_LOGFILES,
generated::kape_generated::KAPE_FILE_LOGFILES,
generated::kape_generated::KAPE_FILE_WINDOWS_PFRO_LOG,
generated::kape_generated::KAPE_FILE_C_MOF,
generated::kape_generated::KAPE_FILE_C_HIBERFIL_SYS,
generated::kape_generated::KAPE_FILE_C_PAGEFILE_SYS,
generated::kape_generated::KAPE_FILE_C_SWAPFILE_SYS,
generated::kape_generated::KAPE_FILE_MINIDUMP_DMP,
generated::kape_generated::KAPE_FILE_SMALL_MEMORY_DUMP_DI,
generated::kape_generated::KAPE_FILE_BACKSTAGEINAPPNAVCACHE,
generated::kape_generated::KAPE_FILE_CLR_LOG,
generated::kape_generated::KAPE_FILE_NET_CLR_USAGELOGS_SY,
generated::kape_generated::KAPE_FILE_LOCALSTATE_TABSTATE_BIN,
generated::kape_generated::KAPE_FILE_WINDOWSTATE_BIN,
generated::kape_generated::KAPE_FILE_SETTINGS_SETTINGS_DAT,
generated::kape_generated::KAPE_FILE_SYSTEMAPPDATA_HELIUM_DAT_2,
generated::kape_generated::KAPE_FILE_MICROSOFT_WORD,
generated::kape_generated::KAPE_FILE_MICROSOFT_EXCEL,
generated::kape_generated::KAPE_FILE_MICROSOFT_POWERPOINT,
generated::kape_generated::KAPE_FILE_MICROSOFT_PUBLISHER,
generated::kape_generated::KAPE_FILE_DIAGNOSTICS_PCW_DEBUGREPORT_XML,
generated::kape_generated::KAPE_FILE_ELEVATEDDIAGNOSTICS_PCW_DEBUGREPORT_XML,
generated::kape_generated::KAPE_FILE_OFFICEFILECACHE,
generated::kape_generated::KAPE_FILE_C_PERFLOGS,
generated::kape_generated::KAPE_FILE_POWERSHELL_7_POWERSHELL_CONFIG_JSON,
generated::kape_generated::KAPE_FILE_DOCUMENTS_POWERSHELL_TRANSCRIPT_TXT,
generated::kape_generated::KAPE_FILE_20_POWERSHELL_TRANSCRIPT_TXT,
generated::kape_generated::KAPE_FILE_POWERSHELL_TRANSCRIPT_TXT,
generated::kape_generated::KAPE_FILE_POWERSHELL_TRANSCRIP,
generated::kape_generated::KAPE_FILE_POWERSHELL_TRANSCRIPT_TXT_2,
generated::kape_generated::KAPE_FILE_20_POWERSHELL_TRANSCRIPT_TXT_2,
generated::kape_generated::KAPE_FILE_PREFETCH_PF,
generated::kape_generated::KAPE_FILE_PREFETCH,
generated::kape_generated::KAPE_FILE_C_PROGRAMDATA,
generated::kape_generated::KAPE_FILE_NOTIFICATIONS_APPDB_DAT_2,
generated::kape_generated::KAPE_FILE_NOTIFICATIONS_WPNDATABASE_DB_2,
generated::kape_generated::KAPE_FILE_TEMP_QUICKASSIST,
generated::kape_generated::KAPE_FILE_TEMP_REMOTEHELP,
generated::kape_generated::KAPE_FILE_TERMINAL_SERVER_CLIENT_CACHE,
generated::kape_generated::KAPE_FILE_WINDOWS_OLD_RDP_CACH,
generated::kape_generated::KAPE_FILE_RDP_CACHE_FILES,
generated::kape_generated::KAPE_FILE_PACKAGES_MICROSOFT_REMOTEDESKTOP_8WEKYB3D8BBWE,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONN_3,
generated::kape_generated::KAPE_FILE_REMOTECONNECTIONMANA,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSI_3,
generated::kape_generated::KAPE_FILE_LOCALSESSIONMANAGER,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_3,
generated::kape_generated::KAPE_FILE_RDPCLIENT_EVENT_LOGS,
generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCO_3,
generated::kape_generated::KAPE_FILE_RDPCORETS_EVENT_LOGS,
generated::kape_generated::KAPE_FILE_PROGRAMS_RECENTFILECACHE_BCF,
generated::kape_generated::KAPE_FILE_RECENTFILECACHE,
generated::kape_generated::KAPE_FILE_WINDOWS_RECENT_2,
generated::kape_generated::KAPE_FILE_OFFICE_RECENT_2,
generated::kape_generated::KAPE_FILE_RECYCLE_BIN_R,
generated::kape_generated::KAPE_FILE_R,
generated::kape_generated::KAPE_FILE_RECYCLE_D,
generated::kape_generated::KAPE_FILE_RECYCLE_BIN_I,
generated::kape_generated::KAPE_FILE_RECYCLE_INFO2,
generated::kape_generated::KAPE_FILE_HELIUM_REGISTRY_DAT,
generated::kape_generated::KAPE_FILE_REGISTRY_DAT,
generated::kape_generated::KAPE_FILE_REGISTRY_DAT_MSIX_HI,
generated::kape_generated::KAPE_FILE_SETTINGS_SETTINGS_DAT_2,
generated::kape_generated::KAPE_FILE_HELIUM_USER_DAT,
generated::kape_generated::KAPE_FILE_HELIUM_USERCLASSES_DAT,
generated::kape_generated::KAPE_FILE_CONFIG_BBI,
generated::kape_generated::KAPE_FILE_BBI_REGISTRY_HIVE,
generated::kape_generated::KAPE_FILE_CONFIG_BBI_LOG,
generated::kape_generated::KAPE_FILE_BBI_REGISTRY_TRANSAC,
generated::kape_generated::KAPE_FILE_CONFIG_BCD_TEMPLATE,
generated::kape_generated::KAPE_FILE_BCD_TEMPLATE_REGISTR,
generated::kape_generated::KAPE_FILE_CONFIG_BCD_TEMPLATE_LOG,
generated::kape_generated::KAPE_FILE_CONFIG_BCD_TEMPLATE_LOG_2,
generated::kape_generated::KAPE_FILE_CONFIG_COMPONENTS,
generated::kape_generated::KAPE_FILE_COMPONENTS_REGISTRY,
generated::kape_generated::KAPE_FILE_CONFIG_COMPONENTS_LOG,
generated::kape_generated::KAPE_FILE_CONFIG_COMPONENTS_LOG_2,
generated::kape_generated::KAPE_FILE_CONFIG_DRIVERS,
generated::kape_generated::KAPE_FILE_DRIVERS_REGISTRY_HIV,
generated::kape_generated::KAPE_FILE_CONFIG_DRIVERS_LOG,
generated::kape_generated::KAPE_FILE_DRIVERS_REGISTRY_TRA,
generated::kape_generated::KAPE_FILE_CONFIG_ELAM,
generated::kape_generated::KAPE_FILE_ELAM_REGISTRY_HIVE,
generated::kape_generated::KAPE_FILE_CONFIG_ELAM_LOG,
generated::kape_generated::KAPE_FILE_ELAM_REGISTRY_TRANSA,
generated::kape_generated::KAPE_FILE_CONFIG_USERDIFF,
generated::kape_generated::KAPE_FILE_USERDIFF_REGISTRY_HI,
generated::kape_generated::KAPE_FILE_CONFIG_USERDIFF_LOG,
generated::kape_generated::KAPE_FILE_USERDIFF_REGISTRY_TR,
generated::kape_generated::KAPE_FILE_CONFIG_VSMIDK,
generated::kape_generated::KAPE_FILE_VSMIDK_REGISTRY_HIVE,
generated::kape_generated::KAPE_FILE_CONFIG_VSMIDK_LOG,
generated::kape_generated::KAPE_FILE_VSMIDK_REGISTRY_TRAN,
generated::kape_generated::KAPE_FILE_CONFIG_SAM_LOG,
generated::kape_generated::KAPE_FILE_SAM_REGISTRY_TRANSAC,
generated::kape_generated::KAPE_FILE_CONFIG_SECURITY_LOG,
generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_TR,
generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_LOG,
generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_TR,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM_LOG,
generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_TRAN,
generated::kape_generated::KAPE_FILE_CONFIG_SAM,
generated::kape_generated::KAPE_FILE_SAM_REGISTRY_HIVE,
generated::kape_generated::KAPE_FILE_CONFIG_SECURITY,
generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_HI,
generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE,
generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_HI,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM,
generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_HIVE,
generated::kape_generated::KAPE_FILE_REGBACK_LOG,
generated::kape_generated::KAPE_FILE_REGBACK_REGISTRY_TRA,
generated::kape_generated::KAPE_FILE_REGBACK_SAM,
generated::kape_generated::KAPE_FILE_SAM_REGISTRY_HIVE_RE,
generated::kape_generated::KAPE_FILE_REGBACK_SECURITY,
generated::kape_generated::KAPE_FILE_REGBACK_SECURITY_2,
generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE,
generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE_2,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM_2,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1_2,
generated::kape_generated::KAPE_FILE_SYSTEMPROFILE_NTUSER_DAT,
generated::kape_generated::KAPE_FILE_SYSTEM_PROFILE_REGIS,
generated::kape_generated::KAPE_FILE_SYSTEMPROFILE_NTUSER_DAT_LOG,
generated::kape_generated::KAPE_FILE_SYSTEMPROFILE_NTUSER_DAT_LOG_2,
generated::kape_generated::KAPE_FILE_LOCALSERVICE_NTUSER_DAT,
generated::kape_generated::KAPE_FILE_LOCAL_SERVICE_REGIST,
generated::kape_generated::KAPE_FILE_LOCALSERVICE_NTUSER_DAT_LOG,
generated::kape_generated::KAPE_FILE_LOCALSERVICE_NTUSER_DAT_LOG_2,
generated::kape_generated::KAPE_FILE_NETWORKSERVICE_NTUSER_DAT,
generated::kape_generated::KAPE_FILE_NETWORK_SERVICE_REGI,
generated::kape_generated::KAPE_FILE_NETWORKSERVICE_NTUSER_DAT_LOG,
generated::kape_generated::KAPE_FILE_NETWORKSERVICE_NTUSER_DAT_LOG_2,
generated::kape_generated::KAPE_FILE_SNAPSHOT_REGISTRY,
generated::kape_generated::KAPE_FILE_USER_NTUSER_DAT,
generated::kape_generated::KAPE_FILE_NTUSER_DAT_REGISTRY,
generated::kape_generated::KAPE_FILE_USER_NTUSER_DAT_LOG,
generated::kape_generated::KAPE_FILE_CONFIG_DEFAULT,
generated::kape_generated::KAPE_FILE_NTUSER_DAT_DEFAULT_R,
generated::kape_generated::KAPE_FILE_CONFIG_DEFAULT_LOG,
generated::kape_generated::KAPE_FILE_NTUSER_DAT_DEFAULT_T,
generated::kape_generated::KAPE_FILE_WINDOWS_USRCLASS_DAT,
generated::kape_generated::KAPE_FILE_WINDOWS_USRCLASS_DAT_LOG,
generated::kape_generated::KAPE_FILE_C_NTUSER_DAT,
generated::kape_generated::KAPE_FILE_C_NTUSER_DAT_LOG,
generated::kape_generated::KAPE_FILE_C_DEFAULT,
generated::kape_generated::KAPE_FILE_C_DEFAULT_LOG,
generated::kape_generated::KAPE_FILE_C_USRCLASS_DAT,
generated::kape_generated::KAPE_FILE_C_USRCLASS_DAT_LOG,
generated::kape_generated::KAPE_FILE_C_LNK,
generated::kape_generated::KAPE_FILE_MICROSOFT_WORD_2,
generated::kape_generated::KAPE_FILE_MICROSOFT_EXCEL_2,
generated::kape_generated::KAPE_FILE_MICROSOFT_POWERPOINT_2,
generated::kape_generated::KAPE_FILE_MICROSOFT_PUBLISHER_2,
generated::kape_generated::KAPE_FILE_PUBLISHER_AUTOSAVE_L,
generated::kape_generated::KAPE_FILE_OFFICEFILECACHE_2,
generated::kape_generated::KAPE_FILE_OFFICE_DOCUMENT_CACH,
generated::kape_generated::KAPE_FILE_BOOKMARKS_21,
generated::kape_generated::KAPE_FILE_CHROME_BOOKMARKS_3,
generated::kape_generated::KAPE_FILE_COOKIES_17,
generated::kape_generated::KAPE_FILE_CHROME_COOKIES_3,
generated::kape_generated::KAPE_FILE_CURRENT_SESSION_19,
generated::kape_generated::KAPE_FILE_CHROME_CURRENT_SESSI_3,
generated::kape_generated::KAPE_FILE_CURRENT_TABS_19,
generated::kape_generated::KAPE_FILE_CHROME_CURRENT_TABS_3,
generated::kape_generated::KAPE_FILE_DOWNLOAD_METADATA_2,
generated::kape_generated::KAPE_FILE_CHROME_DOWNLOAD_META,
generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_18,
generated::kape_generated::KAPE_FILE_CHROME_EXTENSION_COO,
generated::kape_generated::KAPE_FILE_FAVICONS_22,
generated::kape_generated::KAPE_FILE_CHROME_FAVICONS_3,
generated::kape_generated::KAPE_FILE_HISTORY_22,
generated::kape_generated::KAPE_FILE_CHROME_HISTORY_3,
generated::kape_generated::KAPE_FILE_LAST_SESSION_18,
generated::kape_generated::KAPE_FILE_CHROME_LAST_SESSION_3,
generated::kape_generated::KAPE_FILE_LAST_TABS_18,
generated::kape_generated::KAPE_FILE_CHROME_LAST_TABS_3,
generated::kape_generated::KAPE_FILE_SESSIONS_20,
generated::kape_generated::KAPE_FILE_CHROME_SESSIONS_FOLD,
generated::kape_generated::KAPE_FILE_LOGIN_DATA_21,
generated::kape_generated::KAPE_FILE_CHROME_LOGIN_DATA_3,
generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_18,
generated::kape_generated::KAPE_FILE_CHROME_MEDIA_HISTORY,
generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_22,
generated::kape_generated::KAPE_FILE_CHROME_NETWORK_ACTIO,
generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_21,
generated::kape_generated::KAPE_FILE_CHROME_NETWORK_PERSI,
generated::kape_generated::KAPE_FILE_PREFERENCES_22,
generated::kape_generated::KAPE_FILE_CHROME_PREFERENCES_3,
generated::kape_generated::KAPE_FILE_QUOTAMANAGER_19,
generated::kape_generated::KAPE_FILE_CHROME_QUOTA_MANAGER,
generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_19,
generated::kape_generated::KAPE_FILE_CHROME_REPORTING_AND,
generated::kape_generated::KAPE_FILE_SHORTCUTS_21,
generated::kape_generated::KAPE_FILE_CHROME_SHORTCUTS_3,
generated::kape_generated::KAPE_FILE_TOP_SITES_22,
generated::kape_generated::KAPE_FILE_CHROME_TOP_SITES_3,
generated::kape_generated::KAPE_FILE_TRUST_TOKENS_18,
generated::kape_generated::KAPE_FILE_CHROME_TRUST_TOKENS,
generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_13,
generated::kape_generated::KAPE_FILE_CHROME_SYNCDATA_DATA,
generated::kape_generated::KAPE_FILE_VISITED_LINKS_22,
generated::kape_generated::KAPE_FILE_CHROME_VISITED_LINKS_3,
generated::kape_generated::KAPE_FILE_WEB_DATA_22,
generated::kape_generated::KAPE_FILE_CHROME_WEB_DATA_3,
generated::kape_generated::KAPE_FILE_PROTECT_18,
generated::kape_generated::KAPE_FILE_WINDOWS_PROTECT_FOLD,
generated::kape_generated::KAPE_FILE_PACKAGES_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_2,
generated::kape_generated::KAPE_FILE_EDGE_FOLDER,
generated::kape_generated::KAPE_FILE_C_AMCACHE_HVE,
generated::kape_generated::KAPE_FILE_C_AMCACHE_HVE_LOG,
generated::kape_generated::KAPE_FILE_WINDOWS_RECENT_3,
generated::kape_generated::KAPE_FILE_LNK_FILES_FROM_RECEN,
generated::kape_generated::KAPE_FILE_OFFICE_RECENT_3,
generated::kape_generated::KAPE_FILE_LNK_FILES_FROM_MICRO,
generated::kape_generated::KAPE_FILE_DESKTOP_LNK_FILES_2,
generated::kape_generated::KAPE_FILE_CCM_LOGS,
generated::kape_generated::KAPE_FILE_CUSTOM_SDB,
generated::kape_generated::KAPE_FILE_SDB_FILES,
generated::kape_generated::KAPE_FILE_CUSTOM64_SDB,
generated::kape_generated::KAPE_FILE_SDB_FILES_X64,
generated::kape_generated::KAPE_FILE_SYSTEM32_SRU,
generated::kape_generated::KAPE_FILE_SRUM,
generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_2,
generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_HI_2,
generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_LOG_2,
generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_TR_2,
generated::kape_generated::KAPE_FILE_LOGFILES_SUM,
generated::kape_generated::KAPE_FILE_TASKS_JOB,
generated::kape_generated::KAPE_FILE_AT_JOB,
generated::kape_generated::KAPE_FILE_WINDOWS_SCHEDLGU_TXT,
generated::kape_generated::KAPE_FILE_AT_SCHEDLGU_TXT,
generated::kape_generated::KAPE_FILE_SYSTEM32_TASKS,
generated::kape_generated::KAPE_FILE_SYSWOW64_TASKS,
generated::kape_generated::KAPE_FILE_XML,
generated::kape_generated::KAPE_FILE_POWERSHELL_SCHEDULEDJOBS,
generated::kape_generated::KAPE_FILE_OUTPUT,
generated::kape_generated::KAPE_FILE_POWERSHELL_SCHEDULED,
generated::kape_generated::KAPE_FILE_OUTPUT_2,
generated::kape_generated::KAPE_FILE_POWERSHELL_SCHEDULEDJOBS_2,
generated::kape_generated::KAPE_FILE_OUTPUT_3,
generated::kape_generated::KAPE_FILE_SYSTEM32_CATROOT,
generated::kape_generated::KAPE_FILE_SIGNATURECATALOG,
generated::kape_generated::KAPE_FILE_TEMPSTATE_PNG,
generated::kape_generated::KAPE_FILE_SNIP_SKETCH,
generated::kape_generated::KAPE_FILE_SCREENCLIP_JSON,
generated::kape_generated::KAPE_FILE_SCREENSHOTS_PNG,
generated::kape_generated::KAPE_FILE_SNIPS_PNG,
generated::kape_generated::KAPE_FILE_PROGRAMS_STARTUP,
generated::kape_generated::KAPE_FILE_SYSTEM_WIDE_STARTUP,
generated::kape_generated::KAPE_FILE_STARTUPINFO_XML,
generated::kape_generated::KAPE_FILE_STARTUPINFO_XML_FILE,
generated::kape_generated::KAPE_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE,
generated::kape_generated::KAPE_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE_LOG,
generated::kape_generated::KAPE_FILE_EXPLORER_THUMBCACHE_DB,
generated::kape_generated::KAPE_FILE_WINDOWS_SETUPAPI_LOG,
generated::kape_generated::KAPE_FILE_INF_SETUPAPI_LOG,
generated::kape_generated::KAPE_FILE_SETUPAPI_LOG_WIN7,
generated::kape_generated::KAPE_FILE_USERS_USER,
generated::kape_generated::KAPE_FILE_C_VHD,
generated::kape_generated::KAPE_FILE_C_VHDX,
generated::kape_generated::KAPE_FILE_C_VDI,
generated::kape_generated::KAPE_FILE_C_VMDK,
generated::kape_generated::KAPE_FILE_WBEM_REPOSITORY,
generated::kape_generated::KAPE_FILE_WBEM,
generated::kape_generated::KAPE_FILE_WINDOWS_WER,
generated::kape_generated::KAPE_FILE_WER_FILES,
generated::kape_generated::KAPE_FILE_CRASHDUMPS_DMP,
generated::kape_generated::KAPE_FILE_WINDOWS_DMP,
generated::kape_generated::KAPE_FILE_CRASH_DUMPS,
generated::kape_generated::KAPE_FILE_LOGCAT_LOG,
generated::kape_generated::KAPE_FILE_LOCALCACHE_PNG,
generated::kape_generated::KAPE_FILE_LOCALCACHE_ICO,
generated::kape_generated::KAPE_FILE_LOCALSTATE_APPCOMPATDB_JSON,
generated::kape_generated::KAPE_FILE_LOCALCACHE_USERDATA_VHDX,
generated::kape_generated::KAPE_FILE_ETC_DEBIAN_VERSION,
generated::kape_generated::KAPE_FILE_ETC_FSTAB,
generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE,
generated::kape_generated::KAPE_FILE_ETC_PASSWD,
generated::kape_generated::KAPE_FILE_ETC_GROUP,
generated::kape_generated::KAPE_FILE_ETC_SHADOW,
generated::kape_generated::KAPE_FILE_ETC_TIMEZONE,
generated::kape_generated::KAPE_FILE_ETC_HOSTNAME,
generated::kape_generated::KAPE_FILE_ETC_HOSTS_2,
generated::kape_generated::KAPE_FILE_ETC_CRONTAB,
generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC,
generated::kape_generated::KAPE_FILE_ETC_PROFILE,
generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY,
generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC,
generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE,
generated::kape_generated::KAPE_FILE_CRON_CRONTABS,
generated::kape_generated::KAPE_FILE_APT_LOG,
generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX,
generated::kape_generated::KAPE_FILE_ETC_DEBIAN_VERSION_2,
generated::kape_generated::KAPE_FILE_ETC_FSTAB_2,
generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_2,
generated::kape_generated::KAPE_FILE_ETC_PASSWD_2,
generated::kape_generated::KAPE_FILE_ETC_GROUP_2,
generated::kape_generated::KAPE_FILE_ETC_SHADOW_2,
generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_2,
generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_2,
generated::kape_generated::KAPE_FILE_ETC_HOSTS_3,
generated::kape_generated::KAPE_FILE_ETC_CRONTAB_2,
generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_2,
generated::kape_generated::KAPE_FILE_ETC_PROFILE_2,
generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_2,
generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_2,
generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_2,
generated::kape_generated::KAPE_FILE_CRON_CRONTABS_2,
generated::kape_generated::KAPE_FILE_APT_LOG_2,
generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_2,
generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_3,
generated::kape_generated::KAPE_FILE_ETC_FSTAB_3,
generated::kape_generated::KAPE_FILE_ETC_PASSWD_3,
generated::kape_generated::KAPE_FILE_ETC_GROUP_3,
generated::kape_generated::KAPE_FILE_ETC_SHADOW_3,
generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_3,
generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_3,
generated::kape_generated::KAPE_FILE_ETC_HOSTS_4,
generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_3,
generated::kape_generated::KAPE_FILE_ETC_PROFILE_3,
generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_3,
generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_3,
generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_3,
generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_3,
generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_4,
generated::kape_generated::KAPE_FILE_ETC_FSTAB_4,
generated::kape_generated::KAPE_FILE_ETC_PASSWD_4,
generated::kape_generated::KAPE_FILE_ETC_GROUP_4,
generated::kape_generated::KAPE_FILE_ETC_SHADOW_4,
generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_4,
generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_4,
generated::kape_generated::KAPE_FILE_ETC_HOSTS_5,
generated::kape_generated::KAPE_FILE_ETC_CRONTAB_3,
generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_4,
generated::kape_generated::KAPE_FILE_ETC_PROFILE_4,
generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_4,
generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_4,
generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_4,
generated::kape_generated::KAPE_FILE_CRON_CRONTABS_3,
generated::kape_generated::KAPE_FILE_APT_LOG_3,
generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_4,
generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_5,
generated::kape_generated::KAPE_FILE_ETC_FSTAB_5,
generated::kape_generated::KAPE_FILE_ETC_PASSWD_5,
generated::kape_generated::KAPE_FILE_ETC_GROUP_5,
generated::kape_generated::KAPE_FILE_ETC_SHADOW_5,
generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_5,
generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_5,
generated::kape_generated::KAPE_FILE_ETC_HOSTS_6,
generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_5,
generated::kape_generated::KAPE_FILE_ETC_PROFILE_5,
generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_5,
generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_5,
generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_5,
generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_5,
generated::kape_generated::KAPE_FILE_DIAGOUTPUTDIR_WINDOWS365,
generated::kape_generated::KAPE_FILE_COREAIPLATFORM_00_UKP,
generated::kape_generated::KAPE_FILE_FIREWALL_PFIREWALL,
generated::kape_generated::KAPE_FILE_WINDOWS_FIREWALL_LOG,
generated::kape_generated::KAPE_FILE_CRYPTO_KEYS,
generated::kape_generated::KAPE_FILE_S_1_5_18_USER,
generated::kape_generated::KAPE_FILE_MICROSOFT_NGC,
generated::kape_generated::KAPE_FILE_CONFIG_SECURITY_LOG_2,
generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_TR_2,
generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_LOG_3,
generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_TR_3,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM_LOG_2,
generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_TRAN_2,
generated::kape_generated::KAPE_FILE_CONFIG_SECURITY_2,
generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_HI_2,
generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_3,
generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_HI_3,
generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM_2,
generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_HIVE_2,
generated::kape_generated::KAPE_FILE_REGBACK_SECURITY_3,
generated::kape_generated::KAPE_FILE_REGBACK_SECURITY_2_2,
generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE_3,
generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE_2_2,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM_3,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM_2_2,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1_3,
generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1_2_2,
generated::kape_generated::KAPE_FILE_APPLICATIONS_WINDOWS,
generated::kape_generated::KAPE_FILE_APPLICATIONS_S_1,
generated::kape_generated::KAPE_FILE_S_1_GATHERLOGS,
generated::kape_generated::KAPE_FILE_WINDOWS_GATHERLOGS,
generated::kape_generated::KAPE_FILE_DRIVERS_ETC,
generated::kape_generated::KAPE_FILE_NOTIFICATIONS_WPNDATABASE_DB_3,
generated::kape_generated::KAPE_FILE_NOTIFICATIONS_APPDB_DAT_3,
generated::kape_generated::KAPE_FILE_WINDOWS_PANTHERMIGLOG_XML,
generated::kape_generated::KAPE_FILE_WINDOWS_PANTHERSETUPACT_LOG,
generated::kape_generated::KAPE_FILE_WINDOWS_PANTHER_HUMANREADABLE_XML,
generated::kape_generated::KAPE_FILE_PANTHER_ROLLBACKFOLDERMOVELOG_TXT,
generated::kape_generated::KAPE_FILE_USOPRIVATE_UPDATESTORESTORE_DB_2,
generated::kape_generated::KAPE_FILE_WINDOWS_POWER_EFFICIENCY_DIAGNOSTICS,
generated::kape_generated::KAPE_FILE_CONFIG_NETLOGON,
generated::kape_generated::KAPE_FILE_SYSTEM32_DNS,
generated::kape_generated::KAPE_FILE_SYSTEM32_DHCP,
generated::kape_generated::KAPE_FILE_DIAGNOSIS_EVENTS_RBS,
generated::kape_generated::KAPE_FILE_LEGACY_RBS_FILES_REL,
generated::kape_generated::KAPE_FILE_CONNECTEDDEVICESPLATFORM_ACTIVITIESCACHE_DB,
generated::kape_generated::KAPE_FILE_SYSTEM_ETL,
generated::kape_generated::KAPE_FILE_WINDOWSUPDATE_WINDOWSUPDATE_ETL,
generated::kape_generated::KAPE_FILE_CBS_CBS_LOG,
generated::kape_generated::KAPE_FILE_SOFTWAREDISTRIBUTION_DATASTORE,
generated::kape_generated::KAPE_FILE_C_SYSTEM_VOLUME_INFORMATION,
// ── nirsoft_generated (22 entries) ────────────────────────────────────
generated::nirsoft_generated::NIRSOFT_LAST_ACTIVITY_RECENT_ITEMS,
generated::nirsoft_generated::NIRSOFT_BROWSING_HISTORY_CHROME,
generated::nirsoft_generated::NIRSOFT_BROWSING_HISTORY_FIREFOX,
generated::nirsoft_generated::NIRSOFT_NETWORK_CONNECT_LOG,
generated::nirsoft_generated::NIRSOFT_USBDEVIEW_ENUM_USB,
generated::nirsoft_generated::NIRSOFT_USBDEVIEW_ENUM_USBSTOR,
generated::nirsoft_generated::NIRSOFT_SHELLBAGS_USRCLASS_BAGS,
generated::nirsoft_generated::NIRSOFT_SHELLBAGS_NTUSER_BAGS,
generated::nirsoft_generated::NIRSOFT_JUMPLISTS_AUTOMATIC_DESTINATIONS,
generated::nirsoft_generated::NIRSOFT_JUMPLISTS_CUSTOM_DESTINATIONS,
generated::nirsoft_generated::NIRSOFT_MUICACHE_LOCAL_SETTINGS,
generated::nirsoft_generated::NIRSOFT_RECENTFILES_RECENTDOCS_KEY,
generated::nirsoft_generated::NIRSOFT_WIFI_HISTORY_PROFILES_DIR,
generated::nirsoft_generated::NIRSOFT_NETWORK_PASSWORDS_CRED_DIR,
generated::nirsoft_generated::NIRSOFT_SAM_HIVE_REG,
generated::nirsoft_generated::NIRSOFT_REGISTRY_CHANGES_NTUSER,
generated::nirsoft_generated::NIRSOFT_OPENED_FILES_VIEW_HANDLE,
generated::nirsoft_generated::NIRSOFT_PROCESS_ACTIVITY_PREFETCH,
generated::nirsoft_generated::NIRSOFT_INSTALLED_CODEC_AUDIO,
generated::nirsoft_generated::NIRSOFT_STARTUP_RUN_HKLM_RUN,
generated::nirsoft_generated::NIRSOFT_STARTUP_RUN_HKCU_RUN,
generated::nirsoft_generated::NIRSOFT_APP_CRASH_DUMPS_DIR,
// ── regedit_generated (44 entries) ────────────────────────────────────
generated::regedit_generated::REGEDIT_NETWORK,
generated::regedit_generated::REGEDIT_MICROSOFT_INTERNET_EXPLORER_TYPEDURLS,
generated::regedit_generated::REGEDIT_USER_MRU,
generated::regedit_generated::REGEDIT_MICROSOFT_TERMINAL_SERVER_CLIENT,
generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_CIDSIZEMRU,
generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_FIRSTFOLDER,
generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_LASTVISITEDPIDLMRU,
generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_LASTVISITEDPIDLMRULEGACY,
generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_OPENSAVEPIDLMRU,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_FILEEXTS,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_RECENTDOCS,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_MOUNTPOINTS2,
generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUN,
generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUNONCE,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_RUNMRU,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_TYPEDPATHS,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_USERASSIST,
generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_WORDWHEELQUERY,
generated::regedit_generated::REGEDIT_CURRENTVERSION_SEARCH_RECENTAPPS,
generated::regedit_generated::REGEDIT_DOMAINS_ACCOUNT_USERS,
generated::regedit_generated::REGEDIT_MICROSOFT_WINDOWS_NT_CURRENTVERSION,
generated::regedit_generated::REGEDIT_WINDOWS_NT_CURRENTVERSION_NETWORKLIST,
generated::regedit_generated::REGEDIT_POLICIES_EXPLORER_RUN,
generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUN_SYSTEM_RUN_KEY,
generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUNONCE_SYSTEM_RUNONCE,
generated::regedit_generated::REGEDIT_MICROSOFT_WINDOWS_PORTABLE_DEVICES_DEVICES,
generated::regedit_generated::REGEDIT_CONTROL_COMPUTERNAME_COMPUTERNAME,
generated::regedit_generated::REGEDIT_CONTROL_SESSION_MANAGER_APPCOMPATCACHE,
generated::regedit_generated::REGEDIT_CONTROLSET00_CONTROL_TIMEZONEINFORMATION,
generated::regedit_generated::REGEDIT_SYSTEM_CONTROLSET00_SERVICES,
generated::regedit_generated::REGEDIT_SERVICES_BAM_USERSETTINGS,
generated::regedit_generated::REGEDIT_SERVICES_DAM_USERSETTINGS,
generated::regedit_generated::REGEDIT_SERVICES_LANMANSERVER_SHARES,
generated::regedit_generated::REGEDIT_TCPIP_PARAMETERS_INTERFACES,
generated::regedit_generated::REGEDIT_PARAMETERS_INTERFACES,
generated::regedit_generated::REGEDIT_SYSTEM_MOUNTEDDEVICES,
generated::regedit_generated::REGEDIT_SYSTEM_SETUP,
REGEDIT_SYSTEM_SELECT,
generated::regedit_generated::REGEDIT_CONTROLSET00_CONTROL_WINDOWS,
generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST,
generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_PRO,
generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_RUN,
generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_SID,
generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_STA,
// ── velociraptor_generated (122 entries) ────────────────────────────────────
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_SYSMON_4OPERATIONAL,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_DOCX_DOCM_DOTX_DOTM_DOCB_XLSX_XLSM_XLTX_XL,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_USERS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_C_PROGRAM_FILES,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP_LOCALLOGS_LOG,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_ACCESS_LOG_ACCESS_LOG,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_BIN_LS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_EXE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_IMAGE_DD,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_MANIFEST_JSON,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_EXTENSIONS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_RUN_DOCKER_SOCK,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_APT_LISTS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_DPKG_STATUS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_RUN_SNAPD_SOCKET,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_JOURNAL,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SBIN_AUDITCTL,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG_AUTH_LOG,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SYSLOGTIMESTAMP_TIMESTAMP_SYSLOGFACILITY_S,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_HOME,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROC_MOUNTS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_NET_ARP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROC_MODULES,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SBIN_NFT,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SSH_AUTHORIZED_KEYS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SSH_PEM_ID_RSA_ID_DSA,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_ACPI_TABLES,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_HISTORY,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROC_STAT,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_CRONTABS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_CRON_WEEKLY,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_GROUP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG_WTMP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_USR,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_PASSWD,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG_AUTH_LOG_SECURE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_BIN_SYNC,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_FINDER_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_COM_APPLE_XPC_LAUNCHD_DISABLED_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TABS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_RECEIPTS_INSTALLHISTORY_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_DOWNLOADS_ZIP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_DOCK_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARA,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_COM_APPLE_TCC_TCC_DB,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_TIMEMACHINE_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_USERS_PLIST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SYSTEMCONFIGURATION_COM_APPLE_AIRPORT_PREF,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_YAML_YML,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_YAML,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TO_IMAGE_VMDK,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_REMAPPING_WRITEBACK_YAML,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_1_YAML,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_FAVICONS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_3_LOG,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_LOG,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEAMVIEWER_CONNECTIONS_INCOMING_TXT,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_COLLECTION_ZIP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROGRAMS_AMCACHE_HVE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_INVENTORY_FILE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_DLL,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINDOWS_SYSMON64_EXE,
generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_RUN,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_RTF_DOC_DOT_DOCX_DOCM_DOTX_DOTM_DOCB_XLS_X,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINDOWS_SYSTEM32,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP_WINPMEM_SYS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SECURITY_EVTX,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SYSTEM_SECURITY_EVTX,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINEVT_LOGS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_EVTX,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4OPERATI,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SYSTEM_EVTX,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LO,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_TASKSCHEDULER_4OPER,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SYMANTEC_ENDPOINT_PROTECTION_CLIENT_E,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_APPLICATION_EVTX,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP_PROCESSES_SQLITE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_METADATA,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_METADATA_2,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_AUTOMATICDESTINATIONS_AUTOMATICDESTINATION,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_LNK,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINDOWSTATE_01_BIN,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TABSTATE_BIN,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFETCH_PF,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_PST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_CACHE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_NTUSER_DAT,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_I,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_CONFIG_SAM,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SRU_SRUDB_DAT,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_ACTIVITIESCACHE_DB,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_SUM,
generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_IMAGE_FILE_EXECUTION_OPTIONS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_V1_0_PROFILE_MICROSOFT_PROFILE_PS1,
generated::velociraptor_generated::VELOCIRAPTOR_MICROSOFT_WOW64,
generated::velociraptor_generated::VELOCIRAPTOR_SESSION_MANAGER_APPCOMPATCACHE_APPCOMPATCACHE,
generated::velociraptor_generated::VELOCIRAPTOR_CONTROL_BACKUPRESTORE,
generated::velociraptor_generated::VELOCIRAPTOR_SERVICES_PORTPROXY,
generated::velociraptor_generated::VELOCIRAPTOR_SOFTWARE_SYSINTERNALS,
generated::velociraptor_generated::VELOCIRAPTOR_SECURITYPROVIDERS_WDIGEST,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_TASKS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_V1_0_POWERSHELL_EXE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_HOSTS,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_HOSTS_VELOCIRAPTOR_BACKUP,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_VHDX,
generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_PROFILELIST,
generated::velociraptor_generated::VELOCIRAPTOR_APPCOMPATFLAGS_INSTALLEDSDB,
generated::velociraptor_generated::VELOCIRAPTOR_CUSTOM,
generated::velociraptor_generated::VELOCIRAPTOR_FIREWALLRULES,
generated::velociraptor_generated::VELOCIRAPTOR_SYSTEM_RESOURCES_PHYSICAL_MEMORY_TRANSLATED,
generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_UNINSTALL,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_CAT,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_POWERSHELL_MODULEANALYSISCACHE,
generated::velociraptor_generated::VELOCIRAPTOR_SYSTEM_CURRENTCONTROLSET_SERVICES,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_DLL_EXE,
generated::velociraptor_generated::VELOCIRAPTOR_FILE_C_MFT,
// ── Browser-forensic v2 profiles ─────────────────────────────────────
browser_ext::BROWSER_CHROME_HISTORY,
browser_ext::BROWSER_CHROME_COOKIES,
browser_ext::BROWSER_CHROME_DOWNLOADS,
browser_ext::BROWSER_CHROME_BOOKMARKS,
browser_ext::BROWSER_CHROME_EXTENSIONS,
browser_ext::BROWSER_CHROME_LOGIN_DATA_V2,
browser_ext::BROWSER_CHROME_AUTOFILL,
browser_ext::BROWSER_CHROME_CACHE,
browser_ext::BROWSER_CHROME_SESSION,
browser_ext::BROWSER_CHROME_SESSION_MEMORY,
browser_ext::BROWSER_FIREFOX_HISTORY,
browser_ext::BROWSER_FIREFOX_COOKIES,
browser_ext::BROWSER_FIREFOX_DOWNLOADS,
browser_ext::BROWSER_FIREFOX_SESSION_MEMORY,
browser_ext::BROWSER_SAFARI_HISTORY,
// ── iOS ─────────────────────────────────────────────────────────────────
macos_ext::IOS_UNIFIED_LOG,
macos_ext::IOS14_MAPS_HISTORY,
macos_ext::HEIC_IMAGE_FILE,
macos_ext::UBER_IOS_LEVELDB,
macos_ext::IOS_GOOGLE_CHAT_CACHEV0,
macos_ext::IOS_MOBILE_CONTAINER_MANAGER,
macos_ext::APPLE_ATX_TEXTURE_CONTAINER,
macos_ext::IOS_ATX_POSTERBOARD_RUNTIME_SNAPSHOT,
macos_ext::IOS_ATX_POSTER_SNAPSHOT_CACHE,
macos_ext::IOS_ATX_AVATAR_ANIMOJI_TEXTURE,
macos_ext::MACOS_BTM_BACKGROUND_TASKS,
windows_files_ext::ONEDRIVE_ODL_LOGS,
// ── Android ─────────────────────────────────────────────────────────────
android_ext::SAMSUNG_GALLERY3D_TRASH,
android_ext::SAMSUNG_GALLERY3D_LOG,
android_ext::ANDROID_TOR_BROWSER_THUMBNAILS,
android_ext::ANDROID_GBOARD_TRAININGCACHE,
// ── Memory forensics (VAD/malfind, netscan, handles/threads, callbacks, DKOM) ──
windows_memory_ext::MEM_PROCESS_INJECTION,
windows_memory_ext::MEM_NETWORK_SCAN,
windows_memory_ext::MEM_HANDLES_THREADS,
windows_memory_ext::MEM_KERNEL_CALLBACKS,
windows_memory_ext::MEM_HIDDEN_PROCESSES,
// ── Disk / NTFS / registry (timestomping, VSS, $LogFile, WMI persistence) ──
windows_ntfs_ext::NTFS_TIMESTOMPING_SI_FN,
windows_ntfs_ext::NTFS_LOGFILE_RECORDS,
windows_vss_ext::VSS_SNAPSHOT_ANALYSIS,
windows_wmi_ext::WMI_PERSISTENCE_CIM_REPOSITORY,
// ── Cloud services (Google Takeout, AWS CloudTrail) ────────────────────
cloud_ext::GOOGLE_TAKEOUT_LOCATION_RECORDS,
cloud_ext::GOOGLE_TAKEOUT_SEMANTIC_LOCATION_HISTORY,
cloud_ext::AWS_CLOUDTRAIL_IAM_EVENTS,
// ── Vehicle infotainment (Honda Accord 2016) ─────────────────────────────
vehicle_ext::HONDA_ACCORD_RECENTSTOPS,
vehicle_ext::HONDA_ACCORD_CRM_ECO_LOGS,
vehicle_ext::HONDA_ACCORD_PHONEDB,
vehicle_ext::HONDA_ACCORD_BLUETOOTH,
// ── GPS devices (Garmin) ─────────────────────────────────────────────────
vehicle_ext::GARMIN_NUVI_VOICE_LOG,
// ── FA stub upgrades: RunServices, FirewallAuthorizedApps, COM persistence ─
windows_registry_ext3::RUN_SERVICES_HKLM,
windows_registry_ext3::RUN_SERVICES_HKCU,
windows_registry_ext3::RUN_SERVICES_ONCE_HKLM,
windows_registry_ext3::RUN_SERVICES_ONCE_HKCU,
windows_registry_ext3::FIREWALL_AUTHORIZED_APPS,
windows_registry_ext3::SSODL,
windows_registry_ext3::SHARED_TASK_SCHEDULER,
// ── FA stub upgrades batch 2: linux/esxi/credential_provider_filters ──────
windows_registry_ext3::CREDENTIAL_PROVIDER_FILTERS,
// linux_ext::LINUX_ETC_PASSWD removed — duplicate of LINUX_PASSWD in mod.rs
linux_ext::ESXI_ATTESTD_LOG,
linux_ext::ESXI_ESXTOKEND_LOG,
linux_ext::ESXI_KMXA_LOG,
// ── dfir_scripts_generated (404 entries) ─── dfir-scripts.github.io registry artifacts
generated::dfir_scripts_generated::DFIR_SCRIPTS_COMMON_OPEN_FIND,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_OFFICE_14_0,
generated::dfir_scripts_generated::DFIR_SCRIPTS_15_0_WORD_READING_LOCATIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_OFFICE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_OFFICE_COMMON,
generated::dfir_scripts_generated::DFIR_SCRIPTS_VERSION_APP_ADDINS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_OUTLOOK_WEBVIEW_INBOX,
generated::dfir_scripts_generated::DFIR_SCRIPTS_OFFICE_TEST_SPECIAL_PERF,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_WINDOWS_MESSAGING_SUBSYSTEM_PROF,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_MESSAGING_SUBSYSTEM_PROFILES_OUTLOOK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_PROFILES_OUTLOOK_0A0D020000000000C0000000000000,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MEDIAPLAYER_PREFERENCES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MEDIAPLAYER_PLAYER_RECENTFILELIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFT_MANAGEMENT_CONSOLE_RECENT_F,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_SNAPSHOT_VIEWER_RECENT_FILE_LIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MICROSOFT_SPEECH,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_UNREADMAIL,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_DEPENDENCY_WALKER_RECENT_FILE_LIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RUNONCEEX,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_STARTUPAPPROVED_RUN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_STARTUPAPPROVED_RUN32,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_STARTUPAPPROVED_STARTUPFOLDER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RUN_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RUNONCE_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RUN_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RUNONCE_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_POLICIES_EXPLORER_RUN_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RUN_5,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_WOW6432NODE_CLSID,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_CLSID,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SESSION_MANAGER_APPCERTDLLS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_WINDOWS_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_WINLOGON_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_TERMINAL_SERVER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_TERMINAL_SERVER_WINSTATIONS_RDP_TCP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_STARTUP_0_0,
generated::dfir_scripts_generated::DFIR_SCRIPTS_STARTUP_0_0_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_SHELLICONOVERLAYIDENTIF,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_SHELL_FOLDERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_USER_SHELL_FOLDERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_SERVICES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_SVCHOST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_LSA,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_PRINT_MONITORS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SHELL_RUNAS_COMMAND,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_SESSION_MANAGER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_APPV_CLIENT_RUNVIRTUAL,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_WINDOWS_SYSTEMLOOKUP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SHELL_OPEN_COMMAND,
generated::dfir_scripts_generated::DFIR_SCRIPTS_IEAK_GROUPPOLICY_PENDINGGPOS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WORDPAD_COMCHECKS_SAFELIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SESSION_MANAGER_KNOWNDLLS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_AEDEBUG,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_NETFRAMEWORK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WBEM_ESS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_WINDOWS_ERROR_REPORTING,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SHELLEX_CONTEXTMENUHANDLERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_PROTOCOLS_HANDLER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_CTF_LANGBARADDIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINSOCK2_PARAMETERS_PROTOCOL_CATALOG9,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINSOCK2_PARAMETERS_NAMESPACE_CATALOG5,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_NETWORKPROVIDER_ORDER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_SECURITYPROVIDERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_SESSION_MANAGER_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ACTIVATABLECLASSES_PACKAGE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_PACKAGEDAPPXDEBUG,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MICROSOFT_ONEDRIVE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_LXSS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BAM_STATE_USERSETTINGS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_SRUM_EXTENSIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_DEFAULTOBJECTSTORE_OBJECTTABLE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_ESENT_PROCESS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_RADAR_HEAPLEAKDETECTION_DIAGNOSEDAPPLICATIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_FILESYSTEM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLIENTS_MEDIA_ANYDESK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_ANYDESK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SHELL_OPEN_COMMAND_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SHELL_OPEN_COMMAND_4,
generated::dfir_scripts_generated::DFIR_SCRIPTS_PRINTERS_ANYDESK_PRINTER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_DEVICEIDS_USBPRINT_ANYDESK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_UNINSTALL_ANYDESK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_CITRIX_GOTOMYPC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CITRIX_GOTOMYPC_GUESTINVITE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_GOTOMYPC_FILETRANSFER_HISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_GOTOMYPC_FILETRANSFER_HISTORY_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_RDCLIENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_VEYON_SOLUTIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_VEYONSERVICE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_TEAMVIEWER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_WOW6432NODE_TEAMVIEWER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_TEAMVIEWER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_TEAMVIEWER_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_TEAMVIEWER_CONNECTIONHISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_SCREENCONNECT_CLIENT_GUID,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_SCREENCONNECT_CLIENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_WOW6432NODE_SCREENCONNECT_CLIENT_GUID,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_LOGMEIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_WOW6432NODE_LOGMEIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_LMIGUARDIANSVC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_LOGMEIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_SPLASHTOP_INC_SPLASHTOP_REMOTE_SERVER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_SPLASHTOP_INC_SPLASHTOP_REMOTE_SERV,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_SPLASHTOPREMOTESERVI,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ATERA_NETWORKS_ATERAAGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_ATERA_NETWORKS_ATERAAGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_ATERAAGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_KASEYA_AGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_KASEYA_AGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_KASEYAREMOTECONTROLH,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_LABTECH_SERVICE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_LABTECH_SERVICE_SETTINGS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_LTSVC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_CENTRASTAGE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_WOW6432NODE_CENTRASTAGE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_CAGSERVICE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_REPAIRTECH_SYNCRO,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_SYNCRO,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_NINJARMM_LLC_NINJARMM_AGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_NINJARMMAGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_SUPREMOCONTROL_SUPREMO,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_SUPREMOCONTROL_SUPREMO_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_IDRIVE_INC_REMOTEPC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_REMOTEPCSERVICE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_IDRIVE_INC_REMOTEPC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ZOHO_CORP_ZOHOASSIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_ZOHOASSIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ACTION1,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_ACTION1AGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_FLEETDECK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_FLEETDECKAGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_OPEN_SOURCE_MESH_AGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_MESH_AGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ADMIN_ARSENAL_PDQ_DEPLOY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_ADMIN_ARSENAL_PDQ_DEPLOY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_SIMPLEHELP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_SIMPLEHELP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_REMOTE_UTILITIES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_WOW6432NODE_REMOTE_UTILITIES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTCONTROLSET_SERVICES_RUTSERV,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_DEFENDER_REAL_TIME_PROTECTION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_SYSTEM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_LOCKY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_TRANSPAN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_SHIPTR,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_SHIPUP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLIENTS_NETRAU,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLIENTS_SDATA,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_BJ_STATIC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_FAST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_XXXX,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_BINARY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BINARY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BEGIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_HTMLHELP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_RPC_INTERNET,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_NETWORK_SHARINGHANDLER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MICROSOFT_CLOCK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MICROSOFT_CURRENTHALINF,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MICROSOFT_CURRENTPNPSETUP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_OFFICE_TEST_SPECIAL_PERF_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WBEM_WMIC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ESS_ROOT_CIMV2_WIN32CLOCKPROVIDER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ADOBE_ARM_1_0_ARM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ADOBE_READER_IPM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MAIN_FEATURECONTROL_FEATURE_BROWSER_EMULATION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_UPDATE_NETWORK_SECURE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WRDATA,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WOW6432NODE_WRDATA,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WRDATA_THREATS_HISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WRDATA_THREATS_HISTORY_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_ACCOUNT_MANAGER_ACCOUNTS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_AUTOCOMPLETE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_SETTINGS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_TOOLBAR,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_ADVANCED,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_SYSTEM_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_MAIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_INTERNET_SETTINGS_ZONES_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_RELIABILITY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SECURITYPROVIDERS_WDIGEST_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_OEMMGMT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_DECAFME,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_UNINSTALL_NETASSISTANT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MOZILLA_FIREFOX_EXTENSIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_UPDATE_NETWORK_SECURE_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INTERNET_SETTINGS_URLZONE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_EXPLORER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ADATUMCORPORATION_OPENCANDY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_SERVICES_MSUPDATE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_POLICIES_MICROSOFT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_CAIN_SETTINGS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ORL_WINVNC3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ORL_WINVNC3_DEFAULT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ORL_WINVNC_DEFAULT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_REALVNC_DEFAULT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_REALVNC_WINVNC4,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ORL_VNCVIEWER_MRU,
generated::dfir_scripts_generated::DFIR_SCRIPTS_REALVNC_VNCVIEWER4_MRU,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ORL_VNCHOOKS_APPLICATION_PREFS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SIMONTATHAM_PUTTY_SSHHOSTKEYS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SIMONTATHAM_PUTTY_SSHHOSTKEYS_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MARTIN_PRIKRYL_WINSCP_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MARTIN_PRIKRYL_WINSCP_2_SSHHOSTKEYS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SERVICES_TERMSERVICE_PARAMETERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NETWORKLIST_SIGNATURES_MANAGED,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NETWORKLIST_SIGNATURES_UNMANAGED,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NLA_CACHE_INTRANET,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NETWORKLIST_NLA_WIRELESS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_NETWORK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_NETWORK_4D36E972_E325_11CE_BFC1_08002BE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_TCPIP_PARAMETERS_INTERFACES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_NETWORKSETUP2_INTERFACES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_EAPOL_PARAMETERS_INTERFACES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_NETWORKCARDS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_COMPUTERNAME_COMPUTERNAME,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SERVICES_TCPIP_PARAMETERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_TCPIP_PARAMETERS_PERSISTENTROUTES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SERVICES_LANMANSERVER_SHARES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_EXPLORER_WORKGROUPCRAWLER_SHARES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_SKYPE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_SERVICES_PSEXESVC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_FILEZILLA3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_UNINSTALL_FILEZILLA,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MEGA_LIMITED_MEGASYNC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_UNINSTALL_MEGASYNC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_FAMATECH_ADVANCED_IP_SCANNER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_FAMATECH_ADVANCED_IP_SCANNER_STATE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NETSUPPORT_LTD_NETSUPPORT_MANAGER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_SERVICES_NETSUPPORT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_BITBUCKET,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_BITBUCKET_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_ADVANCED_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_COMDLG32,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_EXPLORER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_SCHEDULE_TASKCACHE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SECURITYPROVIDERS_WDIGEST_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_MICROSOFT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_MICROSOFT_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_MICROSOFT_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_PRINT_PRINTERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_PRINT_PRINTERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_PRINTERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_PRINTERPORTS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SETTINGS_WIZARD_CONNECTMRU,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_GROUP_POLICY_HISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_FILEHISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NAVCLIENT_1_1_HISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_GOOGLE_TOOLBAR_4_0_WHITELIST,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BAGS_1_DESKTOP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_SHELLNOROAM_BAGS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ENTIRE_HIVE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ALL_KEYS_ALL_HIVES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_YARA_RULE_SCAN_ENTIRE_HIVE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_USER_LOCATION_SERVICE_CLIENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_SEARCH_VOLUMEINFOCACHE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_EXPLORER_STARTUPAPPROVED_RUN32,
generated::dfir_scripts_generated::DFIR_SCRIPTS_EXPLORER_STARTUPAPPROVED_STARTUPFOLDER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_ALLOWEDENUMERATION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_CURRENTVERSION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_PANEL_DON_T_LOAD,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_PANEL_INTERNATIONAL_GEO,
generated::dfir_scripts_generated::DFIR_SCRIPTS_VSS_DIAG_SYSTEMRESTORE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_EXFILTRATION_CLOUD_SYNC,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_TUNNELING_C2_RELAY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_TUNNELING_PORT_FORWARDING,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_CREDENTIAL_HARVESTING,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_CREDENTIAL_HARVESTING_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_ACTIVE_DIRECTORY_RECONNAISSANCE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_LATERAL_MOVEMENT_CREDENTIAL_ACCESS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_ACTIVE_DIRECTORY_RECONNAISSANCE_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_NETWORK_RECONNAISSANCE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_NETWORK_RECONNAISSANCE_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_C2_FRAMEWORK,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_C2_FRAMEWORK_OPEN_SOURCE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_NO_REGISTRY_C2_FRAMEWORK_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_POLICY_POLADTEV,
generated::dfir_scripts_generated::DFIR_SCRIPTS_POLICY_POLACDMS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_POLICY_POLPRDMS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_DOMAINS_BUILTIN_ALIASES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_LSA_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_1_SHELLIDS_MICROSOFT_POWERSHELL,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_POWERSHELL,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_DEFENDER_REAL_TIME_PROTECTION_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_SYSTEM_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_SAFER_CODEIDENTIFIERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_SECURITY_CENTER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_NT_WINDOWS_FILE_PROTECTION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_ADVANCED_PROTECTION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_SCRIPT_HOST_SETTINGS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_REMOTEACCESS_PARAMETERS_ACCOUNTLOCKOUT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_FILE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_PROGRAMS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_INVENTORYAPPLICATIONSHORTCUT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_INVENTORYDEVICECONTAINER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_INVENTORYDEVICEPNP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_INVENTORYDRIVERBINARY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ROOT_INVENTORYMISCELLANEOUSOFFICEADDIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_UNINSTALL_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_UNINSTALL_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_APPCOMPATFLAGS_CUSTOM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_APPCOMPATFLAGS_INSTALLEDSDB,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_APPCOMPATFLAGS_LAYERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SHELL_OPEN_COMMAND_5,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLIENTS_STARTMENUINTERNET,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_CLIENTS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLASSES_INSTALLER_PRODUCTS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INSTALLER_USERDATA,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_APP_MANAGEMENT_ARPCACHE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WINDOWS_CURRENTVERSION_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_COMPONENT_BASED_SERVICING_PACKAG,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_CURRENTVERSION_SIDEBYSIDE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SESSION_MANAGER_ENVIRONMENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_BACKUPRESTORE_FILESNOTTOBACKUP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_BACKUPRESTORE_FILESNOTTOSNAPSHOT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_BACKUPRESTORE_KEYSNOTTORESTORE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SESSION_MANAGER_MEMORY_MANAGEMENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SESSION_MANAGER_MEMORY_MANAGEMENT_PREFETCHPARAM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_SAFEBOOT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_SESSION_MANAGER_POWER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_WINDOWS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_CONTROL_TIMEZONEINFORMATION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_NLS_CODEPAGE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_WATCHDOG_DISPLAY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_WINRAR_ARCHISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINRAR_DIALOGEDITHISTORY_ARCNAME,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINRAR_DIALOGEDITHISTORY_EXTRPATH,
generated::dfir_scripts_generated::DFIR_SCRIPTS_AVGENERAL_CRECENTFILES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_FOXIT_SOFTWARE_FOXIT_READER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_NICO_MAK_COMPUTING_WINZIP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_7_ZIP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_VS_REVO_GROUP_REVO_UNINSTALLER_PRO_UNINSTALLER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ERASER_ERASER_6,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_PIRIFORM_CCLEANER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_VMWARE_PLAYER_VMPLAYER_WINDOW_POSITION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WBEM_CIMOM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WBEM_WDM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWSBACKUP_SCHEDULEPARAMS_TARGETDEVICE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_WINDOWSBACKUP_STATUS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CLIENT_SUPERSOCKETNETLIB_LASTCONNECT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINCLIENT_SOFTWAREMONITORING_MONITORLOG,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_PRIVOXY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_BINDSHELL_NET_ODYSSEUS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_IMGBURN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_NICO_MAK_COMPUTING_WINZIP_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_AOL_INSTANT_MESSENGER_TM_CURRENTVERSION_USERS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_ARES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_REALPLAYER_6_0_PREFERENCES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_YAHOO_PAGER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_JAVASOFT_JAVA_PLUG_IN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WAB_DLLPATH,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ODBC_ODBC_INI,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_SERVICES_NTDS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_SERVICES_EVENTLOG,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_SPP_CLIENTS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_REMOVALTOOLS_MRT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_REGISTRY_REGIDLEBACKUP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_SCHEDULINGAGENT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_WOW64_ARM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_RPC_INTERNET_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_DFRG_BOOTOPTIMIZEFUNCTION,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_NT_CURRENTVERSION_SYSTEMRESTORE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_LICENSES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_TRACING,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BLIZZARD_ENTERTAINMENT_WARCRAFT_III_STRING,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_ENUM_USBSTOR,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_ENUM_USB,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BTHPORT_PARAMETERS_DEVICES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_BTHPORT_PARAMETERS_RADIO_SUPPORT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_ENUM_BTHENUM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WIDCOMM_BTCONFIG_DEVICES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ENUM_SWD_WPDBUSENUM,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_ENUM_WPDBUSENUMROOT,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_CLASS_6BDD1FC6_810F_11D0_BEC7_08002BE20,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_STILLIMAGE_LOGGING,
generated::dfir_scripts_generated::DFIR_SCRIPTS_ENUM_SWD_DAFUPNPPROVIDER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_DEVICECLASSES_53F56307_B6BF_11D0_94F2_0,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROL_DEVICECLASSES_53F5630D_B6BF_11D0_94F2_0,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CONTROLSET001_ENUM_IDE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_SOFTWARE_MICROSOFT_INTERNET_EXPLORER,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_SEARCHSCOPES,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INTERNET_SETTINGS_AUTOCOMPLETE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INTERNET_SETTINGS_DOMSTORAGE,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INTERNET_SETTINGS_MAIN,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INTERNET_SETTINGS_PRIVACY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_INTERNET_SETTINGS_ZONEMAP,
generated::dfir_scripts_generated::DFIR_SCRIPTS_INTERNET_SETTINGS_SUBKEY_HISTORY,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_TOOLBAR_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_EXTENSIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_MICROSOFT_4,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_MICROSOFT_5,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_MICROSOFT_6,
generated::dfir_scripts_generated::DFIR_SCRIPTS_DEFAULTACCOUNT_WINDOWS_DATA_TASKFLOW_SHELLACTIV,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_ASSOCIATIONS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_ATTACHMENTS,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_SHELLNOROAM_BAGMRU,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_SHELLNOROAM_BAGS_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_WINDOWS_SHELL_BAGMRU_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_EXPLORER_ADVANCED_3,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_COMDLG32_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_CURRENTVERSION_POLICIES_EXPLORER_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_SEARCH_ASSISTANT_ACMRU,
generated::dfir_scripts_generated::DFIR_SCRIPTS_MICROSOFT_INTERNET_EXPLORER_MAIN_2,
generated::dfir_scripts_generated::DFIR_SCRIPTS_INTERNET_SETTINGS_ZONES_3_2,
];